ExLoader_Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader_Installer.exe
Size 22.2MB
Sample260821-eccweafr41
SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
MD5 e6316f8cf95a39fa15ae3b429bdee860
SHA1 43f39b21c1af9616c387a10e29394e2bafb067b9
SHA512 c6147f0adff15e71e2541ee1f9cea43b88343799b256012a68cd26ff9e5a50950aba5fb7ed2c4b56e474e0c7772c90d87446295d997a098902c24f588a638614
SSDEEP 393216:Fy7xm6OlKHpbsjgPHa7kyzzFBQPzql6s+HsdRDFhudYQI4OZMKmargPG1IqAysE2:wZOlKHEgpyvFC+l6uRgtI4O6Kma8ZqGf
TLSH
T1403733C1BBCD61BDE431D8BEE0166182D11BBF954199F22A9B6BD2CCCC936405C36B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExLoader_Installer.exe

File Explorer

ExLoader_Installer.exe

.exe 22.2MB

ExLoader_Installer.exe

IMPHASH 5f5c4d3663cd5c9660ea403fe416cb2f
SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
MD5 e6316f8cf95a39fa15ae3b429bdee860
SHA1 43f39b21c1af9616c387a10e29394e2bafb067b9
SHA512 c6147f0adff15e71e2541ee1f9cea43b88343799b256012a68cd26ff9e5a50950aba5fb7ed2c4b56e474e0c7772c90d87446295d997a098902c24f588a638614
SSDEEP 393216:Fy7xm6OlKHpbsjgPHa7kyzzFBQPzql6s+HsdRDFhudYQI4OZMKmargPG1IqAysE2:wZOlKHEgpyvFC+l6uRgtI4O6Kma8ZqGf
TLSH
T1403733C1BBCD61BDE431D8BEE0166182D11BBF954199F22A9B6BD2CCCC936405C36B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxzip64\Release\sfxzip.pdb

comctl32

ord17

kernel32

SetFileAttributesW GetFullPathNameA MoveFileA DeleteFileA DeleteFileW CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetTickCount WideCharToMultiByte MultiByteToWideChar GetVersionExA GlobalAlloc lstrlenA GetModuleFileNameA FindResourceA GetModuleHandleA HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess SetFileAttributesA GetNumberFormatA lstrcmpiA GetProcAddress DosDateTimeToFileTime GetDateFormatA GetTimeFormatA FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsA WaitForSingleObject SetCurrentDirectoryA Sleep GetTempPathA MoveFileExA GetModuleFileNameW SetEnvironmentVariableA GetCommandLineA LocalFileTimeToFileTime SystemTimeToFileTime IsDBCSLeadByte GetCPInfo FreeLibrary LoadLibraryA GetCurrentDirectoryA GetFileAttributesW GetFileAttributesA WriteFile SetFileTime GetStdHandle ReadFile CreateFileW SetLastError CreateFileA GetFileType SetFilePointer CloseHandle SetEndOfFile GetLastError GetLocaleInfoA

user32

LoadStringA CharToOemBuffA OemToCharBuffA CharLowerA wvsprintfA FindWindowExA GetClassNameA ReleaseDC GetDC SendMessageA wsprintfA SetDlgItemTextA EndDialog DestroyIcon SendDlgItemMessageA GetDlgItemTextA DialogBoxParamA IsWindowVisible WaitForInputIdle GetSysColor PostMessageA SetMenu SetFocus SetWindowPos LoadIconA CharToOemA OemToCharA MapWindowPoints CreateWindowExA UpdateWindow SetWindowTextA LoadCursorA RegisterClassExA SetWindowLongPtrA GetWindowLongPtrA DefWindowProcA PeekMessageA GetMessageA DispatchMessageA DestroyWindow GetClientRect CopyRect IsWindow MessageBoxA ShowWindow GetDlgItem GetWindowTextA GetSystemMetrics GetWindow GetWindowLongA SetWindowLongA CharUpperA GetWindowRect LoadBitmapA GetParent EnableWindow TranslateMessage

gdi32

GetDeviceCaps CreateCompatibleDC GetObjectA CreateCompatibleBitmap SelectObject StretchBlt DeleteObject DeleteDC

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA

shell32

ShellExecuteExA SHFileOperationA SHGetFileInfoA SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA SHChangeNotify

ole32

CreateStreamOnHGlobal OleInitialize CoCreateInstance OleUninitialize CLSIDFromString

oleaut32

VariantInit