loader-free[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader-free.exe
Size 1.9MB
Sample261102-jsq57aav2r
SHA256 0a9bbae6e815a0ba4e6aa7ac0abc7dda3e1336d0f4dfd3385b17655a954ee27c
MD5 6d2159363092caf84d9e1b44ccd7b3af
SHA1 c7e471454d22fe91fb6e3b9797cb452046c16a77
SHA512 c062177f9bb20f25a8faf06618e5a6c56e04c667ecb86a2f4175bd1acb5beddb16b7056015729e0fddbd11a4c98ca86fed2cbcfa65649d5f7d02d558ec50208e
SSDEEP 49152:9jIi0bfLK4K8zVW3HknQKt9lHOI8GZL7BMzlvnyyQtO88nUlj4CT:9ITu4DzNlHOI8GZL7BMRnkMCT
TLSH
T11295AE59B3A801E8E1B7D278C5465607EBB2744C17315ADB03D08BA92F237E16B3F768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader-free.exe

File Explorer

loader-free.exe

.exe 1.9MB

loader-free.exe

IMPHASH c73e692a772ec5404fe14eba364b518a
SHA256 0a9bbae6e815a0ba4e6aa7ac0abc7dda3e1336d0f4dfd3385b17655a954ee27c
MD5 6d2159363092caf84d9e1b44ccd7b3af
SHA1 c7e471454d22fe91fb6e3b9797cb452046c16a77
SHA512 c062177f9bb20f25a8faf06618e5a6c56e04c667ecb86a2f4175bd1acb5beddb16b7056015729e0fddbd11a4c98ca86fed2cbcfa65649d5f7d02d558ec50208e
SSDEEP 49152:9jIi0bfLK4K8zVW3HknQKt9lHOI8GZL7BMzlvnyyQtO88nUlj4CT:9ITu4DzNlHOI8GZL7BMRnkMCT
TLSH
T11295AE59B3A801E8E1B7D278C5465607EBB2744C17315ADB03D08BA92F237E16B3F768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1290416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoCreateInstance

oleaut32

SysAllocString VariantClear VariantInit SysFreeString

iphlpapi

if_nametoindex GetAdaptersAddresses

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGenRandom

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

shlwapi

ord12

shell32

ShellExecuteW

kernel32

HeapAlloc UnhandledExceptionFilter IsDebuggerPresent SizeofResource UnmapViewOfFile GetTickCount64 GetLastError LockResource CloseHandle LoadResource FindResourceW ExitProcess GetModuleHandleW CreateFileMappingW MapViewOfFile WriteProcessMemory WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory FlushInstructionCache CreateRemoteThread Module32NextW VirtualFreeEx IsWow64Process DeviceIoControl CreateFileW WideCharToMultiByte GetFileSizeEx GetModuleFileNameW GetModuleHandleA VirtualProtect GetCurrentProcess GetCurrentThreadId Sleep GetCurrentThread QueryPerformanceFrequency GetThreadContext GetCurrentProcessId QueryPerformanceCounter OpenThread CheckRemoteDebuggerPresent TerminateProcess K32EnumProcessModulesEx K32GetModuleBaseNameW VerSetConditionMask FreeLibrary LoadLibraryA MultiByteToWideChar GetLocaleInfoA IsDBCSLeadByte OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GetDateFormatW RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread HeapFree GetCommandLineW GetCommandLineA FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitOnceBeginInitialize InitOnceComplete GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetSystemTimePreciseAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetSystemInfo InitializeCriticalSection GetTimeZoneInformation HeapReAlloc GetCurrentDirectoryW RtlUnwind SetStdHandle LocalFree CreateThread WaitForSingleObjectEx SleepConditionVariableCS WakeConditionVariable WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle FindNextFileW FindClose VerifyVersionInfoW InitializeConditionVariable GetEnvironmentVariableA MoveFileExW GetFullPathNameW FindFirstFileW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepEx FormatMessageA SetLastError AcquireSRWLockExclusive ReleaseSRWLockExclusive DeleteFileW SetEndOfFile IsValidCodePage GetACP GetOEMCP FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap ExitThread LoadLibraryExW WriteConsoleW HeapSize GlobalFree

user32

LoadCursorW LoadIconW TranslateMessage PeekMessageW DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW ScreenToClient CreateWindowExW MessageBoxW PostQuitMessage DefWindowProcW GetWindowTextW GetClassNameW GetClientRect GetKeyboardLayout TrackMouseEvent GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow SetCursorPos SetCursor GetCursorPos ClientToScreen SystemParametersInfoW UpdateWindow GetDpiForSystem EnumWindows DestroyWindow LoadCursorA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDPIAware GetMessageExtraInfo

advapi32

RegCloseKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegOpenKeyExW RegQueryValueExW

ntdll

NtQueryInformationProcess NtSetInformationThread NtQuerySystemInformation

d3dcompiler_47

D3DCompile

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent send getsockopt gethostname WSAWaitForMultipleEvents WSAGetLastError WSAStartup accept bind closesocket getpeername getsockname htons ntohs recv setsockopt socket WSASetLastError WSAIoctl __WSAFDIsSet select getaddrinfo freeaddrinfo htonl listen recvfrom sendto ioctlsocket connect

crypt32

CertFindCertificateInStore CertEnumCertificatesInStore CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptStringToBinaryW PFXImportCertStore CertCloseStore CryptDecodeObjectEx

secur32

InitSecurityInterfaceW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

365KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader-free.exe

ole32

oleaut32

iphlpapi

bcrypt

d3d11

dwmapi

shlwapi

shell32

kernel32

user32

advapi32

ntdll

d3dcompiler_47

imm32

ws2_32

crypt32

secur32

generic