myau_loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
myau_loader.exe
Size 401KB
Sample260916-nap8dsan4z
SHA256 4172b542a87cfd88c6ce54dcc8ae6a8a20df5d72b7ecd0108b63d2f7b319f8bc
MD5 594f099c0cf6983701c85fdc21f7ffab
SHA1 32ce90d1668b0a5838aebb93729dcf1805c7bb71
SHA512 e693782bdc904d4e116a29257acf98079882734e065884741bbfbd3c6c2838bc90b78ea2aa3afbcf2f42f2e7be6530edba8afcbc08402e1d37acc6021d7fdf8d
SSDEEP 6144:AhAjWIFz3RdvcBoxd0VC0S63BzUlMLFk9i33Fwkb0Bf7AJCHKKtKxMwdvgAM:L8QXlcFDVwcCKKhwV
TLSH
T1FB948C05B7A549FEE9B7963C8D82CA02DB337C0A4BB0D6DF135049A61E276D09E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
myau_loader.exe

File Explorer

myau_loader.exe

.exe 401KB

myau_loader.exe

IMPHASH 90a2fb4c0b2ffbf222aa18f71e945b04
SHA256 4172b542a87cfd88c6ce54dcc8ae6a8a20df5d72b7ecd0108b63d2f7b319f8bc
MD5 594f099c0cf6983701c85fdc21f7ffab
SHA1 32ce90d1668b0a5838aebb93729dcf1805c7bb71
SHA512 e693782bdc904d4e116a29257acf98079882734e065884741bbfbd3c6c2838bc90b78ea2aa3afbcf2f42f2e7be6530edba8afcbc08402e1d37acc6021d7fdf8d
SSDEEP 6144:AhAjWIFz3RdvcBoxd0VC0S63BzUlMLFk9i33Fwkb0Bf7AJCHKKtKxMwdvgAM:L8QXlcFDVwcCKKhwV
TLSH
T1FB948C05B7A549FEE9B7963C8D82CA02DB337C0A4BB0D6DF135049A61E276D09E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipFree GdiplusStartup GdiplusShutdown GdipPrivateAddMemoryFont GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipGetFamilyName GdipCloneFontFamily GdipDeleteFontFamily GdipDrawImageRectRect GdipFillPath GdipFillEllipse GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawLine GdipSetInterpolationMode GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHDC GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipAddPathRectangle GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdipAlloc

ole32

CreateStreamOnHGlobal

dwmapi

DwmSetWindowAttribute

winhttp

WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

shell32

ShellExecuteW

kernel32

LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetLastError GetProcessHeap GetFileSizeEx ReadFile WriteFile GetTempPathW CloseHandle CreateThread GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW WaitForSingleObject CreateRemoteThread GetExitCodeThread CreateProcessW OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx IsWow64Process GetModuleHandleW GetProcAddress ReadProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW CreateFileW RaiseException RtlPcToFileHeader

user32

PtInRect FillRect ScreenToClient SetCursor AdjustWindowRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow DrawTextW KillTimer wsprintfW ReleaseCapture SetCapture SetWindowPos ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent SystemParametersInfoW LoadCursorA SetTimer LoadIconW

gdi32

BitBlt CreateFontW CreateSolidBrush DeleteDC DeleteObject GetTextExtentPoint32W AddFontMemResourceEx RemoveFontMemResourceEx SelectObject SetBkMode SetTextColor CreateDIBSection TextOutW CreateCompatibleDC

Name

.text

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

myau_loader.exe

gdiplus

ole32

dwmapi

winhttp

shell32

kernel32

user32

gdi32

generic