Loader[.]rar | Triage™

General

Target
Loader.rar
Size 1.1MB
Sample260819-ym3pcsvthv
SHA256 c72d63f457ec53b1bd7fb9a56290808dd8d16c1808c74260000883ab7a581f3e
MD5 c98c22aafcc7e395e9d80be9ad85cd9e
SHA1 266bce7a71d3e85631ba6061a1cd59fb232453ea
SHA512 ddb9d09857483fa3e8b2ba20e7df49e111ce09c10d36592a55217d46e11b215a3f4a3c216ffdf1ea10224b1e1161f0627df54acd6e305da6b97ae7eac3bca879
SSDEEP 24576:qcpXBeXTACytGvT/UkydToy9O/sJCW4SJeK6dG7t9zPLL+nqBJ511lzG3j:FBeDA9uydTowGsJCWnMK6uJBJM
TLSH
T18335337FCF15B53BF1C456F5B46BE4826894A62A86293F2B4DB2BBD0C5300E41A44F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/Loader.exe	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Loader.exe

File Explorer

Loader.rar

.rar 1.1MB
Loader.exe

.exe 1.1MB

Loader.rar

SHA256 c72d63f457ec53b1bd7fb9a56290808dd8d16c1808c74260000883ab7a581f3e
MD5 c98c22aafcc7e395e9d80be9ad85cd9e
SHA1 266bce7a71d3e85631ba6061a1cd59fb232453ea
SHA512 ddb9d09857483fa3e8b2ba20e7df49e111ce09c10d36592a55217d46e11b215a3f4a3c216ffdf1ea10224b1e1161f0627df54acd6e305da6b97ae7eac3bca879
SSDEEP 24576:qcpXBeXTACytGvT/UkydToy9O/sJCW4SJeK6dG7t9zPLL+nqBJ511lzG3j:FBeDA9uydTowGsJCWnMK6uJBJM
TLSH
T18335337FCF15B53BF1C456F5B46BE4826894A62A86293F2B4DB2BBD0C5300E41A44F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Loader.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c
MD5 c525491a369b3d926183c5ed3533a5d9
SHA1 365a5301bab12a7512d636a415c3fca3cf568e3d
SHA512 5e73fbf150cd593a64fb3656dfab157bbafefe3aaa1cae71cf6b5f4b6ebd3c585ff184c82165936256134d06b220c6f22b91e83caf8d2eb3cfa0f2f420620439
SSDEEP 24576:NpbdQQqZl8nmoiCqOKGnTpPs9xYo3wxoVrHUgZ:rR5qZ6m0nTpPsPy+jr
TLSH
T1583512CCB52472EED957C032CAD85C68AA50BC77831B5607A8AB106DAD4DCC7DF291F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1187850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Loader.rar

Loader.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Loader.rar

Loader.exe

mscoree

dotnet