loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 630KB
Sample261018-ybfepacd46
SHA256 673fb8d4d2ab7691bd01585373076e775d417c69d3f15598cebd88a538eb4de4
MD5 ae4c9b04c44396acb6571df7476e55d1
SHA1 c4d5c379797427ca2d6f35a7b99c2070f7426dae
SHA512 8614229e2f36367ffa4d86a58a1e1818a8d100daa7a7c932f8b87a112e7871c4f80ffdc0e728890e2238e597889a987ab8079908647d79bbf61a1103b7b32242
SSDEEP 12288:t0258iKXMcStvC530yvqy+cDjG1KwW9P2:t0UsMT163Pp+1W
TLSH
T1F0D49D12569907B8F5F7E4B8CD7A0507E772784A17A096EF13E044B62F232E85E3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 630KB

loader.exe

IMPHASH 6bc84868af8755f2363827037101e08c
SHA256 673fb8d4d2ab7691bd01585373076e775d417c69d3f15598cebd88a538eb4de4
MD5 ae4c9b04c44396acb6571df7476e55d1
SHA1 c4d5c379797427ca2d6f35a7b99c2070f7426dae
SHA512 8614229e2f36367ffa4d86a58a1e1818a8d100daa7a7c932f8b87a112e7871c4f80ffdc0e728890e2238e597889a987ab8079908647d79bbf61a1103b7b32242
SSDEEP 12288:t0258iKXMcStvC530yvqy+cDjG1KwW9P2:t0UsMT163Pp+1W
TLSH
T1F0D49D12569907B8F5F7E4B8CD7A0507E772784A17A096EF13E044B62F232E85E3A713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

162736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SizeofResource FindResourceW WriteConsoleA SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleOutputAttribute SetConsoleTitleW LockResource CloseHandle DeviceIoControl GetCurrentProcessId GetCurrentThreadId VirtualAlloc VirtualFree GetModuleHandleA GetProcAddress GetModuleFileNameW SetEndOfFile LoadResource GetWindowsDirectoryW GetTickCount Sleep SetUnhandledExceptionFilter GetTempPathW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetStdHandle WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc ReadConsoleInputW GetLastError MultiByteToWideChar WideCharToMultiByte LocalFree QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetConsoleCP CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW SetConsoleMode RtlUnwind

advapi32

RegSetKeyValueW RegOpenKeyW RegCreateKeyW RegDeleteTreeW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey FreeSid CheckTokenMembership AllocateAndInitializeSid

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

ntdll

NtLoadDriver NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString NtUnloadDriver

Name

.text

Size

324KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

kernel32

advapi32

ole32

oleaut32

ntdll

generic