sakura-loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
sakura-loader.exe
Size 19.4MB
Sample261024-3fa3zssx4p
SHA256 5ab247befaa8cd6c8c69d4c107be137b270710f9520d0edfeaaff173c5332afa
MD5 7cdec2e3d510be67eed2efe94340d894
SHA1 fae3b1c8fc95f1321fc6df743662b2f795a8774e
SHA512 3468ed873bbeb74b53bf14a2a5252f8f899437bc1a3798e6f0ea1832ce96eccb53b2089f46d1f459acdf4d22b6b70d82bb08244b4d718989ffdeb2e1b7379713
SSDEEP 196608:zT2s5HPPrfv9QBnbcwBM5Xbz1EfBDFyNxYXrT:pTv9Cv+oOOXX
TLSH
T14B276C43E91519EAC3A8D1F589AB460777B4BC041732A7C70B51BB347EE76C8AE7A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sakura-loader.exe

File Explorer

sakura-loader.exe

.exe 19.4MB

sakura-loader.exe

IMPHASH f3c1bdbc972ae3c2d5f9f793e8d37430
SHA256 5ab247befaa8cd6c8c69d4c107be137b270710f9520d0edfeaaff173c5332afa
MD5 7cdec2e3d510be67eed2efe94340d894
SHA1 fae3b1c8fc95f1321fc6df743662b2f795a8774e
SHA512 3468ed873bbeb74b53bf14a2a5252f8f899437bc1a3798e6f0ea1832ce96eccb53b2089f46d1f459acdf4d22b6b70d82bb08244b4d718989ffdeb2e1b7379713
SSDEEP 196608:zT2s5HPPrfv9QBnbcwBM5Xbz1EfBDFyNxYXrT:pTv9Cv+oOOXX
TLSH
T14B276C43E91519EAC3A8D1F589AB460777B4BC041732A7C70B51BB347EE76C8AE7A310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled DwmSetWindowAttribute

gdi32

ChoosePixelFormat CreateRectRgn DeleteObject GetDeviceCaps SetPixelFormat SwapBuffers

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FormatMessageA FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetHandleInformation GetLastError GetLocaleInfoA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException RaiseFailFastException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlUnwindEx SetConsoleCtrlHandler SetErrorMode SetEvent SetLastError SetProcessAffinityMask SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

api-ms-win-crt-convert-l1-1-0

atof mbrtowc mbstowcs strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf atan2f ceilf cosf fmodf log logf pow powf sinf sqrtf

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _read _wfopen _write fclose fflush fputc fputs fread fseek ftell fwrite getc ungetc

api-ms-win-crt-string-l1-1-0

_strdup isspace isxdigit mbrlen memset strcmp strcpy strlen strncmp strncpy strnlen tolower wcscmp wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

qsort rand_s

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind VerSetConditionMask

opengl32

glClear glClearColor glReadPixels glViewport wglCreateContext wglDeleteContext wglMakeCurrent

shell32

CommandLineToArgvW ShellExecuteW

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo IsIconic IsWindow IsWindowUnicode LoadCursorA LoadCursorW MonitorFromWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowPos ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

352KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

469KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/93

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/109

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/125

Size

488KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sakura-loader.exe

dwmapi

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

opengl32

shell32

user32

generic