loader_slim[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader_slim.exe
Size 58.2MB
Sample261003-ye5trafb62
SHA256 06d2ae66105637cd719ff61862f93fc04db4ed9f3bbc0fa6a411678c0b6c2d93
MD5 4a15d593b0c94683eb555eaf91a29752
SHA1 6f91c3d0694e4900c52eac6e4ac97b98aadca205
SHA512 f865c278d43cdb9dc5e2aa2f8d566b3cee15ec6d5332aee197a045126bdb98810112b61fce56d733e81a8a4892baed43e20d96882aa9be10f456b4720345688c
SSDEEP 1572864:wsJOqTsJO+T85+iFghLYAfOPoNQ5tZNKtIzzx:wsJOusJO+o5+BhLYHPbF4Mx
TLSH
T160D733217213D037F629A0F01A28EFF4A0A5B4399B6214C777C1CF7684651D77AB9F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
loader_slim.exe

File Explorer

loader_slim.exe

.exe 58.2MB

loader_slim.exe

IMPHASH 09dab0da9d489246dbc96c5ccb235c67
SHA256 06d2ae66105637cd719ff61862f93fc04db4ed9f3bbc0fa6a411678c0b6c2d93
MD5 4a15d593b0c94683eb555eaf91a29752
SHA1 6f91c3d0694e4900c52eac6e4ac97b98aadca205
SHA512 f865c278d43cdb9dc5e2aa2f8d566b3cee15ec6d5332aee197a045126bdb98810112b61fce56d733e81a8a4892baed43e20d96882aa9be10f456b4720345688c
SSDEEP 1572864:wsJOqTsJO+T85+iFghLYAfOPoNQ5tZNKtIzzx:wsJOusJO+o5+BhLYHPbF4Mx
TLSH
T160D733217213D037F629A0F01A28EFF4A0A5B4399B6214C777C1CF7684651D77AB9F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

40:de:e0:32:31:d5:17:1c:c8:79:c5:62:a8:86:be:ac:bf:66:25:6f:fc:7e:9d:e6:9a:05:c1:b5:e9:b2:40:d9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=FemboiSecureSign

Chains

Oct 2, 2026

CN=FemboiSecureSign

Minor OS version

Major OS version

Entry point

670736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetFolderPathW CommandLineToArgvW SHCreateDirectoryExW ShellExecuteExW ShellExecuteW Shell_NotifyIconW

advapi32

EventRegister RegDeleteValueW EventSetInformation EventWriteTransfer EventUnregister RegGetValueW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl RegQueryValueExW DuplicateTokenEx RegOpenKeyExW CreateProcessWithTokenW RegCloseKey RegSetValueExW

ole32

CoTaskMemAlloc CoTaskMemFree

cabinet

ord45 ord40 ord43

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpSetTimeouts

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptDestroyKey BCryptDecrypt BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey BCryptGetProperty BCryptCreateHash

crypt32

CryptStringToBinaryA CryptUnprotectData CryptProtectData

kernel32

ReadConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapAlloc UnhandledExceptionFilter GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError IsValidCodePage GetACP GetOEMCP ReadFile SizeofResource GetFileSizeEx CreateFileW LockResource CloseHandle LoadResource FindResourceW GetModuleHandleW WriteFile GetModuleFileNameW CreateNamedPipeW CreateMutexW ReleaseMutex DisconnectNamedPipe Sleep GetLastError WaitNamedPipeW ConnectNamedPipe FlushFileBuffers CreateDirectoryW SetHandleInformation TerminateProcess CreatePipe GetTempPathW WaitForSingleObject GetFileAttributesW CreateProcessW WideCharToMultiByte GetTickCount GetExitCodeProcess K32GetModuleFileNameExW OpenProcess SetFileAttributesW CreateEventW DeleteFileW VirtualAllocEx VirtualQueryEx FindFirstFileW FindNextFileW SetFilePointer FindClose MultiByteToWideChar MoveFileExW ExitProcess GetCurrentProcessId CopyFileW VirtualProtect GetCurrentProcess GetModuleHandleA FindFirstFileExW GetTickCount64 Process32NextW GetCurrentThread Process32FirstW CreateThread GetThreadContext GetProcAddress IsDebuggerPresent CheckRemoteDebuggerPresent GetLocalTime GetCommandLineW AttachConsole LocalFree WriteProcessMemory GetProcessId Thread32Next Thread32First GetExitCodeThread QueueUserAPC VirtualProtectEx GetFileSize ReadProcessMemory CreateRemoteThread FormatMessageA VirtualFreeEx OpenThread GetEnvironmentVariableW GetEnvironmentVariableA LocalAlloc GetFileAttributesExW GetDiskFreeSpaceExW GetFullPathNameA GetSystemDirectoryW Module32FirstW FreeLibrary Module32NextW LoadLibraryExW GetStdHandle SetEndOfFile RemoveDirectoryW FileTimeToSystemTime GetLogicalDrives Wow64DisableWow64FsRedirection SetEnvironmentVariableW K32EnumProcessModulesEx Wow64RevertWow64FsRedirection K32GetModuleBaseNameW GetNativeSystemInfo QueryFullProcessImageNameW IsWow64Process UnmapViewOfFile SetFilePointerEx CreateFileMappingA WriteConsoleW ResumeThread LoadLibraryW lstrcpynW GetCurrentThreadId SetComputerNameExW GetComputerNameW QueryPerformanceCounter OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime QueryPerformanceFrequency SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetStringTypeW WaitForSingleObjectEx InitOnceBeginInitialize InitOnceComplete GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize CreateToolhelp32Snapshot MapViewOfFile

user32

PostQuitMessage AppendMenuW TranslateMessage SetForegroundWindow DispatchMessageW TrackPopupMenu RegisterClassExW CreatePopupMenu CreateWindowExW MessageBoxW DestroyWindow PostMessageW DefWindowProcW GetMessageW IsIconic GetCursorPos DestroyMenu FindWindowW ShowWindow wsprintfW FindWindowA GetClientRect EnumWindows GetWindowRect SetWindowPos SendMessageW GetSystemMetrics SetTimer LoadIconW LoadCursorW KillTimer UpdateWindow ReleaseCapture SendMessageTimeoutW GetWindowThreadProcessId IsWindowVisible GetClassNameA GetShellWindow

gdi32

CreateSolidBrush

ws2_32

listen getaddrinfo inet_addr WSAGetLastError ntohs recv shutdown freeaddrinfo setsockopt ioctlsocket getsockopt select WSACleanup bind connect inet_ntop closesocket inet_pton WSAStartup socket htons accept send

wininet

InternetSetOptionW

shlwapi

ord12

dwmapi

DwmSetWindowAttribute

urlmon

URLDownloadToFileW

Name

.text

Size

856KB

Virtual Size

855KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

253KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

57.1MB

Virtual Size

57.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader_slim.exe

PE Signature issue

shell32

advapi32

ole32

cabinet

winhttp

bcrypt

crypt32

kernel32

user32

gdi32

ws2_32

wininet

shlwapi

dwmapi

urlmon

generic