Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 16.8MB
Sample261014-176mvsad38
SHA256 80835a8b82b20c305f77ba57a61fc167e51f28e6a6f10fc298169efa8af60d5a
MD5 29ff4f1af306ee6c0ea1a425db2cec12
SHA1 c77e135f9ce0b63a897e4a6e2d98fdc6f21641a5
SHA512 059c9f820c0d467bf57f44ada67b03a7d781223ae0106fde5e1f2b16d3956edea4d5a7eaee77cfe1af9c7bd72c0fded3e8a205b60f0d697c57a96c10c7331ae3
SSDEEP 393216:hrTUKu9/k2lmDgraLonKuuB39twguyYNp:xUKq5lprGoxYu
TLSH
T1D2072382988907F4D3DB4B1851CB168E73E16752D9BA5A0E1684DC032EC3E5B278FF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 16.8MB

Loader.exe

IMPHASH a34ea6438c572d1ac4afd33186d54927
SHA256 80835a8b82b20c305f77ba57a61fc167e51f28e6a6f10fc298169efa8af60d5a
MD5 29ff4f1af306ee6c0ea1a425db2cec12
SHA1 c77e135f9ce0b63a897e4a6e2d98fdc6f21641a5
SHA512 059c9f820c0d467bf57f44ada67b03a7d781223ae0106fde5e1f2b16d3956edea4d5a7eaee77cfe1af9c7bd72c0fded3e8a205b60f0d697c57a96c10c7331ae3
SSDEEP 393216:hrTUKu9/k2lmDgraLonKuuB39twguyYNp:xUKq5lprGoxYu
TLSH
T1D2072382988907F4D3DB4B1851CB168E73E16752D9BA5A0E1684DC032EC3E5B278FF5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33050878

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

advapi32

EventSetInformation

ntdll

NtCancelIoFileEx

kernel32

RaiseException GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CreateWindowExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle

ole32

RevokeDragDrop

gdi32

SetBkMode

dwmapi

DwmSetWindowAttribute

comctl32

SetWindowSubclass

shlwapi

SHCreateMemStream

combase

CoCreateFreeThreadedMarshaler

shell32

SHAppBarMessage

imm32

ImmGetCompositionStringW

oleaut32

SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ws2_32

freeaddrinfo

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_c_exit

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.N//

Size

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ho2

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.GLK

Size

16.8MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

bcryptprimitives

advapi32

ntdll

kernel32

user32

api-ms-win-core-synch-l1-2-0

ole32

gdi32

dwmapi

comctl32

shlwapi

combase

shell32

imm32

oleaut32

api-ms-win-core-winrt-error-l1-1-0

ws2_32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic