loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 1.0MB
Sample261027-e5qyqsav71
SHA256 16e856dd8932d1de314cfb71039276672426058d9608fef938b05f70b789b312
MD5 9c954d1978a0eac0556ed324cc20619a
SHA1 954922f3f92eb4844e6caa160c0f23eb9f70f5dd
SHA512 741258bfdf2063fee8cf151624fe4fcf892b45b11038f5c16e68c6b509ec862c3b7272584829a8df3e7ecac187466e80893be2b114b6d7abd14304b40fc07eec
SSDEEP 24576:b+QAEjty68TY9YdQVQXNHmoZJEeoihn5j0i:iQdwUBMlhnZ0
TLSH
T13B359D45B3E901E8E1BB9574D9B1651BDA3638550B308ADF07D006692F73BE04BBBB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 1.0MB

loader.exe

IMPHASH fde8525733691a3720bf634446da79fa
SHA256 16e856dd8932d1de314cfb71039276672426058d9608fef938b05f70b789b312
MD5 9c954d1978a0eac0556ed324cc20619a
SHA1 954922f3f92eb4844e6caa160c0f23eb9f70f5dd
SHA512 741258bfdf2063fee8cf151624fe4fcf892b45b11038f5c16e68c6b509ec862c3b7272584829a8df3e7ecac187466e80893be2b114b6d7abd14304b40fc07eec
SSDEEP 24576:b+QAEjty68TY9YdQVQXNHmoZJEeoihn5j0i:iQdwUBMlhnZ0
TLSH
T13B359D45B3E901E8E1BB9574D9B1651BDA3638550B308ADF07D006692F73BE04BBBB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SetCursorPos IsWindowVisible GetAsyncKeyState SetLayeredWindowAttributes MessageBoxW GetSystemMetrics GetKeyboardLayout GetWindowLongPtrW LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent IsWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard MapVirtualKeyA GetKeyNameTextA SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetWindowRect GetForegroundWindow GetWindowThreadProcessId GetClassNameW EnumWindows SetWindowLongPtrW

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathW

advapi32

OpenServiceW ControlService CreateServiceW OpenProcessToken GetTokenInformation DeleteService RegQueryValueExW RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey StartServiceW OpenSCManagerW CloseServiceHandle

kernel32

LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile ReadFile WriteConsoleW GetFileType GetModuleHandleExW FlushFileBuffers GetConsoleOutputCP GetExitCodeProcess GetFileAttributesExW LoadLibraryExW TlsFree OutputDebugStringW SetFilePointerEx GetFileSizeEx GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStdHandle CreateFileW GetFileAttributesW CloseHandle GetStringTypeW DeviceIoControl WaitForSingleObject Sleep GetCurrentProcess ExitProcess CreateProcessW GetTickCount64 FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW lstrcmpiW GetConsoleMode SetConsoleMode ReadConsoleW GetConsoleScreenBufferInfo SetConsoleScreenBufferSize GetLargestConsoleWindowSize SetConsoleTextAttribute SetConsoleWindowInfo SetConsoleTitleW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess ReadProcessMemory WriteProcessMemory Module32FirstW Module32NextW CreateDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetFileAttributesA GetModuleFileNameA GetModuleHandleW FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW DeleteFileW GetDriveTypeW GetLogicalDrives RemoveDirectoryW SetFileAttributesW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA IsDBCSLeadByte TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer HeapSize HeapReAlloc SetEndOfFile GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError

d3d9

Direct3DCreate9

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

754KB

Virtual Size

754KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

user32

shell32

advapi32

kernel32

d3d9

dwmapi

imm32

generic