loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 1.4MB
Sample261024-wsdw3sds2r
SHA256 8df5513c6109e00576e79bf5407e4618c9a74125af8b99e36e57c0c2fe5f8bd0
MD5 e323f5dca054da729844f1c83ebdf644
SHA1 974e8bc5dd56d1cfdbe306b0e0ab13ff6d7dc0db
SHA512 f6c0db1f4c8bf57bb39fa87a0ba086b5853b1e79b2a42768319115b210468d7ddd6dc1f97b9d9b28c3aca4463e1cdacd518761c1da01b0a1544dfe5f3aeac217
SSDEEP 24576:3HWdRW210HiknwjcMyImxqUivh+FkR3uZIQ96/NsRQdeNpRsJ:32dmCknqcHIb+FkRO9gsudeNvsJ
TLSH
T1CD650243B1F944E4C027D2789992AB0FEEB83458175447DB73D8D9682BD36E0A3F9B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.4MB

loader.exe

IMPHASH 5aa47bd85a9dce5e88da6f6a84249971
SHA256 8df5513c6109e00576e79bf5407e4618c9a74125af8b99e36e57c0c2fe5f8bd0
MD5 e323f5dca054da729844f1c83ebdf644
SHA1 974e8bc5dd56d1cfdbe306b0e0ab13ff6d7dc0db
SHA512 f6c0db1f4c8bf57bb39fa87a0ba086b5853b1e79b2a42768319115b210468d7ddd6dc1f97b9d9b28c3aca4463e1cdacd518761c1da01b0a1544dfe5f3aeac217
SSDEEP 24576:3HWdRW210HiknwjcMyImxqUivh+FkR3uZIQ96/NsRQdeNpRsJ:32dmCknqcHIb+FkRO9gsudeNvsJ
TLSH
T1CD650243B1F944E4C027D2789992AB0FEEB83458175447DB73D8D9682BD36E0A3F9B12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\agx\Downloads\katurn-spoofer\katurn-spoofer\build\STier.pdb

d3d11

D3D11CreateDeviceAndSwapChain

user32

DispatchMessageA DestroyWindow GetSystemMetrics ShowWindow DefWindowProcA CreateWindowExA TranslateMessage PeekMessageA PostQuitMessage RegisterClassExA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard UpdateWindow ShowCursor MessageBoxA SetWindowPos SetWindowLongA GetWindowLongA DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor OpenClipboard

kernel32

IsDebuggerPresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetTickCount LoadResource LockResource GetTickCount64 FindResourceA SizeofResource CloseHandle GetLastError Sleep ReleaseMutex CreateMutexA SetConsoleCursorPosition SetConsoleOutputCP GetConsoleWindow FillConsoleOutputAttribute WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent TerminateProcess RtlCaptureContext RtlLookupFunctionEntry SleepConditionVariableSRW RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle SetCurrentConsoleFontEx SetConsoleWindowInfo GetCurrentProcess

shell32

ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

gdi32

GetStockObject

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exceptions@std@@YAHXZ

gdiplus

GdipGetImageHeight GdipCloneImage GdipBitmapUnlockBits GdipGetPropertyItem GdipCreateBitmapFromStream GdiplusStartup GdipGetPropertyItemSize GdipFree GdipImageSelectActiveFrame GdipBitmapLockBits GdipImageGetFrameCount GdipGetImageWidth GdiplusShutdown GdipAlloc GdipDisposeImage

ole32

CreateStreamOnHGlobal

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException memcpy memcmp memchr memset __std_terminate __std_exception_destroy __std_exception_copy __current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsscanf _set_fmode fread ftell __stdio_common_vsprintf _wfopen fwrite fseek __p__commode fclose __acrt_iob_func fflush

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_exit _c_exit exit _initterm_e _register_thread_local_exe_atexit_callback _invoke_watson terminate __p___argc _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argv _get_initial_narrow_environment _initterm

api-ms-win-crt-math-l1-1-0

sinf fmodf cosf sqrtf acosf ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale