loader[.]exe | Triage™

General

Target
loader.exe
Size 149KB
Sample260926-ysakrsswdx
SHA256 eb38d9342a81fe421a28d02b3f6e584dae2ab6b0a169df8a3614209fcaa11548
MD5 5bdbf66d1143f7009b17384b64638d14
SHA1 3dc47cf184ba4e6f08cf4c25a715bd0967954909
SHA512 f488b5c4976c63286d183f1d4ca337c788b2697dd2cc690bc9c8b764f459f125c8b735c8d0d02cd78319f6b573ecfe79afd01477195081384fe53e296f13cddb
SSDEEP 3072:5mC5zN+Skhg0RaA0uI/x1QwiG0TvIN+ZUsZaIX:ixW0RE9Q/G0LIB
TLSH
T1B5E35C57B3A530F9E1B78238C9A10646E772783617619BEF0364437A2F236D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 149KB

loader.exe

IMPHASH 850c50b2638a1aba6c229f3956c806a1
SHA256 eb38d9342a81fe421a28d02b3f6e584dae2ab6b0a169df8a3614209fcaa11548
MD5 5bdbf66d1143f7009b17384b64638d14
SHA1 3dc47cf184ba4e6f08cf4c25a715bd0967954909
SHA512 f488b5c4976c63286d183f1d4ca337c788b2697dd2cc690bc9c8b764f459f125c8b735c8d0d02cd78319f6b573ecfe79afd01477195081384fe53e296f13cddb
SSDEEP 3072:5mC5zN+Skhg0RaA0uI/x1QwiG0TvIN+ZUsZaIX:ixW0RE9Q/G0LIB
TLSH
T1B5E35C57B3A530F9E1B78238C9A10646E772783617619BEF0364437A2F236D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA StartServiceA CloseServiceHandle

urlmon

URLDownloadToFileA

kernel32

WriteConsoleW CreateFileW CreateFileA DeleteFileA GetTempPathA CloseHandle GetLastError DeviceIoControl GetLocalTime QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapReAlloc RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW GetFileSizeEx SetFilePointerEx HeapSize RtlUnwind

Name

.text

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

advapi32

urlmon

kernel32

generic