loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 3.7MB
Sample260824-sd5vgazclb
SHA256 ee4c82481f505c4584284b3036535346b6713d2b8530d11cd190487e0bfa986b
MD5 6bf2806df36134d53f020ccda130b36a
SHA1 498439f87e54f9e200ff02bd11bc5ce15cec908f
SHA512 a259e1a3b0552618d464835d29ebdbddba6eea0dda928504fbe4c52687a78c4f9602cba6c85f75550ada5fb7ae127ae2fba887eada918dd4ba5b293d1181446e
SSDEEP 49152:T9oXgjMKQDio6zKOjEGoZGhY4jCJGf+B0TlcZjiVHWcbyVRJuwzIU6i709hU:hm+YOjEWXpTvwJu5+7
TLSH
T1F6067C43F6A280E8C47AC074D35AA633FA727889473576EB06D487353E62FD06A3DB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 3.7MB

loader.exe

IMPHASH fad0007b8ccb617af27536ac4a4993cf
SHA256 ee4c82481f505c4584284b3036535346b6713d2b8530d11cd190487e0bfa986b
MD5 6bf2806df36134d53f020ccda130b36a
SHA1 498439f87e54f9e200ff02bd11bc5ce15cec908f
SHA512 a259e1a3b0552618d464835d29ebdbddba6eea0dda928504fbe4c52687a78c4f9602cba6c85f75550ada5fb7ae127ae2fba887eada918dd4ba5b293d1181446e
SSDEEP 49152:T9oXgjMKQDio6zKOjEGoZGhY4jCJGf+B0TlcZjiVHWcbyVRJuwzIU6i709hU:hm+YOjEWXpTvwJu5+7
TLSH
T1F6067C43F6A280E8C47AC074D35AA633FA727889473576EB06D487353E62FD06A3DB45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2642176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

loader.pdb

ntdll

NtWriteFile RtlGetVersion RtlCaptureContext RtlVirtualUnwind NtCreateNamedPipeFile NtQuerySystemInformation NtQueryInformationProcess NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtCreateFile NtDeviceIoControlFile NtOpenFile

kernel32

CreateEventW HeapFree ExitProcess GetProcessHeap CreateDirectoryW CancelIo ReadFile SetFileInformationByHandle SetFileTime CreateFileW TlsSetValue TlsGetValue TlsAlloc InitOnceExecuteOnce AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FreeLibrary CreateProcessW GetFullPathNameW GetFileAttributesW SetHandleInformation HeapReAlloc DuplicateHandle GetTempPathW DeleteFileW FlushFileBuffers GetFileInformationByHandleEx MoveFileExW GetFileInformationByHandle WriteFileEx GetProcessIoCounters SleepEx GetSystemTimes ReadFileEx ReleaseMutex CreateMutexA WaitForSingleObjectEx GetUserDefaultUILanguage LCIDToLocaleName GetProcessTimes GetFinalPathNameByHandleW FindFirstFileExW SetLastError SetFileCompletionNotificationModes IsDebuggerPresent CheckRemoteDebuggerPresent CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteProcessMemory Module32FirstW LoadLibraryW FindVolumeClose CreateIoCompletionPort HeapAlloc FindNextVolumeW GetSystemInfo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar FormatMessageW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW ReadProcessMemory VirtualQueryEx FindFirstVolumeW GlobalMemoryStatusEx GetQueuedCompletionStatusEx SetWaitableTimer CreateWaitableTimerExW GetCurrentThread SetThreadStackGuarantee QueryFullProcessImageNameW GetCurrentProcess GetCurrentProcessId DeviceIoControl GetDiskFreeSpaceExW WakeAllConditionVariable OpenProcess LocalFree SleepConditionVariableSRW GetExitCodeThread CreateRemoteThread GetExitCodeProcess WaitForSingleObject GetOverlappedResult WaitForMultipleObjects RemoveDirectoryW TerminateProcess VirtualAllocEx PostQueuedCompletionStatus IsProcessorFeaturePresent SwitchToThread FindClose GetCurrentThreadId GetSystemTimeAsFileTime CreateThread LoadLibraryExA GetVolumePathNamesForVolumeNameW GetVolumeInformationW GetModuleHandleA Sleep GetProcAddress CloseHandle OutputDebugStringA OutputDebugStringW LoadLibraryExW GetLastError GetDriveTypeW Module32NextW VirtualFreeEx FindNextFileW GetModuleHandleW SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter QueryPerformanceFrequency QueryPerformanceCounter AddVectoredExceptionHandler GetCurrentDirectoryW SetEnvironmentVariableW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW K32GetPerformanceInfo

bcryptprimitives

ProcessPrng

oleaut32

SafeArrayUnaccessData SysFreeString SafeArrayAccessData SetErrorInfo SysStringLen GetErrorInfo SafeArrayDestroy VariantClear SysAllocStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSACleanup bind freeaddrinfo getsockopt WSAGetLastError WSASend connect ioctlsocket WSASocketW getaddrinfo setsockopt WSAIoctl closesocket recv send WSAStartup

advapi32

GetLengthSid GetTokenInformation RegGetValueW RegCloseKey RegEnumValueW RegCreateKeyExW IsValidSid OpenProcessToken CopySid RegSetValueExW RegOpenKeyExW RegQueryValueExW EventUnregister SystemFunction036 EventRegister EventSetInformation EventWriteTransfer

user32

RegisterWindowMessageA MapVirtualKeyExW GetKeyboardLayout InvalidateRgn EnumChildWindows IsProcessDPIAware GetDC DispatchMessageA GetMessageA SetWindowPos RegisterClassExW GetWindowLongPtrW SetPropW SystemParametersInfoA SetWindowRgn ToUnicodeEx RegisterTouchWindow IsWindow MonitorFromPoint RegisterRawInputDevices CreateWindowExW ShowWindow SendInput SetForegroundWindow GetSystemMenu EnableMenuItem SetCursor LoadCursorW SetWindowLongW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData DefWindowProcW GetKeyboardState GetAsyncKeyState RedrawWindow SetWindowLongPtrW GetKeyState MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW SendMessageW DestroyWindow PostMessageW DestroyIcon DispatchMessageW TranslateMessage GetMessageW CreateIcon GetActiveWindow ShowCursor GetClipCursor ClipCursor GetMenu SetFocus GetWindow AdjustWindowRectEx SetWindowPlacement GetWindowRect GetForegroundWindow GetWindowPlacement

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

ole32

CoTaskMemFree CoTaskMemAlloc CoInitializeSecurity CoSetProxyBlanket RevokeDragDrop RegisterDragDrop OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance CoUninitialize

gdi32

CreateRoundRectRgn GetDeviceCaps DeleteObject CreateRectRgn CreateSolidBrush

shell32

SHAppBarMessage CommandLineToArgvW DragFinish DragQueryFileW

shlwapi

SHCreateMemStream

crypt32

CryptUnprotectData CryptProtectData

bcrypt

BCryptGenRandom

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

iphlpapi

GetAdaptersAddresses

pdh

PdhRemoveCounter PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhOpenQueryA PdhCollectQueryData

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

__std_exception_destroy _CxxThrowException __std_exception_copy __current_exception_context memcpy __CxxFrameHandler3 __current_exception memcmp memmove __C_specific_handler memset wcsrchr _purecall strchr memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

round __setusermatherr pow floor roundf trunc

api-ms-win-crt-string-l1-1-0

strcmp _wcsicmp wcscmp strlen wcslen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi strtol

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc terminate __p___argv _crt_atexit abort _initialize_onexit_table _cexit _c_exit _register_thread_local_exe_atexit_callback _errno _wassert

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __acrt_iob_func ftell fwrite _setmode fopen fread fgets ferror feof __p__commode fclose _set_fmode fflush _fileno fseek

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode realloc _callnewh

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale