Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 1.1MB
Sample260903-v544csaf49
SHA256 d41d8473ec9cd09aa7dba44a752046902d80a13edb24252f1b94401f3bb1b9b4
MD5 dc3fc85675e177f2a9e60ef1f1430922
SHA1 43efb5f6bcfbf111cdd4c33827abac6c8b1f07d2
SHA512 345165e73123d8723e6f28347a9e6b4f92ef7c15e82c3aa19591cd960bc864b5dd458fb427b3af1e72d3a8b50dc7a3d8b4220e93f7ab7c04bcfc44b08122cd8b
SSDEEP 24576:R7JCVvwVtky541lWTHe6dppSbr7bJ29nBIjtdzARDEA+l3lhpP:RsYeQe6re1knBattYDEA+l
TLSH
T1EE45BF57A3A401EAD4A7803C9543E717F7B6745A2710C7CB23E4CA697FA36E02E7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 1.1MB

Loader.exe

IMPHASH 3b8a3af257d5f57ee1f5d61297ec9608
SHA256 d41d8473ec9cd09aa7dba44a752046902d80a13edb24252f1b94401f3bb1b9b4
MD5 dc3fc85675e177f2a9e60ef1f1430922
SHA1 43efb5f6bcfbf111cdd4c33827abac6c8b1f07d2
SHA512 345165e73123d8723e6f28347a9e6b4f92ef7c15e82c3aa19591cd960bc864b5dd458fb427b3af1e72d3a8b50dc7a3d8b4220e93f7ab7c04bcfc44b08122cd8b
SSDEEP 24576:R7JCVvwVtky541lWTHe6dppSbr7bJ29nBIjtdzARDEA+l3lhpP:RsYeQe6re1knBattYDEA+l
TLSH
T1EE45BF57A3A401EAD4A7803C9543E717F7B6745A2710C7CB23E4CA697FA36E02E7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

693468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Felix\Desktop\Zoid Spoofer\Zoid\x64\Release\Loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileSizeEx CreateFileA WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA GetTickCount VerifyVersionInfoA GetSystemDirectoryA SleepEx SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA Sleep SleepConditionVariableSRW TerminateProcess RtlCaptureContext GetModuleHandleW CreateFileW CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree GetSystemTimeAsFileTime HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess InitializeSListHead CreateThread VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA QueryFullProcessImageNameW SetLastError FormatMessageA LocalFree EnterCriticalSection LeaveCriticalSection WakeAllConditionVariable RtlLookupFunctionEntry RtlVirtualUnwind GlobalAlloc GetCurrentProcessId UnhandledExceptionFilter OutputDebugStringW

user32

TranslateMessage GetMonitorInfoW LoadIconW GetWindowThreadProcessId GetClassNameA SetWindowLongW GetWindowRect UpdateWindow GetSystemMetrics GetAsyncKeyState SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW CloseClipboard SetProcessDPIAware MonitorFromWindow MessageBoxA LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData OpenClipboard

gdi32

CreateSolidBrush

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setf@ios_base@std@@QEAAHHH@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

normaliz

IdnToAscii

wldap32

ord143 ord46 ord41 ord22 ord26 ord27 ord211 ord33 ord35 ord79 ord30 ord50 ord200 ord217 ord301 ord45 ord32 ord60

crypt32

CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CryptStringToBinaryA CertFreeCertificateChain PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertOpenStore

ws2_32

WSAIoctl htons WSAStartup WSACleanup closesocket recv accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom sendto send WSAGetLastError bind gethostname ntohl socket setsockopt ntohs WSASetLastError getsockopt getsockname getpeername connect

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__std_terminate memcpy __current_exception_context __current_exception __C_specific_handler strrchr _CxxThrowException __std_exception_destroy __std_exception_copy memcmp strstr memchr strchr memset memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_errno _initialize_onexit_table _crt_atexit system _register_onexit_function _getpid _cexit _beginthreadex exit terminate _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit strerror _set_app_type _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv __sys_nerr _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _resetstkoflw

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh realloc free calloc

api-ms-win-crt-string-l1-1-0

strcmp tolower strpbrk strncmp strcspn strspn isupper _strdup strncpy

api-ms-win-crt-stdio-l1-1-0

fwrite __acrt_iob_func _wfopen fclose fflush fread fseek __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _get_stream_buffer_pointers feof _open _close _write _read fgetc __p__commode _set_fmode fgetpos fputc fsetpos _lseeki64 _fseeki64 setvbuf ungetc ftell fgets fputs fopen _pclose _popen

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-math-l1-1-0

fmodf sinf sqrtf acosf ceilf powf __setusermatherr _dclass cosf roundf

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoll strtol strtoull strtoul

api-ms-win-crt-filesystem-l1-1-0

_access _fstat64 _unlock_file _lock_file _stat64 remove _unlink

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

advapi32

CryptDestroyKey OpenProcessToken SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptImportKey CryptEncrypt IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce

shell32

ShellExecuteA