Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 47KB
Sample261107-rwtpgsfb74
SHA256 a7cfd6174f3555cbd217130eae0477a410a6cef21426ebf11f2d45796b9d9f47
MD5 3cc7b2ee8504fa2e9ee3333c03cd1bc6
SHA1 6183e4d77f729674a0749837da3ff7abc07c1dd9
SHA512 3aec1058670d1a5d89bb67e05284197c4bec19fa88cdf91800f7a9cbb15d8ebdd395d6874eafcff0ffcfdfb29f66e7cbca4d5f782daa44cbf7ef2345c5316dd4
SSDEEP 768:4yv16CES58Ed2MLQ2WNGbCgUj+RcF7kjerG:4yvqS5lQ2MGbCgI+bjy
TLSH
T1E223E622EDABD137D3494DB0D9135E16CE73ECA68FE0B5C7A7805DE208146D0AB7A306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 47KB

Loader.exe

IMPHASH b4ae670201ab269bb31e2255700fb958
SHA256 a7cfd6174f3555cbd217130eae0477a410a6cef21426ebf11f2d45796b9d9f47
MD5 3cc7b2ee8504fa2e9ee3333c03cd1bc6
SHA1 6183e4d77f729674a0749837da3ff7abc07c1dd9
SHA512 3aec1058670d1a5d89bb67e05284197c4bec19fa88cdf91800f7a9cbb15d8ebdd395d6874eafcff0ffcfdfb29f66e7cbca4d5f782daa44cbf7ef2345c5316dd4
SSDEEP 768:4yv16CES58Ed2MLQ2WNGbCgUj+RcF7kjerG:4yvqS5lQ2MGbCgI+bjy
TLSH
T1E223E622EDABD137D3494DB0D9135E16CE73ECA68FE0B5C7A7805DE208146D0AB7A306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

user32

UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId FindWindowA SetWindowLongA GetWindowLongA ShowScrollBar SetWindowPos PostThreadMessageW PostMessageW

msvcp140

?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ??0_Lockit@std@@QAE@H@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ?fail@ios_base@std@@QBE_NXZ ?good@ios_base@std@@QBE_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent Module32NextW Module32FirstW Thread32Next Thread32First Process32NextW Process32FirstW CreateToolhelp32Snapshot GetConsoleWindow SetConsoleTitleW SetConsoleWindowInfo SetConsoleTextAttribute SetConsoleScreenBufferSize SetConsoleCursorInfo GetConsoleCursorInfo SetConsoleMode GetConsoleMode LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary VirtualFreeEx WriteProcessMemory VirtualAllocEx OpenProcess CreateRemoteThread GetCurrentProcess Sleep WaitForSingleObject CloseHandle GetStdHandle

vcruntime140

__std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException __CxxFrameHandler3 memcpy memmove memset __current_exception __current_exception_context _except_handler4_common

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-stdio-l1-1-0

fclose __p__commode _set_fmode fgetc fgetpos fputc fread fsetpos _fseeki64 ungetc setvbuf fflush _get_stream_buffer_pointers fwrite

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _cexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale