loader[.]exe | Triage™

General

Target
loader.exe
Size 1.2MB
Sample260910-2qvppsxbkb
SHA256 377ab1abcc8b4d796360348f2256e4dea569a4302982319988d72134965a4521
MD5 5006d829773cbd7ace20d4161a4fdb79
SHA1 40cbfb8e24c81a85e33d2bed2202675f78a9c75e
SHA512 fc0105c860b8bb2bae98e90374d5aced9cc416557d743995e950eea431e8dea79747b5820050ccfe69d1f4798a0cb231e82011d652d532e3d3c31f07eb11e045
SSDEEP 24576:PKDUqgovZEHn3JJ0hg2g3ycExBY+LjPWs:PEkLQg2gqxBLjOs
TLSH
T16B55AE12B796AE66DC702FB9002E9343017B9F67DF0577CBBA873A1E40656F1C8B4924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.2MB

loader.exe

IMPHASH 94375955594cc2eb79cdfe29c622d9eb
SHA256 377ab1abcc8b4d796360348f2256e4dea569a4302982319988d72134965a4521
MD5 5006d829773cbd7ace20d4161a4fdb79
SHA1 40cbfb8e24c81a85e33d2bed2202675f78a9c75e
SHA512 fc0105c860b8bb2bae98e90374d5aced9cc416557d743995e950eea431e8dea79747b5820050ccfe69d1f4798a0cb231e82011d652d532e3d3c31f07eb11e045
SSDEEP 24576:PKDUqgovZEHn3JJ0hg2g3ycExBY+LjPWs:PEkLQg2gqxBLjOs
TLSH
T16B55AE12B796AE66DC702FB9002E9343017B9F67DF0577CBBA873A1E40656F1C8B4924
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Downloads\ChinaFree\Fodasse-menu\bin\Release\loader.pdb

kernel32

GetModuleHandleA LoadLibraryA GetProcAddress FindResourceA LoadResource LockResource SizeofResource GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent

vcruntime140

__current_exception_context __current_exception memset _except_handler4_common strstr

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit _controlfp_s terminate _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing