Loader.exe?ex=670dff4f&is=670cadcf&hm=92c7a30e584586d3ed549f95936b6cbb14ea14086c2cf6dd7d96d627f3cb7ec4&
First submission 2024-10-14 16:43:01
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1478.5 KB (1513984 bytes) |
| Compile time: | 2024-08-19 18:29:09 |
| MD5: | 2a4d4da0839146e500af4fe56a7d39ea |
| SHA1: | 897ffd113087d9db0bb4c297474a3e153b7fc09c |
| SHA256: | 00d78b6ff237c0df3e436b73e927ad9d70dafb73e8ba4950868d9fbf920478b3 |
| Import Hash : | 9ad2d236071201eb51095d038bd1b898 |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 36/76 VT report date: 2024-10-13 19:51:03 |
| Malware Type 1 | trojan |
| Threat Type 1 | barys |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1293400136088682506/1294352884535787520/Loader.exe?ex=670dff4f&is=670cadcf&hm=92c7a30e584586d3ed549f95936b6cbb14ea14086c2cf6dd7d96d627f3cb7ec4&  |
cdn.discordapp.com |
2024-10-14 16:43:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5bbf7 | 375808 | 8a8c27d8177110f81ce2b545738bc49b4b02a43b | 64c0453ff0866852edea153be4efd2b6 | |
| .rdata | 0x5d000 | 0xf7504 | 1013248 | e96f5d128458cece16365f1ce9e83ec8730447f8 | cdd2d4cd00beefb7ba47549fb8b07f25 | |
| .data | 0x155000 | 0x19648 | 101888 | 14e916dbe69095cb1e424e23081836d3d6f5a72a | 3cbd5e2b08ad9e390e8f7a7e8fbdfb12 | |
| .pdata | 0x16f000 | 0x3f9c | 16384 | 82366c179a56fdecec40debff2ebcf1977f5c483 | 9b2458b3f7cca4ad616de2c5f33a54e4 | |
| .rsrc | 0x173000 | 0x1338 | 5120 | 8df958ffff14b717e9e30db9bec736360681d3ff | 6a0199a061da538ff352df0ab971aff0 | |
| .reloc | 0x175000 | 0x190 | 512 | b5298982f86ba760dd382f2e3b9268176ee228cc | 032ee69ead74c30a95a4fb7f930d5c6b |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1730f0 | 4264 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x174198 | 20 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1741b0 | 392 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 12
| CheckRemoteDebuggerPresent |
| DebugActiveProcess |
| FindWindowW |
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| Process32FirstW |
| Process32NextW |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Text |
| imgui_log.txt |
| Library |
| ntdll.dll |
| api-ms-win-core-synch-l1-2-0.dll |
| KERNEL32.dll |
| d3d9.dll |
| api-ms-win-crt-utility-l1-1-0.dll |
| ADVAPI32.dll |
| Shcore.dll |
| api-ms-win-crt-convert-l1-1-0.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| xinput1_3.dll |
| xinput1_4.dll |
| SHELL32.dll |
| msvcp140.dll |
| GDI32.dll |
| xinput1_2.dll |
| VCRUNTIME140_1.dll |
| api-ms-win-crt-filesystem-l1-1-0.dll |
| api-ms-win-crt-locale-l1-1-0.dll |
| WININET.dll |
| xinput9_1_0.dll |
| USER32.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| xinput1_1.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| api-ms-win-crt-stdio-l1-1-0.dll |
| vcruntime140.dll |
| IMM32.dll |
| api-ms-win-crt-math-l1-1-0.dll |
Strings analysis - Possible IPs found 10
| 85.5.5.5 |
| 6.6.6.8 |
| 6.6.6.6 |
| 5.5.5.3 |
| 5.5.5.5 |
| 1.1.1.2 |
| 7.7.7.8 |
| 8.8.8.8 |
| 7.8.8.8 |
| 7.7.7.7 |
Strings analysis - Possible URLs found 17
| https://maticsk |
| http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0 |
| http://www.microsoft.com/pkiops/docs/primarycps.htm0@ |
| http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0 |
| https://scripts.sil.org/OFLhttps://scripts.sil.org/OFLLexendMedium |
| http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0 |
| http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0 |
| https://www.lexend.comhttps://www.lexend.comThis |
| http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T |
| http://cmbin22.Rhttp://rmbin22.creen.microsoft.+++++++w++//////< |
| http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X |
| http://www.microsoft.com/typographyMicrosoft |
| http://en.wikipedia.org/wiki/MIT_License), |
| http://www.microsoft.com/typography |
| https://github.com/ThomasJockin/lexend)Lexend |
| http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0 |
| http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a |
Import functions
api-ms-win-crt-filesystem-l1-1-0.dll 3
api-ms-win-crt-utility-l1-1-0.dll 1
api-ms-win-crt-runtime-l1-1-0.dll 20
api-ms-win-crt-locale-l1-1-0.dll 2
MSVCP140.dll 70
WININET.dll 6
GDI32.dll 1
api-ms-win-crt-string-l1-1-0.dll 4
VCRUNTIME140_1.dll 1
SHELL32.dll 1
KERNEL32.dll 75
api-ms-win-crt-math-l1-1-0.dll 7
api-ms-win-crt-convert-l1-1-0.dll 2
VCRUNTIME140.dll 13
ADVAPI32.dll 10
api-ms-win-crt-stdio-l1-1-0.dll 27
d3d9.dll 1
api-ms-win-crt-heap-l1-1-0.dll 4
USER32.dll 53
IMM32.dll 3