The_app[.]rar | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

The_app.rar
Size

17.3MB
MD5

b97f45698df4a7d71c7eda45d6c26d79
SHA1

7c5fe95f82a6448012d9b8df9d9d8eb1fd57963b
SHA256

1566b9d322578f6f367ec174c6c137c0ac3fb99d7c1f412b9d850d4a82baf62a
SHA512

d17d88f96bae4cda4ad79e0aa1c456af9e132e5c5edb2cdd4e2f13e9734aabfc0db4152bc66e681e360d8c42e8bbd9ceb5b02fc04a5beeb234606c2caa52cdb1
SSDEEP

393216:UxeyFItx/dIcVK3EsSNH47OBH6TTpQVhGRkVl69LtUDiPRxpJ:UxeweEEsIB1VhGaVktUupxf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/LOL/START THE HEELLLLLL.exe

Files

The_app.rar
.rar
LOL/SOME APP FILES (DONT DELETE)/Plugins/vt_AMS-Gray.png
.png
LOL/SOME APP FILES (DONT DELETE)/dat01/ap1.dat
LOL/SOME APP FILES (DONT DELETE)/dat01/ap2.dat
LOL/SOME APP FILES (DONT DELETE)/dat01/ap3.dat
.zip
_manifest.xml
.xml
luna-blank-disabled.png
.png
luna-blank-down.png
.png
luna-blank-hover.png
.png
luna-blank-normal.png
.png
LOL/SOME APP FILES (DONT DELETE)/dat01/ap4.dat
.zip
2_1041_disabled.png
.png
2_1041_down.png
.png
2_1041_normal.png
.png
2_1041_over.png
.png
_manifest.xml
LOL/SOME APP FILES (DONT DELETE)/dat01/ap5.dat
.zip
3_1043_disabled.png
.png
3_1043_down.png
.png
3_1043_normal.png
.png
3_1043_over.png
.png
_manifest.xml
LOL/SOME APP FILES (DONT DELETE)/dat01/ap6.dat
.jpg
LOL/SOME APP FILES (DONT DELETE)/dat01/ap7.dat
LOL/START THE HEELLLLLL.cdd
.zip
LOL/START THE HEELLLLLL.exe
.exe windows:5 windows x86 arch:x86

c121cabc15a5a16cb26463cec5174545

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

lua5.1

lua_pushfstring
lua_getinfo
lua_getstack
lua_pushlstring
lua_gettop
lua_tointeger
lua_isnumber
lua_concat
lua_isstring
lua_tothread
lua_type
luaL_newstate
lua_close
lua_sethook
lua_settop
luaL_openlibs
luaL_loadbuffer
lua_pushcclosure
lua_insert
lua_pcall
lua_remove
lua_pushstring
lua_setfield
lua_pushnumber
lua_pushboolean
lua_pushnil
lua_getfield
lua_tonumber
lua_toboolean
lua_createtable
lua_settable
lua_gettable
lua_error
lua_next
luaL_openlib
lua_pushvalue
lua_tolstring

winmm

mixerOpen
mixerSetControlDetails
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
waveInReset
waveInClose
waveInOpen
waveInStart
waveInGetNumDevs
waveInGetDevCapsA
waveInUnprepareHeader
mixerGetNumDevs
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetNumDevs
waveOutGetDevCapsA
mciGetErrorStringA
mciSendCommandA
timeGetTime
mixerClose
waveInPrepareHeader
PlaySoundA
timeGetDevCaps
sndPlaySoundA
timeBeginPeriod
timeSetEvent
timeKillEvent
timeEndPeriod

wsock32

socket
WSAAsyncGetHostByName
inet_addr
WSACancelAsyncRequest
connect
ioctlsocket
htons
WSACleanup
WSAStartup
select
WSAGetLastError
__WSAFDIsSet
inet_ntoa
send
closesocket
recv

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

msacm32

acmStreamOpen
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
acmStreamSize
acmStreamPrepareHeader
acmFormatSuggest

kernel32

LocalFileTimeToFileTime
DosDateTimeToFileTime
SetVolumeLabelA
GetLocalTime
FlushFileBuffers
MoveFileA
VirtualUnlock
FreeResource
VirtualFree
VirtualAlloc
GetModuleFileNameW
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetThreadLocale
ResumeThread
LocalReAlloc
EnumResourceLanguagesA
ConvertDefaultLocale
GetFileTime
GetStringTypeExA
LockFile
UnlockFile
DuplicateHandle
GetFileAttributesExA
GetFileSizeEx
GetProfileIntA
GlobalFlags
GetCPInfo
GetOEMCP
GetModuleHandleW
LoadLibraryW
GetSystemDirectoryW
SearchPathA
FindResourceExA
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
ExitProcess
GetTimeFormatA
GetDateFormatA
VirtualQuery
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
ExitThread
SetStdHandle
GetFileType
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
GetStdHandle
CompareStringW
SetEnvironmentVariableW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
SetHandleCount
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
LocalLock
LocalUnlock
IsDBCSLeadByte
lstrcmpA
TlsGetValue
IsBadReadPtr
TlsFree
TlsSetValue
GlobalHandle
TlsAlloc
GetProcessAffinityMask
VirtualProtect
VirtualLock
OpenFile
InterlockedDecrement
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
GetCurrentThreadId
GetSystemDefaultLangID
DeviceIoControl
SetErrorMode
IsBadStringPtrA
WriteFile
SetEndOfFile
GetFileSize
GetSystemInfo
GlobalMemoryStatus
GetDriveTypeA
GetComputerNameA
ExpandEnvironmentStringsA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetCurrentProcessId
GetLocaleInfoA
GlobalSize
TerminateThread
CreateThread
WaitForSingleObject
CreateEventA
SetEvent
GetExitCodeThread
GetThreadPriority
SetThreadPriority
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
GetCurrentProcess
GetTickCount
LoadLibraryExA
TerminateProcess
OpenProcess
GetTempPathA
LocalFree
FormatMessageA
GetWindowsDirectoryA
GetShortPathNameA
MoveFileExA
CopyFileA
GetPrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
lstrcpyA
MulDiv
GetTempFileNameA
GetExitCodeProcess
CreateProcessA
GetDiskFreeSpaceA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
SetFileTime
SystemTimeToFileTime
SetCurrentDirectoryA
GetCurrentDirectoryA
FindNextFileA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetVolumeInformationA
GetFullPathNameA
FindClose
FindFirstFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrlenA
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
SetFileAttributesA
lstrcpynA
Sleep
GetEnvironmentVariableA
SetEnvironmentVariableA
GetSystemDirectoryA
FreeLibrary
lstrlenW
InterlockedIncrement
GetFileAttributesA
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
SetLastError
CompareStringA
GetVersionExA
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
FileTimeToDosDateTime
lstrcmpiA
GetLogicalDriveStringsA
LocalAlloc
EnumResourceNamesA
LoadLibraryExW
LocalSize
EnumResourceTypesA
IsBadWritePtr
lstrcatA

user32

DefMDIChildProcA
TranslateMDISysAccel
PostThreadMessageA
SubtractRect
GetTabbedTextExtentA
DestroyCursor
DrawIcon
GetDCEx
IsCharLowerA
MapVirtualKeyExA
SetWindowContextHelpId
MapDialogRect
IsMenu
IsZoomed
GetSysColorBrush
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsA
InsertMenuItemA
BringWindowToTop
TranslateAcceleratorA
DestroyAcceleratorTable
NotifyWinEvent
GetMessageA
ValidateRect
DestroyMenu
MapVirtualKeyA
GetKeyNameTextA
EndPaint
BeginPaint
GetMenuStringA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
CheckMenuItem
WinHelpA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
ScrollWindow
TrackPopupMenuEx
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetClassInfoExA
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetMenu
IsIconic
GetWindowPlacement
GetWindowTextLengthA
GetDlgCtrlID
IsDialogMessageA
SendDlgItemMessageA
CheckRadioButton
CheckDlgButton
UnhookWindowsHookEx
CreateDialogIndirectParamA
GetDlgItem
IsWindowEnabled
CharToOemA
OemToCharBuffA
CharLowerA
WaitForInputIdle
SetDlgItemTextA
SetWindowTextA
EndDialog
DialogBoxParamA
GetActiveWindow
OemToCharA
CharNextA
CharPrevA
CharUpperBuffA
CharLowerBuffA
UnregisterClassA
ExitWindowsEx
RemoveMenu
DrawMenuBar
CreateWindowExA
RegisterClassA
DestroyWindow
GetAsyncKeyState
GetNextDlgTabItem
WindowFromPoint
GetDoubleClickTime
ClipCursor
InvertRect
IsClipboardFormatAvailable
GetClassInfoA
DrawEdge
FrameRect
FillRect
TrackMouseEvent
InsertMenuA
EnableScrollBar
MapWindowPoints
DrawFrameControl
CreatePopupMenu
GetMenuItemCount
DefFrameProcA
GetWindowRgn
EqualRect
GetForegroundWindow
GetWindowThreadProcessId
GetWindowTextA
GetWindow
EnumWindows
SetActiveWindow
DrawAnimatedRects
SetParent
EnumChildWindows
FindWindowA
GetClassNameA
GetMenuItemID
TrackPopupMenu
SetMenuDefaultItem
GetSubMenu
SendMessageTimeoutA
MsgWaitForMultipleObjects
wsprintfA
DrawIconEx
LoadBitmapA
CharUpperA
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
MessageBeep
IsChild
RegisterWindowMessageA
ShowWindow
MoveWindow
UnionRect
SetWindowRgn
TranslateMessage
LoadCursorA
SetCursor
SetRectEmpty
DefWindowProcA
UpdateWindow
InvalidateRgn
IntersectRect
SetCapture
GetCapture
SetFocus
GetFocus
SetWindowPos
CallWindowProcA
GetWindowDC
EnableMenuItem
DeleteMenu
GetSystemMenu
PostQuitMessage
RegisterClassExA
GetMenuState
MessageBoxA
GetMessagePos
DestroyIcon
DrawFocusRect
SetRect
DrawStateA
InflateRect
GetIconInfo
GetMenuItemInfoA
CopyRect
GetSystemMetrics
AppendMenuA
SystemParametersInfoA
DispatchMessageA
PeekMessageA
CloseWindow
GetParent
PostMessageA
ReleaseCapture
GetKeyState
PtInRect
ScreenToClient
GetCursorPos
RedrawWindow
GetSysColor
InvalidateRect
IsWindowVisible
IsWindow
OffsetRect
LoadIconA
SendMessageA
SetTimer
KillTimer
EnableWindow
ReleaseDC
UpdateLayeredWindow
ClientToScreen
GetDesktopWindow
IsRectEmpty
GetClientRect
GetDC
GetWindowRect
LoadImageA
SetForegroundWindow
SetWindowLongA
GetWindowLongA
SetWindowLongW
GetWindowLongW
IsWindowUnicode
CreateIconIndirect
CreateIconFromResourceEx
CallWindowProcW
DefWindowProcW
DefFrameProcW
DefDlgProcA
CreateAcceleratorTableA
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyIcon
SetCursorPos
GetMenuDefaultItem
EmptyClipboard
CloseClipboard
SetClipboardData
CopyImage
OpenClipboard
WaitMessage
DefDlgProcW
DefMDIChildProcW
RegisterClassW
LookupIconIdFromDirectoryEx
GetMenuStringW
HideCaret
ShowCaret
GetCursor
ShowOwnedPopups
SetClassLongA
LockWindowUpdate
GetUpdateRect
GetNextDlgGroupItem
RegisterClipboardFormatA
CreateMenu
CopyAcceleratorTableA
GetKeyboardLayoutList
LoadMenuA

gdi32

AddFontResourceA
RemoveFontResourceA
CreateHalftonePalette
CreateFontIndirectA
GetTextColor
Polygon
SelectPalette
RealizePalette
GetWindowOrgEx
GetWindowExtEx
IntersectClipRect
CreateRectRgnIndirect
CombineRgn
LPtoDP
GetMapMode
GetViewportExtEx
DPtoLP
GetDeviceCaps
CreateRectRgn
BitBlt
ExtCreateRegion
CreateRoundRectRgn
GetBkColor
GetPaletteEntries
GdiFlush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateFontA
EnumFontFamiliesExA
CreateScalableFontResourceA
CreatePalette
CreateBitmap
PatBlt
CreatePatternBrush
SetMapMode
ExcludeClipRect
LineTo
MoveToEx
SetTextAlign
AbortDoc
GetPixel
SetViewportExtEx
ScaleViewportExtEx
Rectangle
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
PolyBezierTo
ExtSelectClipRgn
GetObjectType
CreateHatchBrush
GetStockObject
CreateEllipticRgn
CreatePolygonRgn
Polyline
Ellipse
GetRgnBox
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetCharWidthA
StretchDIBits
OffsetRgn
SetDIBColorTable
GetDIBits
StartPage
SetPixel
RoundRect
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
ExtFloodFill
SetPaletteEntries
GetTextAlign
GetTextFaceA
GetNearestPaletteIndex
GetSystemPaletteEntries
DeleteMetaFile
SetPixelV
StartDocA
GetCurrentObject
SetViewportOrgEx
CreatePen
SetWindowOrgEx
GetTextExtentPoint32A
OffsetViewportOrgEx
SelectClipRgn
GetClipRgn
GetBkMode
GetTextMetricsA
CreateCompatibleBitmap
PtInRegion
EndDoc
SetStretchBltMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
SetTextColor
CreateSolidBrush
StretchBlt
SetBrushOrgEx
GetBitmapBits
GetTextExtentPoint32W
ExtTextOutW
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
BeginPath
SetWinMetaFileBits
DeleteEnhMetaFile
GetEnhMetaFileHeader
GetMetaFileBitsEx
GetMetaFileA
GetEnhMetaFileA
PlayEnhMetaFile
GetClipBox
GetDCOrgEx
SetBkColor
SetBkMode
GetStretchBltMode
SetRectRgn
DeleteDC
SelectObject
CreateDIBSection
EndPage
CreateCompatibleDC
GetObjectA
DeleteObject

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetSaveFileNameA
GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

AdjustTokenPrivileges
RegEnumKeyA
GetUserNameA
UnlockServiceDatabase
OpenSCManagerA
GetServiceDisplayNameA
QueryServiceStatus
ControlService
StartServiceA
DeleteService
CloseServiceHandle
CreateServiceA
OpenServiceA
RegConnectRegistryA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
EnumServicesStatusA
EqualSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegOpenKeyA
LookupAccountSidA
SetNamedSecurityInfoA
SetEntriesInAclA
FreeSid
GetNamedSecurityInfoA
ConvertStringSidToSidA
AllocateAndInitializeSid
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegQueryValueA
RegSetValueA
IsValidSid
LookupAccountNameA
ConvertSidToStringSidA
RegOpenKeyExA
LookupPrivilegeValueA

shell32

ShellExecuteExA
ExtractIconA
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
DragQueryFileA
DragFinish
ExtractIconExA
SHGetFileInfoA
SHAppBarMessage
Shell_NotifyIconA
SHGetSpecialFolderLocation

comctl32

ImageList_GetImageInfo
ImageList_GetBkColor
FlatSB_GetScrollProp
_TrackMouseEvent
ImageList_DrawEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_DrawIndirect

shlwapi

PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA
UrlUnescapeA
PathRemoveFileSpecW

oledlg

ord1
ord8

ole32

CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoInitialize
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoRegisterMessageFilter
CoRevokeClassObject
OleLockRunning
CoUninitialize
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
DoDragDrop
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoInitializeEx
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
VarUdateFromDate
LoadTypeLi
RegisterTypeLi
VariantClear
SysStringLen
SysAllocStringByteLen
SysStringByteLen
OleCreateFontIndirect
SafeArrayDestroy
VariantChangeType
VariantCopy
SysAllocStringLen
VariantInit
SysAllocString
SysFreeString
OleLoadPicturePath

urlmon

URLDownloadToFileA

gdiplus

GdipCloneImage
GdiplusShutdown
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

netapi32

Netbios

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

imagehlp

ImageDirectoryEntryToData

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 854KB - Virtual size: 853KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 145KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LOL/lua5.1.dll
.dll windows:5 windows x86 arch:x86

15d95afb470c5f82193b2d9e98fc96d1

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-01-2016 00:00

Not After

02-06-2019 23:59

Subject

CN=Indigo Rose Software Design Corporation,O=Indigo Rose Software Design Corporation,POSTALCODE=R3B 0R3,STREET=123 Bannatyne Ave,L=Winnipeg,ST=MB,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-01-2016 00:00

Not After

02-06-2019 23:59

Subject

CN=Indigo Rose Software Design Corporation,O=Indigo Rose Software Design Corporation,POSTALCODE=R3B 0R3,STREET=123 Bannatyne Ave,L=Winnipeg,ST=MB,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f0:e8:4e:54:90:bb:de:82:e5:e8:7d:0f:81:18:60:87:bd:32:73:ea:86:7b:38:74:71:85:57:eb:bf:54:e6:58
Signer

Actual PE Digest

f0:e8:4e:54:90:bb:de:82:e5:e8:7d:0f:81:18:60:87:bd:32:73:ea:86:7b:38:74:71:85:57:eb:bf:54:e6:58

Digest Algorithm

sha256

PE Digest Matches

true

bf:7d:e1:e7:00:96:8e:8d:48:1f:91:19:cc:66:c9:bd:bb:6c:90:47
Signer

Actual PE Digest

bf:7d:e1:e7:00:96:8e:8d:48:1f:91:19:cc:66:c9:bd:bb:6c:90:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
FormatMessageA
GetLastError
FreeLibrary
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
GetModuleHandleW
Sleep
ExitProcess
RtlUnwind
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
DeleteFileA
MoveFileA
GetTimeFormatA
GetDateFormatA
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetCommandLineA
GetModuleHandleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
InitializeCriticalSectionAndSpinCount
GetFileAttributesA
CreatePipe
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
CreateFileA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
RaiseException
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
SetStdHandle
HeapSize
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

Exports

Exports

luaD_growstack
luaF_newproto
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
luaM_realloc_
luaM_toobig
luaS_newlstr
luaU_dump
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LOL/lua51.dll
.dll windows:4 windows x86 arch:x86

a1b69e6994ef9135a30507dd76a0652e

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-01-2016 00:00

Not After

02-06-2019 23:59

Subject

CN=Indigo Rose Software Design Corporation,O=Indigo Rose Software Design Corporation,POSTALCODE=R3B 0R3,STREET=123 Bannatyne Ave,L=Winnipeg,ST=MB,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-01-2016 00:00

Not After

02-06-2019 23:59

Subject

CN=Indigo Rose Software Design Corporation,O=Indigo Rose Software Design Corporation,POSTALCODE=R3B 0R3,STREET=123 Bannatyne Ave,L=Winnipeg,ST=MB,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cf:02:28:b4:6f:88:00:59:50:e0:9c:53:0e:47:1a:7c:1d:8b:bd:23:39:68:9f:5c:ac:9a:e3:d2:b5:d3:e3:dc
Signer

Actual PE Digest

cf:02:28:b4:6f:88:00:59:50:e0:9c:53:0e:47:1a:7c:1d:8b:bd:23:39:68:9f:5c:ac:9a:e3:d2:b5:d3:e3:dc

Digest Algorithm

sha256

PE Digest Matches

true

c0:f1:36:ca:1f:4f:4a:c3:07:78:12:c8:cc:34:a8:cc:93:8d:c4:9e
Signer

Actual PE Digest

c0:f1:36:ca:1f:4f:4a:c3:07:78:12:c8:cc:34:a8:cc:93:8d:c4:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua5.1

luaD_growstack
luaF_newproto
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
luaM_realloc_
luaM_toobig
luaS_newlstr
luaU_dump
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Exports

Exports

luaD_growstack
luaF_newproto
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
luaM_realloc_
luaM_toobig
luaS_newlstr
luaU_dump
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c121cabc15a5a16cb26463cec5174545

Headers

DLL Characteristics

File Characteristics

Imports

lua5.1

winmm

wsock32

version

msacm32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

gdiplus

netapi32

imm32

imagehlp

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 854KB - Virtual size: 853KB

.data Size: 145KB - Virtual size: 474KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

15d95afb470c5f82193b2d9e98fc96d1

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

f0:e8:4e:54:90:bb:de:82:e5:e8:7d:0f:81:18:60:87:bd:32:73:ea:86:7b:38:74:71:85:57:eb:bf:54:e6:58Signer

bf:7d:e1:e7:00:96:8e:8d:48:1f:91:19:cc:66:c9:bd:bb:6c:90:47Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 223KB - Virtual size: 222KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

a1b69e6994ef9135a30507dd76a0652e

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15Certificate

Extended Key Usages

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 854KB - Virtual size: 853KB

.data
Size: 145KB - Virtual size: 474KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

f0:e8:4e:54:90:bb:de:82:e5:e8:7d:0f:81:18:60:87:bd:32:73:ea:86:7b:38:74:71:85:57:eb:bf:54:e6:58
Signer

bf:7d:e1:e7:00:96:8e:8d:48:1f:91:19:cc:66:c9:bd:bb:6c:90:47
Signer

.text
Size: 223KB - Virtual size: 222KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

83:be:82:48:d6:37:ee:d3:5d:ad:4d:bf:af:36:63:15
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

cf:02:28:b4:6f:88:00:59:50:e0:9c:53:0e:47:1a:7c:1d:8b:bd:23:39:68:9f:5c:ac:9a:e3:d2:b5:d3:e3:dc
Signer

c0:f1:36:ca:1f:4f:4a:c3:07:78:12:c8:cc:34:a8:cc:93:8d:c4:9e
Signer

.text
Size: 1024B - Virtual size: 768B

.rdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 296B