Static task
static1
Behavioral task
behavioral1
Sample
LPO43293627/LPO43293627.iso
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
LPO43293627/LPO43293627.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
LPO43293.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
LPO43293.exe
Resource
win10v2004-20220812-en
General
-
Target
LPO43293627.zip
-
Size
435KB
-
MD5
8ff7d8091f1d6697749f705f8c5be715
-
SHA1
0a8705820b4c768f4cb0b25e7e6be233c561b645
-
SHA256
35ebabe1513ee4ce5728123f0888f7b80f0d5cc6e8212bbf0ad01fa3e04552e6
-
SHA512
a69c9c17d8d6ddd9c64f83e7255776b1ed13532ad3a767329c3f10160977c269a1584bf2c1e7854477a687bbe2588b73e3c62a75cf8cfc0203ac36208442d0b0
-
SSDEEP
12288:EV+jzQ+epuVYpHFBteF9G+K+nGNyHDY0GoV4r:pAjkUFaEIGA8oi
Malware Config
Signatures
Files
-
LPO43293627.zip.zip
Password: PQbhu8bgt5!@3
-
LPO43293627/LPO43293627.IMG.iso
Password: PQbhu8bgt5!@3
-
LPO43293.EXE.exe windows x86
Password: PQbhu8bgt5!@3
a1833be3302884c18ce5a107d4d1965b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapSetInformation
HeapSize
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetPerformanceInfo
K32GetProcessMemoryInfo
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlUnwind
HeapReAlloc
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
VirtualProtect
VirtualAlloc
Sleep
GetConsoleWindow
CreateFileW
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
GetStringTypeW
GetFileType
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapDestroy
HeapCreate
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentStringsW
GetDriveTypeW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
EncodePointer
SearchPathW
DuplicateHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetCPInfo
GetOEMCP
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
OutputDebugStringA
OutputDebugStringW
CloseHandle
WaitForSingleObjectEx
RaiseException
user32
GetThreadDesktop
IsWindow
PostMessageW
GetProcessWindowStation
GetMessageW
GetWindowThreadProcessId
GetUserObjectInformationW
IsWindowVisible
ShowWindow
MessageBoxA
UnregisterClassW
TranslateMessage
SetProcessWindowStation
SetProcessDPIAware
SendMessageTimeoutW
RegisterClassW
advapi32
EventRegister
EqualSid
DuplicateTokenEx
DuplicateToken
CreateWellKnownSid
CreateRestrictedToken
CreateProcessAsUserW
CopySid
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
AccessCheck
EventUnregister
shell32
SHGetKnownFolderPath
SHGetFolderPathW
ole32
StgCreateDocfile
CoUninitialize
CoInitialize
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 233KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 423KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ