loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 1.5MB
Sample260910-kfer3attbx
SHA256 dabd102d0a40c57ab0fcbfa142415f0986382f31d7feb7269b02a6e5da58a023
MD5 a214f4f44bfc59188146a45615610dbe
SHA1 cda6e51578827dcd6c889d1f904968e1bdd6b40d
SHA512 212828fb1f18baee816e91d217220a97a6b772bb8fc260932032e207fc73df9a6729abce2150c957e368d81f876a21a70a0461a71b5c838b05ba8ca81cfb2dad
SSDEEP 24576:JfEhtQG9tYlWg/vP1l2nPhsGBPsSXgX3NZOjMZzUpQWQ67nNlV08qZDK0zUsIOCC:dCtY5/3TPGBFXg9zqQ67nl0q0zU
TLSH
T19775D096E3A401F8D0A7D0BC8256A71BEB71744703609BDB26DC4A1E2F53AF11BBE315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.5MB

loader.exe

IMPHASH 969d06e9c1a641e3914eeb7efc4c4f57
SHA256 dabd102d0a40c57ab0fcbfa142415f0986382f31d7feb7269b02a6e5da58a023
MD5 a214f4f44bfc59188146a45615610dbe
SHA1 cda6e51578827dcd6c889d1f904968e1bdd6b40d
SHA512 212828fb1f18baee816e91d217220a97a6b772bb8fc260932032e207fc73df9a6729abce2150c957e368d81f876a21a70a0461a71b5c838b05ba8ca81cfb2dad
SSDEEP 24576:JfEhtQG9tYlWg/vP1l2nPhsGBPsSXgX3NZOjMZzUpQWQ67nNlV08qZDK0zUsIOCC:dCtY5/3TPGBFXg9zqQ67nl0q0zU
TLSH
T19775D096E3A401F8D0A7D0BC8256A71BEB71744703609BDB26DC4A1E2F53AF11BBE315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

770688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Mr_m6\Downloads\B4l-Loader\B4l-Loader\x64\Release\loader.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegCreateKeyExA RegCloseKey RegQueryValueExA RegSetValueExA RegOpenKeyExA

kernel32

QueryPerformanceCounter WriteProcessMemory VirtualProtect CreateToolhelp32Snapshot GetLastError GetThreadContext GetCurrentProcessId ReadProcessMemory GetSystemInfo VirtualFree VirtualAlloc GetEnvironmentVariableA LoadLibraryA FreeLibrary MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock AddVectoredExceptionHandler IsDebuggerPresent CheckRemoteDebuggerPresent DebugBreak RemoveVectoredExceptionHandler RtlCaptureContext OpenProcess HeapFree GetCurrentThreadId RaiseException K32GetModuleInformation GetModuleHandleExA DuplicateHandle K32GetProcessImageFileNameW ReadFile CreateFileA Process32NextW Process32FirstW GetTickCount64 GetLocalTime SystemTimeToFileTime SleepEx GlobalGetAtomNameA GetBinaryTypeW GetEnvironmentVariableW GetWriteWatch ResetWriteWatch HeapQueryInformation LoadLibraryExA CreateMutexA GetFileSizeEx MapViewOfFile UnmapViewOfFile CreateFileMappingA GetModuleHandleA ReleaseSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess GetProcAddress CloseHandle QueryPerformanceFrequency HeapAlloc Sleep AcquireSRWLockExclusive SetThreadContext

user32

PostQuitMessage RegisterClassExA CreateWindowExA CloseWindow UnregisterClassA GetMessageA DispatchMessageA SetWindowLongA GetWindowLongA SetWindowDisplayAffinity GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient UpdateWindow ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowRect GetCapture TranslateMessage DefWindowProcA MoveWindow PeekMessageW DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics SetWindowRgn SetWindowPos DestroyWindow

gdi32

CreateRoundRectRgn

shell32

ShellExecuteA

ole32

PropVariantClear CoCreateInstance CoInitializeEx

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

winhttp

WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

gdiplus

GdiplusStartup

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memcmp __intrinsic_setjmp _CxxThrowException __current_exception memmove memcpy __current_exception_context strrchr memset longjmp __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strstr wcsstr

api-ms-win-crt-heap-l1-1-0

free realloc _callnewh malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_errno _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm system _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _seh_filter_exe exit _cexit _beginthreadex terminate _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

toupper strncpy_s strncmp strcmp strncpy _wcsicmp strcpy strlen

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc fseek __stdio_common_vsprintf fsetpos fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vsscanf ftell _set_fmode _wfopen __acrt_iob_func __stdio_common_vfprintf fwrite __p__commode fgetc fgetpos fputc fflush fclose

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sqrtf powf cosf ceilf __setusermatherr sinf acosf fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale