CommandLine[.]lmd | Triage

Sharing

General

Target

CommandLine.lmd
Size

72KB
MD5

ab57340a802d6f8bab2492ffdbfbba4e
SHA1

3b4b52aed9240206b5e44956adfe645400382d69
SHA256

1eee1aa6ad7e49abbaacb4c2ce1cb2bee91d05ffbe3b00094b09fbf7e8ea22f6
SHA512

76b5560503c99cb65d44a7fd8e21af46db37b509a57921cb5421df5f0359305cf5fae72e609075c4ab35fa0150ed90ffc67276aac87c68765ef990d80dc91ceb
SSDEEP

1536:gZ4cTSttWStnmwuBtUVeMsJ7kv00mCsvPIOPp:kstm3zJ4tPQx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CommandLine.lmd

Files

CommandLine.lmd
.dll windows:4 windows x86 arch:x86

c034b3b77e1426d781dcd4e605a998ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

lua5.1

lua_remove

user32

GetForegroundWindow

gdi32

Escape

winspool.drv

OpenPrinterA

advapi32

RegQueryValueA

shell32

ShellExecuteA

comctl32

ord17

shlwapi

PathFindExtensionA

oleaut32

VariantInit

Exports

Exports

irPlg_Action_RegisterActions
irPlg_GetAuthorInfo
irPlg_GetLuaVersion
irPlg_GetPluginActionXML
irPlg_GetPluginName
irPlg_GetPluginVersion
irPlg_GetSDKVersion
irPlg_ShowHelpForAction
irPlg_ShowHelpForPlugin
irPlg_ValidateLicense

Sections

.text
Size: 63KB - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE