Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 5.3MB
Sample261007-thfltabt3v
SHA256 acb4fdd8eab403dd309015ff8d73334ce7fb1656a627ae837804e59a1b20005a
MD5 52922ceeab0a95443710310269e0bd6b
SHA1 ae3623103310c8bc62efcb8538800efeffee931f
SHA512 ccc9a72d8642e167dce9f1ed0078e48cde9dd762499de5b15cc64bba86935ffa3e21d18c5cfc629ce25fe8e8444ea58a0ee71fb31a3bfe4e20d0d468a23edf41
SSDEEP 49152:xs+66Hc/D0wh/wi94JQcnq0HNIg7krE5nYwe4U4ae/b9HWcXotBi7Nwe:O+cX9wi9bVEkKDTLB2hqNV
TLSH
T11E46AE4D387AF3BAD088DB7F98A45640766000FD188B5FF31E95D6CE6E4B34A6A76043
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 5.3MB

Loader.exe

IMPHASH 4203bcc197a677cc6e618642dfca870e
SHA256 acb4fdd8eab403dd309015ff8d73334ce7fb1656a627ae837804e59a1b20005a
MD5 52922ceeab0a95443710310269e0bd6b
SHA1 ae3623103310c8bc62efcb8538800efeffee931f
SHA512 ccc9a72d8642e167dce9f1ed0078e48cde9dd762499de5b15cc64bba86935ffa3e21d18c5cfc629ce25fe8e8444ea58a0ee71fb31a3bfe4e20d0d468a23edf41
SSDEEP 49152:xs+66Hc/D0wh/wi94JQcnq0HNIg7krE5nYwe4U4ae/b9HWcXotBi7Nwe:O+cX9wi9bVEkKDTLB2hqNV
TLSH
T11E46AE4D387AF3BAD088DB7F98A45640766000FD188B5FF31E95D6CE6E4B34A6A76043
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

SafeArrayCreateVector SafeArrayDestroy SafeArrayPutElement SysAllocString SysFreeString

ws2_32

WSAStartup

version

GetFileVersionInfoSizeA

gdi32

BitBlt

user32

EnumWindows

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fwrite

kernel32

CloseHandle CreateFileA DeleteCriticalSection DeleteFileA EnterCriticalSection FreeLibrary GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetFileAttributesA GetFileSize GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress GetSystemDirectoryA GetTempPathA GetTickCount GetWindowsDirectoryA InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalFree ReadFile SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile

ntdll

NtAllocateVirtualMemory NtFreeVirtualMemory

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

ole32

oleaut32

ws2_32

version

gdi32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

kernel32

ntdll

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

generic