lzma[.]exe | Triage

General

Target

lzma.exe
Size

129KB
MD5

a0ba956adad2bb99de180306907cf821
SHA1

043dc349b8ed417a5973df617a7c53ab9cbf0d6b
SHA256

a369bab8ba0aa46a831cb3c0b953210ebf312b55d1500e3c831b03de92f89c1f
SHA512

f506b1d8f16d25dca68be15cc54bcd104f45cfdbfd68b9d558f0b848914160b95b94fa98d48319dabf88eeab9fcfe147e3c520d5d5939dc24aa5dcc93d99cd60
SSDEEP

3072:X4FYpq54HwaqmqY1opq/9qzLZeUkchhQEJZr32Cy1XXUUFlHB:ooHtNvOdLZeUkI+EJZWXUu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lzma.exe

Files

lzma.exe
.exe windows:4 windows x86

27170b9833d1fcf4e9cac2e93ed0a68d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
VirtualAlloc
CreateFileA
GetLastError
CloseHandle
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
MultiByteToWideChar
WideCharToMultiByte
CompareStringA
CompareStringW
GetStdHandle
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
SetHandleCount
GetFileType
RtlUnwind
RaiseException
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
VirtualFree
SetUnhandledExceptionFilter
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

27170b9833d1fcf4e9cac2e93ed0a68d

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 13KB - Virtual size: 22KB

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 13KB - Virtual size: 22KB