General

Malware Config

Signatures

Files

• lightshot.zip

  .zip
• Lightshot.dll

  .dll windows:5 windows x86 arch:x86

  c0c501cf3297e1f198923d5f84a50189

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  oleaut32

  SysFreeString

  SysReAllocStringLen

  SysAllocStringLen

  SafeArrayPtrOfIndex

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayCreate

  VariantChangeType

  VariantCopy

  VariantClear

  VariantInit

  advapi32

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  user32

  CharNextW

  LoadStringW

  PeekMessageW

  MsgWaitForMultipleObjects

  MessageBoxW

  LoadStringW

  GetSystemMetrics

  CharUpperBuffW

  CharUpperW

  CharLowerBuffW

  kernel32

  Sleep

  VirtualFree

  VirtualAlloc

  lstrlenW

  VirtualQuery

  QueryPerformanceCounter

  GetTickCount

  GetSystemInfo

  GetVersion

  CompareStringW

  IsValidLocale

  SetThreadLocale

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  GetLocaleInfoW

  WideCharToMultiByte

  MultiByteToWideChar

  GetACP

  LoadLibraryExW

  GetStartupInfoW

  GetProcAddress

  GetModuleHandleW

  GetModuleFileNameW

  GetCommandLineW

  FreeLibrary

  GetLastError

  UnhandledExceptionFilter

  RtlUnwind

  RaiseException

  ExitProcess

  ExitThread

  SwitchToThread

  GetCurrentThreadId

  CreateThread

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  FindFirstFileW

  FindClose

  WriteFile

  GetStdHandle

  CloseHandle

  GetProcAddress

  RaiseException

  LoadLibraryA

  GetLastError

  TlsSetValue

  TlsGetValue

  TlsFree

  TlsAlloc

  LocalFree

  LocalAlloc

  FreeLibrary

  WriteFile

  WideCharToMultiByte

  WaitForSingleObject

  VirtualQueryEx

  VirtualQuery

  VirtualProtect

  VirtualFree

  VerSetConditionMask

  VerifyVersionInfoW

  SwitchToThread

  SuspendThread

  Sleep

  SizeofResource

  SetThreadPriority

  SetLastError

  SetFilePointer

  SetEvent

  SetEndOfFile

  ResumeThread

  ResetEvent

  ReadFile

  RaiseException

  IsDebuggerPresent

  LockResource

  LocalFree

  LoadResource

  IsValidLocale

  HeapSize

  HeapFree

  HeapDestroy

  HeapCreate

  HeapAlloc

  GetVersionExW

  GetTickCount

  GetThreadPriority

  GetThreadLocale

  GetStdHandle

  GetProcAddress

  GetModuleHandleW

  GetModuleFileNameW

  GetLogicalDrives

  GetLocaleInfoW

  GetLocalTime

  GetLastError

  GetFullPathNameW

  GetFileAttributesW

  GetExitCodeThread

  GetDiskFreeSpaceW

  GetDateFormatW

  GetCurrentThreadId

  GetCurrentThread

  GetCurrentProcess

  GetCPInfoExW

  GetCPInfo

  GetACP

  FreeResource

  FreeLibrary

  FormatMessageW

  FindResourceW

  FindFirstFileW

  FindClose

  ExitProcess

  EnumSystemLocalesW

  EnumCalendarInfoW

  CreateProcessA

  CreateFileW

  CreateEventW

  CreateDirectoryW

  CompareStringW

  CloseHandle

  Sleep

  version

  VerQueryValueW

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  netapi32

  NetWkstaGetInfo

  Exports

  Exports

  DebugConnectWide

  DebugCreate

  KSFFInit

  KSFFUninit

  KSInit

  KSOptions

  KSPromptForKey

  KSSetKeyInfo

  KSSetOption

  KSUninit

  KSUpdate

  TMethodImplementationIntercept

  UnityMain

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 839KB - Virtual size: 839KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 23KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 512B - Virtual size: 490B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 408B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 69B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 80KB - Virtual size: 80KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Lightshot.exe

  .exe windows:5 windows x86 arch:x86

  2f0381ca527366dde0bbef4148ecb54a

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07

  Certificate

  Issuer

  CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Not Before

  03-05-2011 07:00

  Not After

  03-05-2031 07:00

  Subject

  CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  c9:34:23:ce:0c:60:66:67

  Certificate

  Issuer

  CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Not Before

  30-05-2019 00:39

  Not After

  30-05-2022 00:39

  Subject

  CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c

  Signer

  Actual PE Digest

  c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  kernel32

  FreeLibrary

  FindFirstFileW

  SetLastError

  FindNextFileW

  GetCurrentProcess

  GetModuleFileNameW

  FindClose

  MultiByteToWideChar

  GetTickCount

  CompareStringW

  lstrlenW

  GetVersionExW

  GetLocalTime

  lstrcmpiW

  MulDiv

  InterlockedDecrement

  InterlockedIncrement

  LoadLibraryExW

  GetComputerNameW

  LCMapStringW

  GetStringTypeW

  GetFileType

  GetACP

  GetStdHandle

  GetModuleHandleExW

  ExitProcess

  QueryPerformanceFrequency

  LoadLibraryW

  RtlUnwind

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  LoadLibraryExA

  VirtualFree

  VirtualAlloc

  FlushInstructionCache

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  EncodePointer

  OutputDebugStringW

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  GetStartupInfoW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  WaitForSingleObjectEx

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GlobalFree

  ResetEvent

  SetEvent

  CreateEventW

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetStdHandle

  GetConsoleCP

  LeaveCriticalSection

  EnterCriticalSection

  WideCharToMultiByte

  GetModuleHandleW

  GetFileSize

  GetProcAddress

  FindResourceW

  LoadResource

  FindResourceExW

  LockResource

  ReleaseMutex

  GetCurrentThreadId

  CreateFileW

  CreateMutexW

  WriteFile

  SizeofResource

  ReadFile

  GetProcessHeap

  DeleteCriticalSection

  HeapDestroy

  DecodePointer

  HeapAlloc

  CreateThread

  RaiseException

  CloseHandle

  HeapReAlloc

  TerminateThread

  GetLastError

  HeapSize

  WaitForSingleObject

  InitializeCriticalSectionAndSpinCount

  HeapFree

  GetConsoleMode

  SetFilePointerEx

  FlushFileBuffers

  WriteConsoleW

  user32

  PostQuitMessage

  DialogBoxParamW

  SetTimer

  MoveWindow

  PostMessageW

  RegisterWindowMessageW

  GetMessageW

  DispatchMessageW

  TranslateMessage

  KillTimer

  MapVirtualKeyW

  RemoveMenu

  LoadIconW

  DestroyMenu

  GetKeyNameTextW

  EnableWindow

  GetAsyncKeyState

  GetWindowLongW

  GetWindowTextLengthW

  DefWindowProcW

  CallWindowProcW

  GetWindow

  GetWindowRect

  RegisterHotKey

  DestroyIcon

  GetActiveWindow

  GetSubMenu

  TrackPopupMenu

  MonitorFromPoint

  LoadMenuW

  UnregisterHotKey

  GetClassInfoExW

  RegisterWindowMessageA

  RegisterClassExW

  MessageBoxW

  GetFocus

  DestroyWindow

  GetDC

  SetWindowPos

  MonitorFromWindow

  FillRect

  CreateWindowExW

  ScreenToClient

  EndDialog

  SetWindowTextW

  IsWindow

  OffsetRect

  GetCapture

  GetMonitorInfoW

  GetDlgCtrlID

  MapWindowPoints

  DrawFocusRect

  GetSysColor

  IsWindowEnabled

  SetFocus

  CharNextW

  LoadCursorW

  GetClassNameW

  SetCapture

  SetCursor

  SetRectEmpty

  SetWindowLongW

  GetClientRect

  GetDlgItem

  DrawTextW

  SystemParametersInfoW

  GetParent

  PtInRect

  UpdateWindow

  ReleaseCapture

  InvalidateRect

  GetCursorPos

  BeginPaint

  EndPaint

  GetWindowTextW

  InsertMenuItemW

  SetMenuItemInfoW

  TrackMouseEvent

  ReleaseDC

  GetSystemMetrics

  GetWindowDC

  SendMessageW

  UnregisterClassW

  SetForegroundWindow

  gdi32

  SelectObject

  CreateFontW

  GetDeviceCaps

  DeleteObject

  GetObjectW

  CreateFontIndirectW

  CreateSolidBrush

  SetBkColor

  SetBkMode

  GetStockObject

  SetTextColor

  advapi32

  RegQueryValueExW

  RegCreateKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegDeleteKeyW

  RegEnumKeyExW

  CryptDestroyKey

  CryptEncrypt

  CryptDecrypt

  CryptSetKeyParam

  CryptImportKey

  CryptReleaseContext

  CryptGetHashParam

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptAcquireContextW

  RegDeleteValueW

  RegEnumValueW

  RegCloseKey

  shell32

  ShellExecuteW

  Shell_NotifyIconW

  ole32

  CoTaskMemRealloc

  CoTaskMemFree

  CoUninitialize

  CoTaskMemAlloc

  CoInitialize

  StringFromGUID2

  CoCreateGuid

  CoCreateInstance

  oleaut32

  VarUI4FromStr

  SysFreeString

  SysAllocString

  shlwapi

  PathFileExistsW

  PathCanonicalizeW

  PathAppendW

  PathRemoveFileSpecW

  PathAddBackslashW

  PathIsDirectoryW

  comctl32

  DestroyPropertySheetPage

  PropertySheetW

  CreatePropertySheetPageW

  wininet

  InternetQueryOptionW

  Sections

  .text

  Size: 226KB - Virtual size: 225KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 62KB - Virtual size: 61KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 308B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 172KB - Virtual size: 171KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• lightshot.hta

  .html