loader (2)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader (2).exe
Size 215KB
Sample261107-wc5d4azyf1
SHA256 d597ccb94a6401a9a8dfddb2ca10675866c6ed205bd8896ae568e9d4aab620ed
MD5 c5758106929ee159a6fc15af4ff4ba9b
SHA1 804476222c480c7c052a88b9a28f2f3b9951d161
SHA512 309d04a814dbe11ebab9456674247973cb6c4835ef8e679030261ea3247f343a9a3652e8d1b9e9680df5b4f01f90dd6b1f68f585524329c5e60e80196d2dc2cd
SSDEEP 6144:hXIDxq2rY5MmNSnLnZEWx6RfeHMJmwr5FfsF:ZbCrEWx6RfeHMh
TLSH
T120248E15F6A509FED637C279C9520A06EA737C460770EACF039046B69F236E4AE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader (2).exe

File Explorer

loader (2).exe

.exe 215KB

loader (2).exe

IMPHASH aa601bc155d27b250255604a5c3b6ae1
SHA256 d597ccb94a6401a9a8dfddb2ca10675866c6ed205bd8896ae568e9d4aab620ed
MD5 c5758106929ee159a6fc15af4ff4ba9b
SHA1 804476222c480c7c052a88b9a28f2f3b9951d161
SHA512 309d04a814dbe11ebab9456674247973cb6c4835ef8e679030261ea3247f343a9a3652e8d1b9e9680df5b4f01f90dd6b1f68f585524329c5e60e80196d2dc2cd
SSDEEP 6144:hXIDxq2rY5MmNSnLnZEWx6RfeHMJmwr5FfsF:ZbCrEWx6RfeHMh
TLSH
T120248E15F6A509FED637C279C9520A06EA737C460770EACF039046B69F236E4AE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ShowWindow DestroyWindow CreateWindowExW RegisterClassExW SetWindowPos SetProcessDPIAware DispatchMessageW TranslateMessage GetMessageW SystemParametersInfoW SetWindowLongPtrW PtInRect FillRect MessageBeep GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint SetForegroundWindow UpdateWindow DrawTextW EnableWindow SetFocus SetLayeredWindowAttributes CallWindowProcW PostQuitMessage PostMessageW SendMessageW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowW InvertRect ClipCursor ReleaseDC GetDC GetSystemMetrics KillTimer SetTimer GetAsyncKeyState DefWindowProcW

gdi32

SetBkColor RoundRect CreateSolidBrush CreateFontW Arc TextOutW MoveToEx CreateDIBSection SetTextColor SetBkMode SelectObject Rectangle LineTo GetTextExtentPoint32W GetStockObject Ellipse DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC BitBlt

shell32

SHGetKnownFolderPath SHCreateDirectoryExW

advapi32

RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegSetValueExW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

kernel32

GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW MultiByteToWideChar HeapReAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx GetFileType HeapSize IsProcessorFeaturePresent GetStdHandle GetProcAddress GetConsoleOutputCP GetConsoleMode WriteConsoleW HeapAlloc CloseHandle GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess GetEnvironmentVariableW GetFileAttributesW GetTickCount64 GetModuleFileNameW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileSize GetFileSizeEx ReadFile SetFileAttributesW WriteFile MoveFileExW GetModuleHandleW SetThreadExecutionState GetTempPathW GetLastError WaitForSingleObject CreateMutexW CreateEventW Sleep CreateProcessW CopyFileW SetEvent CreateThread GetCurrentProcess SetPriorityClass ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead DeleteCriticalSection RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx

Name

.text

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader (2).exe

user32

gdi32

shell32

advapi32

ole32

kernel32

generic