Loader[.]exe | Triage™

General

Target
Loader.exe
Size 1.7MB
Sample260924-ehs5ksde66
SHA256 2545fbedb5788867dcc642987175d595b5598c47502d635600f1251960ef8530
MD5 a5c21285a6aaad448967d9945912831b
SHA1 b85987a46b52895ed3182179c8767c73f79f9671
SHA512 f1d9789428b6f22cd7dddeffadb13c0b5375738d1237f83a4597f64ff7cc46b45f51e99dd23c45fef9f9974f299b918a3a4b288aac6e3e6edb8257c8a52272d6
SSDEEP 12288:xi+wK8r0ScqVAaJzSbPPR6MH5ylz498TjCVXMi5y25Is0sRxoj9cph0lhSMXlixc:Zvfp04rxA25IslRxoMh0lhSMXlW
TLSH
T1A285D7457B6045E2C436D63E89BA5331EBB23C4D8130B3968BD867E51FC63A0AB78F54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 1.7MB

Loader.exe

IMPHASH 945a620815a6d184dc7da8422677fa6d
SHA256 2545fbedb5788867dcc642987175d595b5598c47502d635600f1251960ef8530
MD5 a5c21285a6aaad448967d9945912831b
SHA1 b85987a46b52895ed3182179c8767c73f79f9671
SHA512 f1d9789428b6f22cd7dddeffadb13c0b5375738d1237f83a4597f64ff7cc46b45f51e99dd23c45fef9f9974f299b918a3a4b288aac6e3e6edb8257c8a52272d6
SSDEEP 12288:xi+wK8r0ScqVAaJzSbPPR6MH5ylz498TjCVXMi5y25Is0sRxoj9cph0lhSMXlixc:Zvfp04rxA25IslRxoMh0lhSMXlW
TLSH
T1A285D7457B6045E2C436D63E89BA5331EBB23C4D8130B3968BD867E51FC63A0AB78F54
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1370848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle InternetOpenA InternetReadFile InternetOpenUrlA

ntdll

RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlInitUnicodeString RtlUnwind

kernel32

DecodePointer GetOEMCP GetACP IsValidCodePage SetEndOfFile WriteConsoleW HeapSize WriteProcessMemory CreateFileW CloseHandle GetModuleHandleA GetTempPathA SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer HeapReAlloc LCMapStringEx GetStringTypeW GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW GetEnvironmentStringsW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

wininet

ntdll

kernel32

generic