Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 14.3MB
Sample261030-d88saavyfx
SHA256 fb70e96a6f6b56a72ba0ef8ec1413af2bfe0ccdbf4fdb4f74964fdfbe29fbbd9
MD5 1288abcaeabf4b0d6bb3b9c9d4f2676e
SHA1 c9076ca234ef01ed98e95f7d68fadc2f9aca9bca
SHA512 430e72fe5d863bb673c1d228a94dff4035bbb8c141ca8707122072513f965492cef9e99c77940b865721a84845fe3b7d84549ca8bef0b1304ee72c80081a58ad
SSDEEP 393216:8IyIqGwvisCrawxeIWkbIG7+/l3ZXj43:8I4isYawgNqnyvT
TLSH
T198E6224BF39889C2C96741F98851071BA336EC635F23530B2298B66E6E377DC2F26355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 14.3MB

Loader.exe

IMPHASH 4f7dd6488ec425d13fee1220039f8dc7
SHA256 fb70e96a6f6b56a72ba0ef8ec1413af2bfe0ccdbf4fdb4f74964fdfbe29fbbd9
MD5 1288abcaeabf4b0d6bb3b9c9d4f2676e
SHA1 c9076ca234ef01ed98e95f7d68fadc2f9aca9bca
SHA512 430e72fe5d863bb673c1d228a94dff4035bbb8c141ca8707122072513f965492cef9e99c77940b865721a84845fe3b7d84549ca8bef0b1304ee72c80081a58ad
SSDEEP 393216:8IyIqGwvisCrawxeIWkbIG7+/l3ZXj43:8I4isYawgNqnyvT
TLSH
T198E6224BF39889C2C96741F98851071BA336EC635F23530B2298B66E6E377DC2F26355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21590748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.adata

Size

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=210, id=261, version=33145,

count=24, id=259, version=33145,

count=1, id=253, version=35403,

count=12, id=259, version=35403,

count=20, id=260, version=35403,

count=106, id=261, version=35403,

count=26, id=260, version=31107,

count=34, id=260, version=33145,

count=42, productName=Unmarked objects (old),

count=5, id=265, version=35729,

count=42, id=257, version=33145,

count=1158, id=260, version=35729,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=9, id=156, version=21202,

count=492, id=1, productName=Unmarked objects,

count=20, id=261, version=35729,

count=1, id=256, version=35729,

count=1, id=255, version=35729,

count=1, id=151,

count=1, id=258, version=35729,

Sharing

General

Malware Config

Signatures

File Explorer

Loader.exe

kernel32

generic