Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 328KB
Sample261009-wheqmacv5w
SHA256 8739a25945f9bcce6b50686a10ecca834aa2b201e724a5ebc79ef815b3db915b
MD5 d99d2aad102f1ca928f9e4527da29a0c
SHA1 2f3af9844ec66068de5db49d7fcf9973457db6cd
SHA512 02d4260e9c60dc9abff309175b9696c0b873bf33fff67dfb5187a4414608857fef5e8e03164a0cdd0ae480d9bf900c5d62950ec008545c35caf98402e8f8d020
SSDEEP 6144:dUfhZGlnDtX7qXwUO7ehS4XZTw91hrheU8sdxBTqaAIYX/JoD:dyK5BrqtO7wXIUJo
TLSH
T1AE643A53E28501F8E86AE139D34AE225FA727C9003D1F4CF13605735BE66AE4AE3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 328KB

Loader.exe

IMPHASH 37f4451aa43a720128685f09d9e9441a
SHA256 8739a25945f9bcce6b50686a10ecca834aa2b201e724a5ebc79ef815b3db915b
MD5 d99d2aad102f1ca928f9e4527da29a0c
SHA1 2f3af9844ec66068de5db49d7fcf9973457db6cd
SHA512 02d4260e9c60dc9abff309175b9696c0b873bf33fff67dfb5187a4414608857fef5e8e03164a0cdd0ae480d9bf900c5d62950ec008545c35caf98402e8f8d020
SSDEEP 6144:dUfhZGlnDtX7qXwUO7ehS4XZTw91hrheU8sdxBTqaAIYX/JoD:dyK5BrqtO7wXIUJo
TLSH
T1AE643A53E28501F8E86AE139D34AE225FA727C9003D1F4CF13605735BE66AE4AE3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CLSIDFromString CoCreateInstance CoGetObject CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize

oleaut32

SysAllocString SysFreeString SysReAllocString VariantClear VariantInit

shlwapi

PathFileExistsW

shell32

SHCreateItemFromIDList SHGetFolderPathW SHParseDisplayName

advapi32

AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegSetValueExW

user32

wsprintfW

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW CreateFileW CreateProcessW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentThread GetCurrentThreadId GetFileSize GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadContext GetThreadId GetTickCount64 GlobalMemoryStatusEx InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryExW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadFile ReadProcessMemory ReleaseSRWLockExclusive ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetEvent SetFilePointer SetThreadContext SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler

api-ms-win-crt-string-l1-1-0

_wcsicmp memset strcmp strlen strncmp wcscat_s wcscpy_s wcslen

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush fputc fputs fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove wcsrchr

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

Name

.text

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

ole32

oleaut32

shlwapi

shell32

advapi32

user32

kernel32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic