internal loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
internal loader.exe
Size 286KB
Sample260925-ppalxsssat
SHA256 22dbc8f7ccbef08998b6db7e191656d897042dee58ead6ff01f72daed4886f2b
MD5 a666fd752d55084b7858bd158d7a4923
SHA1 a2e1f431f722b44115a795abc516ea60c599a8ff
SHA512 9bf5e35d522f4dd3b4428bf541a1106ddccd9edbabb31ed3a409ac1e2d980f137f05109257b8a446f91a432d741c02001d13a81128398e2b58306692011c7980
SSDEEP 6144:BM/EtifHIKe9n10F1izEJtrUbn5S1Z5swA3udyK7JR:i/EtifHIKe910F1rvZ5swwkyKl
TLSH
T1D3546C2AB6950179D297C0BCCD838807FB7338464B91E7DF27955AF52F635E05A3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
internal loader.exe

File Explorer

internal loader.exe

.exe 286KB

internal loader.exe

IMPHASH cd0ea3de695abf6b60a90bb5370ed1ca
SHA256 22dbc8f7ccbef08998b6db7e191656d897042dee58ead6ff01f72daed4886f2b
MD5 a666fd752d55084b7858bd158d7a4923
SHA1 a2e1f431f722b44115a795abc516ea60c599a8ff
SHA512 9bf5e35d522f4dd3b4428bf541a1106ddccd9edbabb31ed3a409ac1e2d980f137f05109257b8a446f91a432d741c02001d13a81128398e2b58306692011c7980
SSDEEP 6144:BM/EtifHIKe9n10F1izEJtrUbn5S1Z5swA3udyK7JR:i/EtifHIKe910F1rvZ5swwkyKl
TLSH
T1D3546C2AB6950179D297C0BCCD838807FB7338464B91E7DF27955AF52F635E05A3E202
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

urlmon

URLDownloadToFileA

advapi32

InitializeAcl AllocateAndInitializeSid GetTokenInformation AddAccessAllowedAce GetLengthSid SetSecurityInfo OpenProcessToken CheckTokenMembership FreeSid IsValidSid

kernel32

ReleaseSRWLockExclusive InitializeSListHead ReadFile SetConsoleCtrlHandler SetNamedPipeHandleState Process32First VirtualProtect SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle WriteFile TerminateProcess CreateMutexA WaitForSingleObject GetCurrentDirectoryA GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 GetLastError QueryFullProcessImageNameA CreateFileA GetCurrentThread DeleteFileA Process32Next CloseHandle K32GetModuleInformation SetFileAttributesA AddVectoredExceptionHandler GetThreadContext GetProcAddress RemoveDirectoryA ExitProcess GetCurrentProcessId GetConsoleWindow CreateProcessA CreateDirectoryA GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent QueryPerformanceCounter AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetModuleHandleW GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter GetCurrentThreadId

user32

ShowWindow MessageBoxA FindWindowA

shell32

ShellExecuteExA ShellExecuteA

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __C_specific_handler __current_exception_context memmove __current_exception _CxxThrowException memset __std_terminate memcpy memcmp __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_set_app_type _get_initial_narrow_environment _initterm _initterm_e terminate __p___argc _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback _cexit _register_onexit_function _invoke_watson _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit __p___argv _crt_atexit _exit _beginthreadex

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-string-l1-1-0

_stricmp tolower

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s _set_fmode __p__commode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

228KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Protd

Size

512B

Virtual Size

490B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Samar

Size

1024B

Virtual Size

794B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UXI00

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

212B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

internal loader.exe

urlmon

advapi32

kernel32

user32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic