tfloader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tfloader.exe
Size 207KB
Sample260824-d2hyaaxygs
SHA256 93190dd0a4fa15221de72b739581ec953b6fab27ae2ba3b8989ce169f0a57cf2
MD5 f1ed8947bf917eafcba7695001cdbe4a
SHA1 c5d2cb6fe15175a06695b0926e3a29c7371462ea
SHA512 3bea278c80457335414cc01df7cc485260a6711467ec4ba461aebcee570e673bf01f8b07a11462bbbe1eef06f0ab5af78c85c23389e0c17714eedf4673ea178e
SSDEEP 6144:EHGFBZpomWakbc8HY65AfETC9WkXdBQuHKN1sgHCrgH8:l+PHESLAgHC
TLSH
T1B7244B06A7D501FDE1B7C579CD815901EB727C0A4BB0EADF079049A29E73AA0AE3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tfloader.exe

File Explorer

tfloader.exe

.exe 207KB

tfloader.exe

IMPHASH c7c39658ecb91afe775b79d14d849b04
SHA256 93190dd0a4fa15221de72b739581ec953b6fab27ae2ba3b8989ce169f0a57cf2
MD5 f1ed8947bf917eafcba7695001cdbe4a
SHA1 c5d2cb6fe15175a06695b0926e3a29c7371462ea
SHA512 3bea278c80457335414cc01df7cc485260a6711467ec4ba461aebcee570e673bf01f8b07a11462bbbe1eef06f0ab5af78c85c23389e0c17714eedf4673ea178e
SSDEEP 6144:EHGFBZpomWakbc8HY65AfETC9WkXdBQuHKN1sgHCrgH8:l+PHESLAgHC
TLSH
T1B7244B06A7D501FDE1B7C579CD815901EB727C0A4BB0EADF079049A29E73AA0AE3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile InternetSetOptionW HttpQueryInfoW InternetOpenW

urlmon

URLDownloadToFileW

ole32

CoUninitialize CoInitializeEx

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptGenerateSymmetricKey BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptCloseAlgorithmProvider

user32

RegisterWindowMessageW LoadIconW LoadCursorW GetCursorPos MessageBoxW SetForegroundWindow UpdateWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW

shell32

Shell_NotifyIconW

kernel32

SetUnhandledExceptionFilter WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapFree HeapAlloc CompareFileTime CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileSize ReadFile WriteFile GetTempPathW Beep CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW OpenMutexW GetExitCodeProcess CreateThread GetExitCodeThread CreateProcessW GetTickCount GetModuleFileNameW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleExW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle ExitProcess