loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 310KB
Sample261009-vxethasw5q
SHA256 3b067fe19629d1949dfaf6e9fb30e54414f0b21086454d008e499229919e05e8
MD5 c0545fa07901f6ff7c6212c9cc41dabe
SHA1 76b7f965bfb0e795ea837e55f6fe7f1fd6e68a3b
SHA512 48513dd35657da6cf7c2203ce17049bec648cccc3f89bb960077e96a268665a42116c0ec58447c2625f46b988db5d87a8fa9803fdf4fa7253ba55f7094e792dd
SSDEEP 6144:ewdW+Jjhs3gbeFv9BYtoqswsSm1IBC/H:A+Jjhs3gUY+NSbBo
TLSH
T18C647D29E79410FAE567857CCD424906EBB2BC1607A1DBCF23E049962F27BE05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 310KB

loader.exe

IMPHASH 69464b42398ecc17d624d068f50c801f
SHA256 3b067fe19629d1949dfaf6e9fb30e54414f0b21086454d008e499229919e05e8
MD5 c0545fa07901f6ff7c6212c9cc41dabe
SHA1 76b7f965bfb0e795ea837e55f6fe7f1fd6e68a3b
SHA512 48513dd35657da6cf7c2203ce17049bec648cccc3f89bb960077e96a268665a42116c0ec58447c2625f46b988db5d87a8fa9803fdf4fa7253ba55f7094e792dd
SSDEEP 6144:ewdW+Jjhs3gbeFv9BYtoqswsSm1IBC/H:A+Jjhs3gUY+NSbBo
TLSH
T18C647D29E79410FAE567857CCD424906EBB2BC1607A1DBCF23E049962F27BE05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

urlmon

URLDownloadToFileA

user32

MessageBoxA

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSetOption

iphlpapi

GetAdaptersInfo

advapi32

RegOpenKeyExA RegCloseKey GetUserNameA FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExA

kernel32

GetACP SetEnvironmentVariableW FindNextFileW FindFirstFileExW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile IsValidCodePage IsProcessorFeaturePresent CreateDirectoryA DeleteFileA GetDiskFreeSpaceExA RemoveDirectoryA GetTempPathA GetVolumeInformationA CloseHandle GetLastError WaitForSingleObject GetCurrentProcessId CreateRemoteThread OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetComputerNameExA GetVersionExA GetNativeSystemInfo VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlUnwind QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW FindClose RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc

Name

.text

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

urlmon

user32

winhttp

iphlpapi

advapi32

kernel32

generic