Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 1.4MB
Sample260822-ql62dsvcmf
SHA256 d0e27483216a7d895159b52e74eb4b127b57384ba05decfd33e4ad7e6f23bfaf
MD5 97f66c14de62a53f8f899db144f0eaec
SHA1 6891369585a5b54028c43ae444e48ed047e8dd0b
SHA512 a79cca38811b6e7cdd8d182fde011756b1ec5f9f29ba68e68f3c3e68ce2dc8d4c7cf264d49d732e6b5b83aa89d1c45d6fc656cba5333ec416c5fe5d934b80641
SSDEEP 24576:XrxobeKT11YOTVVddBrXrqy7y10RUL32aGiAJrayRKxh0lhSMXle2ugy0+O93l0x:OZT1Zrd7X60UL32aGiAJrayRKYPz+O9i
TLSH
T16365AE17A7A414F9C17BC138C6574A17E7B2781903219BEF13D09AA92F23AD16F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 1.4MB

Loader.exe

IMPHASH 855b982675957386c5a47dce92c7a586
SHA256 d0e27483216a7d895159b52e74eb4b127b57384ba05decfd33e4ad7e6f23bfaf
MD5 97f66c14de62a53f8f899db144f0eaec
SHA1 6891369585a5b54028c43ae444e48ed047e8dd0b
SHA512 a79cca38811b6e7cdd8d182fde011756b1ec5f9f29ba68e68f3c3e68ce2dc8d4c7cf264d49d732e6b5b83aa89d1c45d6fc656cba5333ec416c5fe5d934b80641
SSDEEP 24576:XrxobeKT11YOTVVddBrXrqy7y10RUL32aGiAJrayRKxh0lhSMXle2ugy0+O93l0x:OZT1Zrd7X60UL32aGiAJrayRKYPz+O9i
TLSH
T16365AE17A7A414F9C17BC138C6574A17E7B2781903219BEF13D09AA92F23AD16F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

790960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\xwa\Downloads\2023 MW3 CHAIR INJECTOR (1)\2023 MW3 CHAIR INJECTOR\x64\Release\Loader.pdb

kernel32

AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree QueryPerformanceFrequency GetSystemDirectoryW SleepEx GetSystemInfo MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 CreatePipe CreateProcessA ResumeThread OpenThread TerminateProcess GetCurrentProcessId Process32Next Process32First Process32NextW Process32FirstW CreateToolhelp32Snapshot SetConsoleTitleA SetConsoleTextAttribute SetConsoleScreenBufferInfoEx GetConsoleScreenBufferInfoEx SetConsoleMode GetConsoleMode FreeConsole QueryFullProcessImageNameW LoadLibraryW LoadLibraryA LoadLibraryExA GetProcAddress GetModuleHandleA FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetWindowsDirectoryW OpenProcess ExitProcess GetCurrentProcess SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA Module32NextW Module32FirstW Thread32Next Thread32First GetModuleHandleW Sleep GetLastError Beep IsDebuggerPresent GetTempPathA WriteFile ReadFile DeleteFileW GetStdHandle DeviceIoControl CloseHandle VerSetConditionMask CreateFileW

user32

GetClassNameA FindWindowExW ShowWindow UnhookWindowsHookEx SetWindowsHookExA GetWindow GetWindowThreadProcessId EnumWindows MessageBoxW MessageBoxA IsWindowVisible PostThreadMessageA

advapi32

CryptCreateHash CryptReleaseContext OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptGetHashParam CryptAcquireContextW ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA

shell32

ShellExecuteA ShellExecuteW

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Xtime_get_ticks _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Query_perf_counter _Query_perf_frequency ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_detach ??7ios_base@std@@QEBA_NXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z

urlmon

URLDownloadToFileA

shlwapi

PathFindFileNameW

ntdll

RtlImageNtHeader

ws2_32

WSAEnumNetworkEvents WSASetLastError inet_ntop ntohs inet_pton WSAStartup WSACleanup WSAGetLastError connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen gethostname ioctlsocket sendto recvfrom closesocket WSAWaitForMultipleEvents WSAResetEvent bind freeaddrinfo WSAEventSelect getsockopt send WSACloseEvent WSACreateEvent getaddrinfo

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140

strchr memchr memcmp __std_terminate strrchr memmove memcpy _CxxThrowException __std_exception_destroy __current_exception __current_exception_context strstr memset wcschr __std_exception_copy __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcspn _wcsdup _stricmp strlen wcspbrk _strdup strcpy_s _wcsicmp strspn strcmp wcsncmp wcslen tolower strpbrk wcsncpy strncmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh calloc realloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_lseeki64 ungetc _set_fmode __acrt_iob_func _fseeki64 _wfopen _wopen __stdio_common_vsscanf __stdio_common_vfprintf __p__commode setvbuf _pclose _read _write ftell _fileno _close fsetpos fread _popen fputs fgets __stdio_common_vsprintf _get_stream_buffer_pointers fwrite fputc fseek feof fclose fflush fgetc fgetpos

api-ms-win-crt-filesystem-l1-1-0

_unlink remove _fstat64 _lock_file _unlock_file _wstat64

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw _invalid_parameter_noinfo system __sys_nerr __sys_errlist _register_thread_local_exe_atexit_callback _c_exit abort __p___argv exit __p___argc _exit _initterm_e terminate _errno _invalid_parameter_noinfo_noreturn _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _get_initial_narrow_environment _seh_filter_exe _set_app_type _initterm _beginthreadex

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 strftime _time64

api-ms-win-crt-math-l1-1-0

_fdopen _dsign __setusermatherr

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-convert-l1-1-0

atoi strtoul strtoll strtoull wcstombs strtol strtod

api-ms-win-crt-environment-l1-1-0

getenv