LMkRstPt[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LMkRstPt.exe
Size

131KB
MD5

6cef69023a10ae2b262ceb2dc3801b01
SHA1

1c229659c6d7f9c715cb2695d1a550e3d1c19c06
SHA256

f80e71ce3d6c9384ea414fbcc1520481b830bffc36c307fcdc9388fdf75ab9db
SHA512

864134fd5d5ba26d04b7ee6b7eda1efb75dccdbde1c29cf92e542b2961e4e30cfe26bc8ccb794c22bbec89b033b587e7a27bb9fdba5eb8554da41086a10338dd
SSDEEP

3072:q40MyCP5nyp7pui01bnNtg7qOUIip6xcuDXBqzXrT:qInyp5CgpauDRqzbT

Score

1^/10

Malware Config

Signatures

Files

LMkRstPt.exe
.exe windows x86

953a4e3144c77e7fabe168bd59c03d54

Code Sign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/06/2020, 00:00

Not After

22/07/2022, 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:c1:c1:73:2f:a2:96:d0:6c:a7:1b:e7:1d:08:bd:80:45:d7:a5:95
Signer

Actual PE Digest

0f:c1:c1:73:2f:a2:96:d0:6c:a7:1b:e7:1d:08:bd:80:45:d7:a5:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
SetFilePointerEx
CloseHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
WriteConsoleW
CopyFileW
FreeLibrary
GetModuleHandleW
CreateProcessW
LocalFree
GetProcAddress
LoadLibraryW
GetVersionExW
GetTempPathW
GetModuleFileNameW
GetStartupInfoW
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
DecodePointer

user32

PostQuitMessage
TranslateMessage
GetMessageW
DefWindowProcW
CreateWindowExW
ShowWindow
DispatchMessageW
SetTimer
RegisterClassW

advapi32

SetSecurityDescriptorDacl
RegCloseKey
SetSecurityDescriptorOwner
SetEntriesInAclW
CreateWellKnownSid
RegCreateKeyExW
RegSetValueExW
InitializeSecurityDescriptor
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetSecurityDescriptorGroup

ole32

CoInitializeEx
CoInitializeSecurity

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

953a4e3144c77e7fabe168bd59c03d54

Code Sign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

0f:c1:c1:73:2f:a2:96:d0:6c:a7:1b:e7:1d:08:bd:80:45:d7:a5:95Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 48KB - Virtual size: 48KB

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

0f:c1:c1:73:2f:a2:96:d0:6c:a7:1b:e7:1d:08:bd:80:45:d7:a5:95
Signer

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 48KB - Virtual size: 48KB