l[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

l.exe
Size

9.0MB
MD5

dd0a49828e226315f1591cc14b32ebc0
SHA1

147bb8f37c79b86bc562cbd731820cedc41733d1
SHA256

91098c1e6e4da456406c1cfd8de75e6d986a21a7ebda98120087fa1b19511e5a
SHA512

17567a262a57348b427324a2028e5aca6d3942a4a82a458351325b4ba40146c4347afd70dc40e7341fc5b4745c2f5a2a5dedb92af6c2e82710bb43c9726a8487
SSDEEP

196608:MASreCO9GtW1MnxyWiYMdBMU4cGqatjAggT8LDAJU:MAUrBfnx7i7MU4c8VEJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
l.exe

Files

l.exe
.exe windows:6 windows x64

5e78bb9165bd45309e607cc207fef9fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersion

user32

GetWindowTextA

gdi32

GetObjectA

advapi32

GetTokenInformation

ole32

CoInitialize

msvcp140

?_Xinvalid_argument@std@@YAXPEBD@Z

dwrite

DWriteCreateFactory

dwmapi

DwmExtendFrameIntoClientArea

d2d1

ord1

vcruntime140

__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-math-l1-1-0

_dsign

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

Sections

.text
Size: - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.H+<
Size: - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.+|4
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cD!
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e78bb9165bd45309e607cc207fef9fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

msvcp140

dwrite

dwmapi

d2d1

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

Sections

.text Size: - Virtual size: 460KB

.rdata Size: - Virtual size: 56KB

.data Size: - Virtual size: 6KB

.pdata Size: - Virtual size: 30KB

.H+< Size: - Virtual size: 6.3MB

.+|4 Size: 512B - Virtual size: 408B

.cD! Size: 9.0MB - Virtual size: 9.0MB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 460KB

.rdata
Size: - Virtual size: 56KB

.data
Size: - Virtual size: 6KB

.pdata
Size: - Virtual size: 30KB

.H+<
Size: - Virtual size: 6.3MB

.+|4
Size: 512B - Virtual size: 408B

.cD!
Size: 9.0MB - Virtual size: 9.0MB

.rsrc
Size: 512B - Virtual size: 469B