loaderbankroll[.]exe

General

Target
loaderbankroll.exe
Size 47.8MB
Sample261001-vavlfazs8m
SHA256 5a0323557518f28349d9ecc5687a6024d2819cfeefb4810d14f997b89b20cf65
MD5 ea0b5303a2f5649f1e71c5d51ca300c2
SHA1 dad66f5f2b5a00feb5c8c155e5060d04d6e73cb9
SHA512 3838720ea13f8732aeb76c1b2a7a2a81e520f70af7e355df514edf4de2178b525a89b2587f282d0af7d66dacf246a63c6b5f7390e895f116346b72378f425e88
SSDEEP 786432:UlukpxyScrm5Aapwkh2vqqv5f3lC7yFHmUPf9mw59rwqqK5setMc618Hp:v1ScIAapwkhyfPHmUPVZ59rwqqKIcX
TLSH
T151B7F142A551EA88C59A8078930E6AAAE632B5073F76FCFF404451523596BCD6FFCF03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loaderbankroll.exe

File Explorer

loaderbankroll.exe

.exe 47.8MB

loaderbankroll.exe

IMPHASH c4b4c13516a342c4cc552ecd2559885d
SHA256 5a0323557518f28349d9ecc5687a6024d2819cfeefb4810d14f997b89b20cf65
MD5 ea0b5303a2f5649f1e71c5d51ca300c2
SHA1 dad66f5f2b5a00feb5c8c155e5060d04d6e73cb9
SHA512 3838720ea13f8732aeb76c1b2a7a2a81e520f70af7e355df514edf4de2178b525a89b2587f282d0af7d66dacf246a63c6b5f7390e895f116346b72378f425e88
SSDEEP 786432:UlukpxyScrm5Aapwkh2vqqv5f3lC7yFHmUPf9mw59rwqqK5setMc618Hp:v1ScIAapwkhyfPHmUPVZ59rwqqKIcX
TLSH
T151B7F142A551EA88C59A8078930E6AAAE632B5073F76FCFF404451523596BCD6FFCF03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\artem\source\repos\loaderbankroll\x64\Release\loaderbankroll.pdb

kernel32

SizeofResource WriteProcessMemory SetConsoleTextAttribute SetConsoleTitleA GetStdHandle RtlAddFunctionTable Thread32Next GetFullPathNameA Thread32First WaitForSingleObject ResumeThread OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW LoadLibraryA LockResource Process32FirstW CloseHandle LoadResource FindResourceW GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx OpenThread SetEndOfFile WriteConsoleW HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW RtlUnwind

shell32

ShellExecuteA

Name

.text

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

47.6MB

Virtual Size

47.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loaderbankroll.exe

kernel32

shell32

generic