Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 14.8MB
Sample261030-2ejhasfv7y
SHA256 f658d45db1ad0b0732634e8512e6e012c6769a3bc4cf6a73751bba7f2560b0f4
MD5 02fd018a3b3e4e0279622f44b351584b
SHA1 cf55338d9b9ecf32537e0238f208b543b05ad4d0
SHA512 bd2647865cb3d09116204c6d327c4b9215615e67314fb48bf363a3be4c9dd2d3616b5468d018cc8e69901ebc6b04fd93e72ac17739e07d1b20fa8e35a1540ef4
SSDEEP 393216:RlyNhPJ8Gqe1EZd/4LVsAURjOLq+20EqMe6qF:Rly98CAuKDNOFs4
TLSH
T132F623F3A4A821E5F7538A71E357335B1B445035ED1B8A49268F38831D23CDBDA4AD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 14.8MB

Loader.exe

IMPHASH 494e8dade1d8f020d55c8f17000decea
SHA256 f658d45db1ad0b0732634e8512e6e012c6769a3bc4cf6a73751bba7f2560b0f4
MD5 02fd018a3b3e4e0279622f44b351584b
SHA1 cf55338d9b9ecf32537e0238f208b543b05ad4d0
SHA512 bd2647865cb3d09116204c6d327c4b9215615e67314fb48bf363a3be4c9dd2d3616b5468d018cc8e69901ebc6b04fd93e72ac17739e07d1b20fa8e35a1540ef4
SSDEEP 393216:RlyNhPJ8Gqe1EZd/4LVsAURjOLq+20EqMe6qF:Rly98CAuKDNOFs4
TLSH
T132F623F3A4A821E5F7538A71E357335B1B445035ED1B8A49268F38831D23CDBDA4AD2E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30027415

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

AppendMenuW TrackPopupMenu UpdateWindow GetClientRect GetCursorPos LoadCursorW CreateIconFromResourceEx MonitorFromWindow GetMonitorInfoW DestroyMenu ShowWindow IsWindowVisible CreatePopupMenu IsIconic LoadIconW DestroyIcon GetSystemMetrics SetTimer DefWindowProcW GetKeyNameTextA MapVirtualKeyW FindWindowA LoadImageW TranslateMessage MessageBoxW GetUserObjectInformationW GetProcessWindowStation DispatchMessageW PeekMessageW GetWindowRect MessageBeep GetWindowLongW KillTimer ReleaseCapture IsZoomed DestroyWindow CreateWindowExW RegisterClassExW GetMessageW PostQuitMessage SendMessageW PostMessageW GetWindowThreadProcessId FindWindowW EnumWindows SetForegroundWindow MsgWaitForMultipleObjects

shlwapi

ord12

winhttp

WinHttpGetIEProxyConfigForCurrentUser

dbghelp

SymGetModuleBase64 UnDecorateSymbolName SymFunctionTableAccess64

advapi32

CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextW CryptGenRandom RegGetValueW CryptReleaseContext CryptAcquireContextA

ole32

CoTaskMemAlloc PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

mfplat

MFStartup MFCreateMFByteStreamOnStream MFCreateMediaType

mfreadwrite

MFCreateSourceReaderFromByteStream

kernel32

FlsFree FlsSetValue FlsGetValue RtlUnwind RtlUnwindEx RtlLookupFunctionEntry FlsAlloc ExitThread GetConsoleOutputCP CreateFileW DeleteFileW GetFileAttributesW GetTempFileNameW WriteFile GetTempPathW CloseHandle Sleep GetModuleFileNameW GetModuleHandleW lstrcpyW ExitProcess CreateProcessA GetModuleFileNameA MoveFileExA SetEvent OpenEventA GetExitCodeProcess OpenProcess GetModuleHandleA FindFirstChangeNotificationW FindNextChangeNotification GetLastError AddVectoredExceptionHandler CreateMutexW CreateEventW WaitForMultipleObjects QueryFullProcessImageNameA QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW MoveFileExW SetFileAttributesW GetCurrentProcessId GetCurrentThreadId GlobalFree WideCharToMultiByte WaitForSingleObject GetCurrentProcess TerminateProcess CreateProcessW GetProcessId GetSystemDirectoryW GetNativeSystemInfo IsWow64Process GetProcAddress MultiByteToWideChar GetEnvironmentVariableW CreateDirectoryW GetTickCount64 GetEnvironmentVariableA CreateFileA LoadLibraryExW OutputDebugStringA VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA OpenThread GetSystemInfo VirtualQueryEx VirtualFreeEx Thread32First Thread32Next Module32FirstW K32GetModuleBaseNameA GetCurrentThread K32GetModuleInformation SetConsoleCtrlHandler GetFileInformationByHandle GetSystemTimeAsFileTime HeapCreate HeapAlloc HeapReAlloc ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect VirtualAlloc GetDriveTypeW VirtualQuery GetCurrentDirectoryW FindClose FindFirstFileW GetFileType SetEndOfFile SetFilePointer SetFileTime CreateFile2 DeviceIoControl CreateHardLinkW CreateSymbolicLinkW IsValidCodePage GetACP GetOEMCP GetFileAttributesA GetFullPathNameW ReadFile PeekNamedPipe GetStdHandle SearchPathA DuplicateHandle SetHandleInformation CreatePipe GetFileSizeEx GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetTickCount SetLastError VerifyVersionInfoW WaitForSingleObjectEx CreateThread LocalFree FormatMessageW FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI CopyFile2 GetFileInformationByHandleEx GetExitCodeThread WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared WakeConditionVariable InitOnceBeginInitialize InitOnceComplete RtlPcToFileHeader RaiseException GetModuleHandleExW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent OutputDebugStringW LoadLibraryW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FreeLibraryAndExitThread RtlCaptureContext RtlVirtualUnwind ReadConsoleW IsDebuggerPresent GetConsoleMode UnhandledExceptionFilter SetFilePointerEx SetStdHandle HeapFree RemoveDirectoryW FlushFileBuffers GetTimeZoneInformation GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW HeapSize SystemTimeToTzSpecificLocalTime InitializeSRWLock TlsAlloc VirtualFree FileTimeToSystemTime TlsGetValue TlsSetValue TlsFree InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetSystemDirectoryA GetSystemTime SystemTimeToFileTime SetConsoleMode ReadConsoleA Module32NextW GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

shell32

SetCurrentProcessExplicitAppUserModelID SHGetFolderPathW ShellExecuteA ShellExecuteExW ShellExecuteW Shell_NotifyIconW

gdi32

CreateSolidBrush

dwmapi

DwmSetWindowAttribute

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

ws2_32

inet_ntoa inet_addr gethostbyname WSAResetEvent gethostbyaddr getservbyport shutdown WSAGetLastError closesocket htons socket accept bind connect getpeername getsockname getsockopt recv send setsockopt WSASetLastError WSAIoctl WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect gethostname htonl listen sendto recvfrom ioctlsocket freeaddrinfo getaddrinfo select __WSAFDIsSet WSACleanup WSAStartup ntohs WSAWaitForMultipleEvents getservbyname

crypt32

CertGetCertificateChain CertFreeCertificateChain CertCreateCertificateChainEngine CertFindExtension CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertEnumCertificatesInStore CertOpenStore CryptQueryObject CertGetNameStringW CertGetCertificateContextProperty CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CertDuplicateCertificateContext CryptMsgClose CertOpenSystemStoreW CertFreeCertificateChainEngine CertFreeCTLContext

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext CryptCATCatalogInfoFromContext WinVerifyTrust CryptCATAdminCalcHashFromFileHandle

Name

.text

Size

Virtual Size

15.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

806KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sheldon

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sheldon

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sheldon

Size

13.9MB

Virtual Size

13.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

923KB

Virtual Size

923KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

user32

shlwapi

winhttp

dbghelp

advapi32

ole32

version

mfplat

mfreadwrite

kernel32

shell32

gdi32

dwmapi

bcrypt

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

secur32

iphlpapi

wintrust

generic