Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 165KB
Sample260903-m97faagh32
SHA256 8683e0def2c44d3d19ef10d4c058e33184e905d4bf07ae8805838888a5499146
MD5 8eb75200586a7d3b112ab07d619762ad
SHA1 452061b0fd4af3b36dfe1025679b8981a95e8bb7
SHA512 85312cba89730d55f29a7a19373304f62d21df35ec14f44226d8b84aeea5524cf736ab56a773dec220ab57d8387d60d1dfd0b7f2888610d26f1e226e17aef0fc
SSDEEP 3072:51MqHJY8nf7Ago9Dyiv7ALsYM9znlR0znBI1ltqSIxrGnTowBAo9bzqKR:tHBjo9Dosl6nCISIxqnTPnR
TLSH
T1A8F38E45B1A900F8D426613DA5AEB71FF536340847109BDB37EC46783FB26E09ABB316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 165KB

Loader.exe

IMPHASH abb8f30e0a5185c336f74398d9e9c9bd
SHA256 8683e0def2c44d3d19ef10d4c058e33184e905d4bf07ae8805838888a5499146
MD5 8eb75200586a7d3b112ab07d619762ad
SHA1 452061b0fd4af3b36dfe1025679b8981a95e8bb7
SHA512 85312cba89730d55f29a7a19373304f62d21df35ec14f44226d8b84aeea5524cf736ab56a773dec220ab57d8387d60d1dfd0b7f2888610d26f1e226e17aef0fc
SSDEEP 3072:51MqHJY8nf7Ago9Dyiv7ALsYM9znlR0znBI1ltqSIxrGnTowBAo9bzqKR:tHBjo9Dosl6nCISIxqnTPnR
TLSH
T1A8F38E45B1A900F8D426613DA5AEB71FF536340847109BDB37EC46783FB26E09ABB316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

124396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Kepler\Downloads\Hwid-Spoofer-EAC-BE-main\Hwid-Spoofer-EAC-BE-main\Spoofer Project İmgui\x64\Release\Loader.pdb

kernel32

QueryPerformanceFrequency QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle GetConsoleCursorInfo SetCurrentConsoleFontEx Sleep SetConsoleCursorInfo ExitProcess GetConsoleWindow EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GlobalLock SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GlobalUnlock GlobalAlloc DeleteCriticalSection CloseHandle

user32

RegisterClassA MoveWindow DispatchMessageA LoadCursorA ShowWindow GetAsyncKeyState SetWindowLongA GetWindowLongA MessageBoxA DefWindowProcA SetClipboardData GetClipboardData CreateWindowExA SetLayeredWindowAttributes TranslateMessage EmptyClipboard CloseClipboard OpenClipboard ReleaseCapture GetClientRect SetCursor SetCapture SetWindowPos GetWindowRect GetKeyState PeekMessageA UnregisterClassA PostQuitMessage GetDesktopWindow UpdateWindow

imm32

ImmGetContext ImmSetCompositionWindow

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

d3d9

Direct3DCreate9

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __C_specific_handler __current_exception_context __current_exception _CxxThrowException strchr strstr __std_terminate memcpy memmove

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf _set_fmode fclose fflush __acrt_iob_func fseek __p__commode __stdio_common_vsscanf ftell __stdio_common_vsprintf fread _wfopen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

__p___argc _register_thread_local_exe_atexit_callback _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit __p___argv _crt_atexit terminate system _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _c_exit

api-ms-win-crt-math-l1-1-0

floor fmodf sinf __setusermatherr cosf ceil sqrt sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale