loader[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.dll
Size 9.8MB
Sample261023-2dcclavy5k
SHA256 de8a9bf059627c5d4d4f65ae55e0bd604a09df1d7a442f13fd02644046010418
MD5 668fe92cc9eb6895a2d3d093ffabb0a6
SHA1 f405c8f98ec7d8610c7dd37854b02ce94279e5ca
SHA512 53168d384a9cb365d441ec02439eac1054e1581e992cb6ecd473160247821d0cb6ecd8789bf31bc538c28e82fdeab2397057c13315478a7c45df7babb9db5318
SSDEEP 98304:yWwkke7BBoFkxvS+Z722kC+VLwWEUWTD/n9VSuOu:YXPFkFWLwW4/9VdOu
TLSH
T106A6F83BEA7B88A9C1E781B4BB83E6B16931BC590030B05F158697513B4FD601BEE7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.dll

File Explorer

loader.dll

.dll 9.8MB

loader.dll

IMPHASH 7cfe9d43378c3de0435cf5936b02892f
SHA256 de8a9bf059627c5d4d4f65ae55e0bd604a09df1d7a442f13fd02644046010418
MD5 668fe92cc9eb6895a2d3d093ffabb0a6
SHA1 f405c8f98ec7d8610c7dd37854b02ce94279e5ca
SHA512 53168d384a9cb365d441ec02439eac1054e1581e992cb6ecd473160247821d0cb6ecd8789bf31bc538c28e82fdeab2397057c13315478a7c45df7babb9db5318
SSDEEP 98304:yWwkke7BBoFkxvS+Z722kC+VLwWEUWTD/n9VSuOu:YXPFkFWLwW4/9VdOu
TLSH
T106A6F83BEA7B88A9C1E781B4BB83E6B16931BC590030B05F158697513B4FD601BEE7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4754

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEncrypt CryptEnumProvidersW CryptExportKey CryptGenRandom CryptGetHashParam CryptGetProvParam CryptGetUserKey CryptHashData CryptImportKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeregisterEventSource GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetNameStringW CertOpenStore CertOpenSystemStoreW CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryW PFXImportCertStore

gdi32

CreateSolidBrush DeleteObject

iphlpapi

if_nametoindex

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle ConvertFiberToThread ConvertThreadToFiberEx CreateEventA CreateFiberEx CreateFile2 CreateFileA CreateFileMappingFromApp CreateFileW CreateHardLinkW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFiber DeleteFileW DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindResourceW FindVolumeClose FlushInstructionCache FormatMessageA FormatMessageW FreeLibrary GetACP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVersion GetVolumeInformationW HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeSRWLock IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockResource MapViewOfFileFromApp MoveFileExW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SizeofResource Sleep SleepConditionVariableCS SleepEx SuspendThread SwitchToFiber SystemTimeToFileTime Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler

api-ms-win-crt-convert-l1-1-0

_ultoa atoi mbrtowc strtol strtoll strtoul strtoull wcrtomb wcstombs

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _findfirst64 _findnext64 _fstat64 _fullpath _stat64 _unlink _wchdir _wchmod _wfindfirst64 _wfindnext64 _wfullpath _wmkdir _wstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr strrchr strstr wcschr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv __sys_errlist __sys_nerr _assert _beginthreadex _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _endthreadex _errno _execute_onexit_table _exit _get_errno _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _register_onexit_function _register_thread_local_exe_atexit_callback _set_errno _wassert abort exit raise signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_s _close _close _fileno _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _read _read _setmode _telli64 _wfopen _wopen _write _write fclose feof ferror fflush fgets fgetwc fopen fputc fputs fread fseek ftell fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _strdup isalnum isspace iswctype memset strcat strcmp strcoll strcpy strcspn strlen strncmp strncpy strpbrk strspn strxfrm tolower towlower towupper wcscat wcscmp wcscoll wcscpy wcslen wcsncmp wcsncpy wcsxfrm

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _gmtime64 _time64 _tzset _wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

qsort rand_s

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear VariantInit

secur32

InitSecurityInterfaceW

shell32

SHCreateDirectoryExW SHGetFileInfoW SHGetKnownFolderPath ShellExecuteW

user32

AllowSetForegroundWindow AttachThreadInput BeginPaint BringWindowToTop CreateWindowExA CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW EndPaint FillRect FlashWindowEx GetClientRect GetCursorPos GetForegroundWindow GetMessageW GetProcessWindowStation GetUserObjectInformationW GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId IsIconic IsWindow LoadCursorW LoadImageW MessageBoxA MessageBoxW PostMessageW PostQuitMessage RegisterClassExW SetFocus SetForegroundWindow SetWindowLongPtrW SetWindowPos ShowWindow SystemParametersInfoW TranslateMessage

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSAAccept WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAPoll WSAResetEvent WSASetEvent WSASetLastError WSASocketW WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

433KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

353KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.dll

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

secur32

shell32

user32

version

ws2_32

generic