plasma_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
plasma_loader.exe
Size 257KB
Sample261011-e3txlsv1ax
SHA256 49294adef66986e5a2dafb9e11c47c6a069e89408c61329e6c8bd0a33c7b6d7c
MD5 5630a939e5c09e58f11e3e5c771878de
SHA1 6cec2ebe9c224311f77e6a8a695938e790f49e2a
SHA512 d715b07352d304808b79e976c476e9f6a492d17dbf5b04c6439552b01d5650515a843d17703a6cad12d0c529280a92afc7e03296eba9b0dfaf29a4f642e50c7f
SSDEEP 3072:Ui8bnVv5/UgZkIrxMto+f7+0Md7LkJ7viwAkEm+4tIs+jG62hsLmVa68sWP89vDj:Ui8NDkNto8+0ksvnQ24z21VXpD1
TLSH
T1C7447D15B7A50CFAED67867CC9524905DBB2BC524760EADF03A04AA70F237D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
plasma_loader.exe

File Explorer

plasma_loader.exe

.exe 257KB

plasma_loader.exe

IMPHASH 6c158e40412ffba50423bff36281ccc0
SHA256 49294adef66986e5a2dafb9e11c47c6a069e89408c61329e6c8bd0a33c7b6d7c
MD5 5630a939e5c09e58f11e3e5c771878de
SHA1 6cec2ebe9c224311f77e6a8a695938e790f49e2a
SHA512 d715b07352d304808b79e976c476e9f6a492d17dbf5b04c6439552b01d5650515a843d17703a6cad12d0c529280a92afc7e03296eba9b0dfaf29a4f642e50c7f
SSDEEP 3072:Ui8bnVv5/UgZkIrxMto+f7+0Md7LkJ7viwAkEm+4tIs+jG62hsLmVa68sWP89vDj:Ui8NDkNto8+0ksvnQ24z21VXpD1
TLSH
T1C7447D15B7A50CFAED67867CC9524905DBB2BC524760EADF03A04AA70F237D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryA

shell32

ShellExecuteW

advapi32

LookupPrivilegeValueA FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken

kernel32

CreateFileW HeapSize WriteConsoleW SetEndOfFile RtlLookupFunctionEntry GetProcessHeap GetStdHandle ExpandEnvironmentStringsA CreateDirectoryW DeleteFileW SetFileAttributesW CloseHandle WaitForSingleObject Sleep GetCurrentProcess CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress MultiByteToWideChar GetConsoleMode SetConsoleMode SetConsoleCP SetConsoleOutputCP SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW SetStdHandle RtlPcToFileHeader RaiseException RtlUnwind RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

Name

.text

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

plasma_loader.exe

urlmon

wininet

shell32

advapi32

kernel32

generic