loader-01a14ff9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
loader-01a14ff9.exe
Size 14.8MB
Sample261018-v4d6jsft7k
SHA256 2e4cf4cb1e785986d2e0bce2cccc36890783210ea24301ee13ee2df03c42dff1
MD5 c5053e3823bdfb6b668223f0adb41375
SHA1 b8f01ba506580b135c428bf2d82d1c815741177e
SHA512 eb526dbf1c633217b2394d9f09a00505835349f819c40550e3f97a4402a6e38a039b31d40efa362e8b8d01003ef2f84e1d03025228464f487e7034f4feb43b95
SSDEEP 393216:LAOTtfrUihk2/WbWCzh7Ow0cwv8vWcWGnlE8jhuC2Tmj:L1TdwihZYHzdHwv4WGlE3C
TLSH
T1F4F623C6D47B92ADD49727702CC6139E1C8831EAD8FC869E39C9CC0B2559E2D5CCE2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader-01a14ff9.exe

File Explorer

loader-01a14ff9.exe

.exe 14.8MB

loader-01a14ff9.exe

IMPHASH b653e87ac450958db95a3a396ffada75
SHA256 2e4cf4cb1e785986d2e0bce2cccc36890783210ea24301ee13ee2df03c42dff1
MD5 c5053e3823bdfb6b668223f0adb41375
SHA1 b8f01ba506580b135c428bf2d82d1c815741177e
SHA512 eb526dbf1c633217b2394d9f09a00505835349f819c40550e3f97a4402a6e38a039b31d40efa362e8b8d01003ef2f84e1d03025228464f487e7034f4feb43b95
SSDEEP 393216:LAOTtfrUihk2/WbWCzh7Ow0cwv8vWcWGnlE8jhuC2Tmj:L1TdwihZYHzdHwv4WGlE3C
TLSH
T1F4F623C6D47B92ADD49727702CC6139E1C8831EAD8FC869E39C9CC0B2559E2D5CCE2B5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24490590

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtQuerySystemInformation

dbghelp

SymUnloadModule64

shlwapi

PathFileExistsA

urlmon

URLDownloadToFileA

shell32

ShellExecuteA

kernel32

FindClose GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

TranslateMessage

advapi32

RegEnumKeyExW

ole32

CoInitialize

oleaut32

SafeArrayGetUBound

msvcp140

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

bcrypt

BCryptGenerateSymmetricKey

wevtapi

EvtClearLog

winhttp

WinHttpOpenRequest

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-string-l1-1-0

isalnum

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nvfc

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

963KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.F"N

Size

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.#W$

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.A^"

Size

14.8MB

Virtual Size

14.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader-01a14ff9.exe

ntdll

dbghelp

shlwapi

urlmon

shell32

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

bcrypt

wevtapi

winhttp

ws2_32

iphlpapi

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

generic