loader[.]dll | Triage™

Resubmissions

27/10/2026, 19:40

261027-ydh9csfv918

27/10/2026, 19:38

27/10/2026, 19:33

27/10/2026, 19:33

27/10/2026, 19:30

27/10/2026, 19:27

Sharing

Copy URL Twitter E-mail

General

Target
loader.dll
Size 6.2MB
Sample261027-ydh9csfv91
SHA256 be4fd805bc37881a1107fb35e9220fa80536e3e06b2b2c4408220596deaff6e4
MD5 0e33b95de85a91f1333dc64c1f75cec9
SHA1 a6a20a2051ca0781ee59af7dcc26ba06d33a2e6f
SHA512 7d2d4d076a531b7bc1d64d0947b4bd9d86df289c24bea68764517f79d48903c1ca4f5af945bf1fd130b72d80cdc63d50ff822b87e0578f9b4bad390ffa8e0cf3
SSDEEP 49152:cZ9w5GUx8bpnveEzURFH0Q5XuyGuJ/A05Dk2FjMO3kF+0lKz1AkdsTMwNgWBhrWb:lNe83kF/lyRcCATEUoyc
TLSH
T144568D43E7BB91A9D267C139D0527763FCB07C094B38A7A757D09A626B62F9049FE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.dll

File Explorer

loader.dll

.dll 6.2MB

loader.dll

IMPHASH 6c9197e6cc25daec8751ac77dce2b407
SHA256 be4fd805bc37881a1107fb35e9220fa80536e3e06b2b2c4408220596deaff6e4
MD5 0e33b95de85a91f1333dc64c1f75cec9
SHA1 a6a20a2051ca0781ee59af7dcc26ba06d33a2e6f
SHA512 7d2d4d076a531b7bc1d64d0947b4bd9d86df289c24bea68764517f79d48903c1ca4f5af945bf1fd130b72d80cdc63d50ff822b87e0578f9b4bad390ffa8e0cf3
SSDEEP 49152:cZ9w5GUx8bpnveEzURFH0Q5XuyGuJ/A05Dk2FjMO3kF+0lKz1AkdsTMwNgWBhrWb:lNe83kF/lyRcCATEUoyc
TLSH
T144568D43E7BB91A9D267C139D0527763FCB07C094B38A7A757D09A626B62F9049FE300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2980260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CloseThreadpoolTimer CloseThreadpoolWait CompareStringW CreateEventExW CreateFileA CreateFileW CreateMutexA CreateProcessW CreateRemoteThread CreateSemaphoreExW CreateSymbolicLinkW CreateThread CreateThreadpoolTimer CreateThreadpoolWait CreateToolhelp32Snapshot DeleteCriticalSection DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FlushProcessWriteBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale IsWow64Process K32EnumProcessModulesEx K32GetModuleFileNameExW LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadContext SetThreadpoolTimer SetThreadpoolWait SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnhandledExceptionFilter VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolTimerCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64GetThreadContext Wow64SetThreadContext WriteConsoleW WriteFile WriteProcessMemory

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowRect GetWindowTextA IsWindowUnicode IsWindowVisible LoadCursorW MonitorFromWindow OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW RegisterHotKey ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetLayeredWindowAttributes SetProcessDPIAware SetWindowDisplayAffinity SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UnregisterHotKey

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmIsCompositionEnabled

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService ConvertSidToStringSidA CreateWellKnownSid GetNamedSecurityInfoW GetSecurityDescriptorDacl GetTokenInformation LookupPrivilegeValueA LookupPrivilegeValueW OpenProcessToken OpenSCManagerA OpenSCManagerW OpenServiceA OpenServiceW QueryServiceStatusEx SetEntriesInAclW SetNamedSecurityInfoW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateRectRgn DeleteDC DeleteObject GetDeviceCaps SelectObject

ole32

CoInitializeEx CreateStreamOnHGlobal

shell32

ShellExecuteW

d3dcompiler_47

D3DCompile

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromDirectDrawSurface GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipCreateBitmapFromGdiDib GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromHICON GdipCreateBitmapFromResource GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateFontFamilyFromName GdipDeleteCustomLineCap GdipDeleteFontFamily GdipDisposeImage GdipFree GdipGetGenericFontFamilySansSerif GdipGetImageEncoders GdipGetImageEncodersSize GdipLoadImageFromFile GdipLoadImageFromFileICM GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipSaveImageToStream GdiplusShutdown GdiplusStartup

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

782KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

loader.dll

kernel32

user32

dwmapi

d3d11

advapi32

gdi32

ole32

shell32

d3dcompiler_47

bcrypt

gdiplus

imm32

generic