loader (2)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader (2).exe
Size 2.0MB
Sample261107-wheevsdx4y
SHA256 ade3ae8e05cda971dffa9bb9f9c5b44890e7b887f2d73f11dc5aa70eaad08055
MD5 f3e366556f1ee4a24ce49084eb98aeb2
SHA1 54e698f32d22bd425661177ee872abdd28b65c76
SHA512 cd0597f547eebefe6f88273eddb049a28d2c56927c160561049d985c04a27dc5925eb461334d8c9dbeded57b211cd8162c946885974151609c8eee06c4298c6c
SSDEEP 49152:7VJ7rbJUDfq/hMzw0eI0M60Qn498EAojQ:jDJxak
TLSH
T14EA56B06B35401A8C173C2B89956D7F7E731BC4513389BE712E4DD633FAA6E04EBA681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader (2).exe

File Explorer

loader (2).exe

.exe 2.0MB

loader (2).exe

IMPHASH 5b307aa1c93b84cae5e9e3c76eff8664
SHA256 ade3ae8e05cda971dffa9bb9f9c5b44890e7b887f2d73f11dc5aa70eaad08055
MD5 f3e366556f1ee4a24ce49084eb98aeb2
SHA1 54e698f32d22bd425661177ee872abdd28b65c76
SHA512 cd0597f547eebefe6f88273eddb049a28d2c56927c160561049d985c04a27dc5925eb461334d8c9dbeded57b211cd8162c946885974151609c8eee06c4298c6c
SSDEEP 49152:7VJ7rbJUDfq/hMzw0eI0M60Qn498EAojQ:jDJxak
TLSH
T14EA56B06B35401A8C173C2B89956D7F7E731BC4513389BE712E4DD633FAA6E04EBA681
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

893104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0x3z1\Downloads\eminence_res\eminence_res\build\loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetTickCount64 GetLastError Process32NextW CreateFileA FileTimeToSystemTime LoadLibraryA QueryPerformanceFrequency DeleteFileA DeleteFileW Process32FirstW CloseHandle GetLocalTime FillConsoleOutputAttribute Beep GetProcAddress SetFilePointerEx CreateFileMappingA LocalFree SetConsoleCP GetCurrentProcessId FreeLibrary GetConsoleWindow CreateProcessA SetConsoleOutputCP GetSystemTimeAsFileTime GetSystemTime SetConsoleCursorPosition QueryPerformanceCounter SetCommTimeouts GetTickCount SetConsoleTitleW ConnectNamedPipe FlushFileBuffers GetExitCodeProcess OutputDebugStringA GetLocaleInfoA IsDBCSLeadByte GetModuleHandleW RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFileAttributesExW FindNextFileW Sleep FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW WakeAllConditionVariable MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA DuplicateHandle CreateFileW WaitForSingleObject CreateMutexA GetEnvironmentVariableA SetFilePointer SetSystemTime SetConsoleWindowInfo CreateNamedPipeW GetModuleFileNameW TerminateProcess DeviceIoControl SetConsoleMode WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect WriteFile GetStdHandle SetConsoleScreenBufferSize GetCurrentProcess SetConsoleTitleA GetConsoleScreenBufferInfo GetFileSizeEx SetNamedPipeHandleState SetConsoleCtrlHandler FillConsoleOutputCharacterA GetModuleFileNameA SleepConditionVariableSRW GetExitCodeThread WaitForSingleObjectEx WideCharToMultiByte GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA InitOnceBeginInitialize InitOnceComplete GetSystemTimePreciseAsFileTime RtlPcToFileHeader RaiseException GetConsoleMode HeapFree GetConsoleOutputCP GetTimeZoneInformation HeapAlloc GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError ReadFile SetEndOfFile FindFirstFileExW RtlUnwind RtlUnwindEx

user32

PostQuitMessage SetWindowLongW GetAsyncKeyState DeleteMenu MessageBoxW SetWindowPos GetSystemMenu GetWindowLongW GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent DestroyWindow CreateWindowExW SendMessageW UnregisterClassW ClientToScreen ShowWindow DispatchMessageW PeekMessageW TranslateMessage LoadIconW RegisterClassExW UpdateWindow DefWindowProcW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture

advapi32

CryptReleaseContext CryptGetHashParam OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW AdjustTokenPrivileges LookupPrivilegeValueW

ole32

CoUninitialize CoCreateGuid CoCreateInstance CoInitializeEx

bcrypt

BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptOpenAlgorithmProvider BCryptEncrypt BCryptDestroyKey BCryptGetProperty BCryptExportKey BCryptGenRandom BCryptFinishHash BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider

crypt32

CertFreeCertificateContext CryptStringToBinaryA CryptDecodeObjectEx CertOpenStore CryptBinaryToStringA PFXExportCertStore CertCloseStore CertStrToNameA CryptImportPublicKeyInfoEx2 CertCreateSelfSignCertificate

wininet

InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA InternetQueryOptionA HttpQueryInfoA InternetReadFile

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

fwpuclnt

FwpmEngineOpen0 FwpmFilterAdd0 FwpmEngineClose0 FwpmSubLayerAdd0

ws2_32

setsockopt freeaddrinfo htons htonl accept bind closesocket select ntohl listen inet_pton getaddrinfo WSAStartup send socket connect recv WSAGetLastError

secur32

DecryptMessage InitializeSecurityContextW FreeCredentialsHandle AcquireCredentialsHandleW DeleteSecurityContext AcceptSecurityContext EncryptMessage FreeContextBuffer QueryContextAttributesW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

844KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader (2).exe

d3d11

d3dcompiler_47

kernel32

user32

advapi32

ole32

bcrypt

crypt32

wininet

winhttp

fwpuclnt

ws2_32

secur32

imm32

generic