Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 14.4MB
Sample261002-2mn3raxvbz
SHA256 de47921e7fbd6879cbbcac37fbc32fc6396f33fc3ea10a5e39ce355cc69b51b2
MD5 0f06fe650650aece46d1492a079fcb50
SHA1 b0c1b643e3492d1497ce0cd2ba0b7d564ee9d07a
SHA512 4a47b8fd9f25c228bb97592e31800f5e305c643c6ff330cb0bd43ef96eb8dc89edf8481b1f74e5eadc5a90b037926b11988399c0f337d3ca086c10402dfa09a2
SSDEEP 196608:ej3x9n+s1ZzPPtfzYYSMgcSPhAVg7PAmkgCjPuSEibxYZqL107wF:SvnlzP1LrgdPAmkgCjNjbxTL1Q
TLSH
T1B1E6CF07F351829CC6569938CAA2D793F3717C401B2593DB729C3A1A9F672F00EBA6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 14.4MB

Loader.exe

IMPHASH 1be412961b918f931070b106f424472b
SHA256 de47921e7fbd6879cbbcac37fbc32fc6396f33fc3ea10a5e39ce355cc69b51b2
MD5 0f06fe650650aece46d1492a079fcb50
SHA1 b0c1b643e3492d1497ce0cd2ba0b7d564ee9d07a
SHA512 4a47b8fd9f25c228bb97592e31800f5e305c643c6ff330cb0bd43ef96eb8dc89edf8481b1f74e5eadc5a90b037926b11988399c0f337d3ca086c10402dfa09a2
SSDEEP 196608:ej3x9n+s1ZzPPtfzYYSMgcSPhAVg7PAmkgCjPuSEibxYZqL107wF:SvnlzP1LrgdPAmkgCjNjbxTL1Q
TLSH
T1B1E6CF07F351829CC6569938CAA2D793F3717C401B2593DB729C3A1A9F672F00EBA6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1042424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen

crypt32

CryptProtectData CryptUnprotectData CryptStringToBinaryA CryptBinaryToStringA

advapi32

CryptAcquireContextW CryptReleaseContext RegCloseKey RegOpenKeyExW RegQueryValueExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam GetUserNameW

ws2_32

WSAStartup getaddrinfo ntohl WSACleanup freeaddrinfo

user32

PostQuitMessage FindWindowW SetForegroundWindow MessageBoxW ShowWindow EmptyClipboard SetProcessDpiAwarenessContext GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect IsWindowUnicode SetCursorPos DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW GetAsyncKeyState OpenClipboard DispatchMessageW CloseClipboard GetCursorPos PeekMessageW TranslateMessage GetClipboardData LoadIconW LoadCursorW SetCapture SetClipboardData UpdateWindow ReleaseCapture LoadImageW

shell32

SHGetKnownFolderPath ShellExecuteA SHGetFolderPathW

kernel32

ReadConsoleW FlushFileBuffers GetConsoleOutputCP GetTimeZoneInformation IsValidCodePage GetConsoleMode GetFileType SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetACP GetOEMCP GetCommandLineA GetCommandLineW CreateMutexW GetTickCount64 GetLastError CloseHandle ExitProcess GetModuleFileNameW GlobalAlloc GlobalFree GlobalLock GetModuleHandleW WideCharToMultiByte GlobalUnlock CreateDirectoryW GetVolumeInformationA GetSystemDirectoryW LoadLibraryW GetProcAddress LocalFree OutputDebugStringA GetLocalTime GetEnvironmentVariableW GetFileAttributesW SetFileAttributesW MultiByteToWideChar GetFileAttributesExW DeleteFileW CopyFileW MoveFileExW ReadFile SetFilePointer CreateFileW GetFileSize WriteFile SizeofResource SetEnvironmentVariableW GetTempPathW CreateToolhelp32Snapshot FormatMessageW Process32NextW SetFileInformationByHandle LockResource Process32FirstW LoadResource FindResourceW GetCurrentProcessId CreateProcessW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcess Thread32Next Thread32First GetCurrentThread GetThreadContext OpenThread IsDebuggerPresent WriteConsoleW GetSystemInfo VirtualQuery GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary CreateFileA GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize SetEndOfFile CheckRemoteDebuggerPresent GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep WaitForSingleObjectEx GetExitCodeThread FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable InitializeCriticalSectionEx

ole32

CoTaskMemFree

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.9MB

Virtual Size

11.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

d3d11

winhttp

crypt32

advapi32

ws2_32

user32

shell32

kernel32

ole32

d3dcompiler_47

imm32

generic