loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 23.2MB
Sample260831-sdmc5avaja
SHA256 3b034159fbee381e1c351bbebb6e517b1fce7ef89f859309e3aba74ce06b2f26
MD5 6ec95fe36d35278150aca62284622585
SHA1 1fad9d5161af60acf32a3bbc3466e8f236e33c03
SHA512 069e2886410c53233d805e524f907b3bc294d98c79c0a963e0e1044e290398b584ab9a782235b48ca34eb1f1716a0bb7db7d39fd233e63f8504fd6eda24094af
SSDEEP 393216:MSIYMNG52UkMbjGSYB2K8xvSk9GR64AEzS8bGhgpo8WsvyR8PhrqWjjFshhEZSN7:MeMNGsUBbjRm8lSkgmEzS86SpypKVqko
TLSH
T1CF37F10546E92FC9EB3D6636C6B5F403C6CC3AF5C5D2A3211A42624139F2DBAC3DB15A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 23.2MB

loader.exe

IMPHASH bd1d2cc93f169cbfe426e8ea861f2e7f
SHA256 3b034159fbee381e1c351bbebb6e517b1fce7ef89f859309e3aba74ce06b2f26
MD5 6ec95fe36d35278150aca62284622585
SHA1 1fad9d5161af60acf32a3bbc3466e8f236e33c03
SHA512 069e2886410c53233d805e524f907b3bc294d98c79c0a963e0e1044e290398b584ab9a782235b48ca34eb1f1716a0bb7db7d39fd233e63f8504fd6eda24094af
SSDEEP 393216:MSIYMNG52UkMbjGSYB2K8xvSk9GR64AEzS8bGhgpo8WsvyR8PhrqWjjFshhEZSN7:MeMNGsUBbjRm8lSkgmEzS86SpypKVqko
TLSH
T1CF37F10546E92FC9EB3D6636C6B5F403C6CC3AF5C5D2A3211A42624139F2DBAC3DB15A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Downloads\sdaffdfd-main\jew-dick-hack-main\x64\Release\frost_loader.pdb

winhttp

WinHttpReadData WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen

kernel32

GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetStdHandle SetEnvironmentVariableA SetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW RemoveDirectoryW WriteFile GetTempPathW CheckRemoteDebuggerPresent CloseHandle GetLastError WaitForSingleObject GetCurrentProcess CreateProcessW GetTickCount64 GetModuleFileNameW GetModuleHandleW GetSystemTimeAsFileTime LoadResource LockResource SizeofResource FindResourceW GlobalUnlock GlobalLock GetComputerNameA GetConsoleMode SetConsoleMode ReadConsoleInputW SetConsoleCP SetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleWindowInfo SetConsoleTitleW GetCurrentConsoleFontEx SetCurrentConsoleFontEx GetConsoleWindow RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetProcAddress RtlCaptureContext

user32

GetClipboardData CloseClipboard SetWindowLongPtrW LoadIconW GetWindowTextW GetWindowLongPtrW SendMessageW SetLayeredWindowAttributes OpenClipboard EnumWindows

advapi32

GetUserNameA RegOpenKeyExA RegQueryValueExA RegCloseKey

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

memcmp memcpy memmove memset __C_specific_handler __current_exception __current_exception_context __std_exception_copy wcsstr __std_exception_destroy _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _initterm _invoke_watson _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate _get_initial_narrow_environment _set_app_type _initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

isalnum wcslen strlen wcscpy_s

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vswprintf_s __acrt_iob_func fputc __stdio_common_vsprintf __p__commode __stdio_common_vsprintf_s fflush _set_fmode

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22.6MB

Virtual Size

22.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

winhttp

kernel32

user32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic