Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 17.5MB
Sample261026-rd3jnsfv2m
SHA256 078b3056cdbb606762881677e30317f3e1ac4151e90b4185b6964b5f081510d6
MD5 c3891d41e9b9aba1f044b2b3ce813038
SHA1 1e9b8516d849279884143a80f4bd99405515fd0e
SHA512 e460bfc1f77d2f9d5c59ffee2c97f6976b115fa1e5a651faa2357c33c3e9d01e66df97788367d771fd775b9c1b7c30332edd6d7f1ee27ee102a6211907c55fca
SSDEEP 393216:XQBa1/SSSSSoSSSSSSSSISSSSSSSSST/Bv:XQBa1/SSSSSoSSSSSSSSISSSSSSSSSTd
TLSH
T1F607D004E3CA4B4EDB33297A486093A38795BF1D5F2143F7718DB9B2458A8B04DA97C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 17.5MB

Loader.exe

IMPHASH a66c4440a3d4b981f93989b1515bb7b4
SHA256 078b3056cdbb606762881677e30317f3e1ac4151e90b4185b6964b5f081510d6
MD5 c3891d41e9b9aba1f044b2b3ce813038
SHA1 1e9b8516d849279884143a80f4bd99405515fd0e
SHA512 e460bfc1f77d2f9d5c59ffee2c97f6976b115fa1e5a651faa2357c33c3e9d01e66df97788367d771fd775b9c1b7c30332edd6d7f1ee27ee102a6211907c55fca
SSDEEP 393216:XQBa1/SSSSSoSSSSSSSSISSSSSSSSST/Bv:XQBa1/SSSSSoSSSSSSSSISSSSSSSSSTd
TLSH
T1F607D004E3CA4B4EDB33297A486093A38795BF1D5F2143F7718DB9B2458A8B04DA97C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW ShowWindow SetLayeredWindowAttributes SetWindowPos SetFocus GetFocus SetCapture ReleaseCapture GetSystemMetrics DrawTextW UpdateWindow BeginPaint EndPaint InvalidateRect GetMessageW SetWindowTextW GetWindowTextW GetWindowRect MessageBoxW SetCursor GetCursorPos FillRect GetWindowLongW SetWindowLongW LoadCursorW LoadImageW IsDialogMessageW

gdi32

SetTextColor SetBkMode SetBkColor SelectObject RoundRect GetStockObject FillRgn DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable

ole32

CreateStreamOnHGlobal

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

gdiplus

GdipSetClipPath GdipResetClip GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathEllipse GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipCreatePen1 GdipDeletePen GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetInterpolationMode GdipDrawPath GdipFillPath GdipDrawImageRectRectI

kernel32

LCMapStringW LoadLibraryExW VirtualProtect FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc GetConsoleOutputCP GetConsoleMode WriteConsoleW CreateFileW FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibrary ExitProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter GetComputerNameW GetVolumeInformationW WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetThreadContext DeleteFileW FlushFileBuffers WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess TerminateProcess CreateThread GetCurrentThread CreateProcessW

Name

.text

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17.3MB

Virtual Size

17.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

user32

gdi32

winhttp

ole32

dwmapi

gdiplus

kernel32

generic