loader_r[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader_r.exe
Size 3.6MB
Sample261016-1vdrbaes2x
SHA256 807c1ffd0e91aed62765aa349a1caf5747c6ba35810819d0c85f69c5e5753e16
MD5 778e081d7a735c5330edbed38d2eb58c
SHA1 d3087443d4888278a48cb6c316d5388a501063c6
SHA512 75938b0d674211bc72e5fe84edeb28eeece83cf5f5b88938cb520e862da848b78f637a6819f5db87eb999733d8e27ea5dd5aa80b8918e2bfc30c854fc1c064f2
SSDEEP 49152:wj3kECxSdIGfGXkPojxadhROdHAQyqp9GNyZV/TTisnD4nM4zLxs9AtWvLQ1Xkpi:wyGfGXdVAQ/xV/a1tnxJtWTQ1UnQTYM
TLSH
T1A006BF0AAE9E05A8D5229B3AE19FCBA7E730F4082B1055D777C813D55F13BE85B37602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader_r.exe

File Explorer

loader_r.exe

.exe 3.6MB

loader_r.exe

IMPHASH 4694a8f68053f4648a31f052251e8d95
SHA256 807c1ffd0e91aed62765aa349a1caf5747c6ba35810819d0c85f69c5e5753e16
MD5 778e081d7a735c5330edbed38d2eb58c
SHA1 d3087443d4888278a48cb6c316d5388a501063c6
SHA512 75938b0d674211bc72e5fe84edeb28eeece83cf5f5b88938cb520e862da848b78f637a6819f5db87eb999733d8e27ea5dd5aa80b8918e2bfc30c854fc1c064f2
SSDEEP 49152:wj3kECxSdIGfGXkPojxadhROdHAQyqp9GNyZV/TTisnD4nM4zLxs9AtWvLQ1Xkpi:wyGfGXdVAQ/xV/a1tnxJtWTQ1UnQTYM
TLSH
T1A006BF0AAE9E05A8D5229B3AE19FCBA7E730F4082B1055D777C813D55F13BE85B37602
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1458780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlVirtualUnwind RtlCaptureContext VerSetConditionMask RtlLookupFunctionEntry NtSetInformationThread

bcrypt

BCryptEncrypt BCryptFinalizeKeyPair BCryptDestroyKey BCryptDecrypt BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptGenRandom BCryptExportKey BCryptFinishHash BCryptGetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdA SetupDiEnumDeviceInfo

kernel32

K32EnumProcesses GetThreadContext LocalFree GetCurrentProcessId Module32NextW K32EnumProcessModules DebugBreak VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleFileNameW LocalAlloc lstrcmpA CreateFileA ExitProcess GetTickCount HeapFree InitializeCriticalSectionEx CreateFileW UnmapViewOfFile HeapAlloc AddVectoredExceptionHandler DeleteCriticalSection GetProcessHeap QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile GetFileAttributesW EnterCriticalSection FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle K32GetModuleInformation GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead CreateFileMappingA OutputDebugStringW LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx InterlockedPushEntrySList GetCurrentThread OpenProcess GetStdHandle SetThreadPriority K32GetModuleFileNameExW TerminateProcess GetCurrentProcess AllocConsole CreateProcessA lstrcmpiA GetConsoleWindow GetModuleHandleW SetEnvironmentVariableA IsProcessorFeaturePresent SetFileAttributesA CreateThread CloseHandle Process32FirstW DeleteFileA Process32NextW GetFileAttributesA GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot SetFileAttributesW GetEnvironmentVariableA VirtualAlloc OutputDebugStringA VirtualFree VirtualProtect GetModuleFileNameA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoEx GetSystemInfo InitializeCriticalSection GetFileSizeEx FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe ReadFile GetLocaleInfoA GetFileType Module32FirstW GetModuleHandleA FindFirstFileW AreFileApisANSI LoadLibraryExW FindClose

user32

GetCursorPos SetProcessDPIAware GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow GetDC GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData ReleaseDC CloseClipboard SetWindowPos SetWindowRgn SetCursorPos UpdateWindow IsWindowUnicode MessageBoxW FindWindowExA GetWindowThreadProcessId FindWindowA GetMessageW DefWindowProcW MapVirtualKeyW SetProcessDpiAwarenessContext GetWindowRect DestroyWindow IsWindowVisible EnumDisplayMonitors OpenClipboard EndPaint BeginPaint InvalidateRect GetDesktopWindow PostQuitMessage TranslateMessage SetLayeredWindowAttributes MoveWindow MessageBoxA PeekMessageW GetMonitorInfoW DispatchMessageW ReleaseCapture DrawTextW EmptyClipboard GetAsyncKeyState GetKeyNameTextA IsWindow ShowWindow RegisterClassExW GetShellWindow UnregisterClassW GetSystemMetrics CreateWindowExW FillRect

gdi32

CreatePen SetStretchBltMode GetDeviceCaps DeleteObject DeleteDC GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateDIBSection CreateSolidBrush MoveToEx LineTo SetBkMode SetTextColor GetDIBits CreateRoundRectRgn CreateFontW AddFontResourceExW Ellipse

advapi32

SetSecurityInfo CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt SystemFunction036 CryptGetHashParam CryptReleaseContext RegDeleteKeyA IsValidSid OpenProcessToken InitializeAcl CryptGenRandom GetLengthSid AddAccessAllowedAce GetTokenInformation RegCloseKey RegQueryValueExA RegOpenKeyExA RegGetValueA CryptAcquireContextA

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

_Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?_Xbad_function_call@std@@YAXXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ _Xtime_get_ticks ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ _Thrd_id _Thrd_join ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z

d3dcompiler_43

D3DCompile

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest

urlmon

URLDownloadToFileA

normaliz

IdnToAscii

wldap32

ord33 ord27 ord35 ord41 ord50 ord45 ord22 ord26 ord60 ord32 ord211 ord46 ord30 ord143 ord200 ord301 ord79 ord217

crypt32

CertCloseStore CertEnumCertificatesInStore CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertAddCertificateContextToStore PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore CryptStringToBinaryA CertFindExtension CertOpenStore CertGetNameStringW CryptDecodeObjectEx

ws2_32

gethostname WSAStartup freeaddrinfo inet_ntop getaddrinfo closesocket recv send WSAGetLastError __WSAFDIsSet bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl accept htonl listen ioctlsocket ntohl sendto recvfrom select WSACleanup

msimg32

TransparentBlt

winmm

timeBeginPeriod

wininet

InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile

mpr

WNetGetProviderNameA

wintrust

WinVerifyTrust

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

psapi

GetModuleInformation

shlwapi

StrStrW

dxgi

CreateDXGIFactory1

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler strstr __intrinsic_setjmp longjmp _CxxThrowException __current_exception_context __current_exception memchr strchr wcsstr memcmp memmove strrchr memset memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fwrite _wfopen fflush fclose __stdio_common_vsprintf fread __acrt_iob_func _lseeki64 __stdio_common_vsscanf _open _close _write feof fputs fopen fputc __stdio_common_vswprintf_s _read _set_fmode _popen fgets _pclose __stdio_common_vsprintf_s fgetc ftell __stdio_common_vfwprintf _get_stream_buffer_pointers _fseeki64 fsetpos __p__commode ungetc fseek setvbuf fgetpos

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _cexit __p___argv terminate __p___argc _initialize_onexit_table _register_onexit_function _crt_atexit system _beginthreadex _exit _invalid_parameter_noinfo strerror abort exit _initterm_e _initterm _getpid __sys_nerr _invoke_watson _errno _get_initial_narrow_environment _initialize_narrow_environment _c_exit _configure_narrow_argv _seh_filter_exe _set_app_type

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-string-l1-1-0

strcat_s towlower tolower strnlen _strdup iswspace strncpy_s strncpy strcspn strpbrk isupper strncmp strcmp strspn

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _callnewh calloc free malloc

api-ms-win-crt-convert-l1-1-0

strtoul strtoull strtol atoi strtoll strtof strtod atof

api-ms-win-crt-math-l1-1-0

floorf logf powf sinf sqrt expf cosf fmodf __setusermatherr ceilf atan2f _dclass sqrtf scalbnf ilogbf fminf roundf lround acosf

api-ms-win-crt-filesystem-l1-1-0

_stat64 remove _access _lock_file _unlock_file _unlink _fstat64

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory