General
-
Target
user32.dll
-
Size
420KB
-
MD5
473cf1c7c30d47ee348102d4afb6aeac
-
SHA1
1c926050468a3ad3f35a8a00b83a3554ac92494a
-
SHA256
64e1721597bc8a1394970c32924f36656d996a5269180d6844abc264430a2e2e
-
SHA512
515bd25252798300aa8d34ee2aacaf72c4d8c2456f2197ef138625be13260ddafe771e7a61e477b75e315ec448ab1280721aede43194fbc3603f3daa4a632d1f
-
SSDEEP
6144:/jlpC5T7Np+ez981cRnT7G2UZGTvPAfljF2k91yc5vm5jRIPynzwIiAtHa1mZU74:psNNu40ynz0lmv95
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource user32.dll
Files
-
user32.dll.dll windows:6 windows x86 arch:x86
4ab7b2f9edd95f0c01e66019f75d2f0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFree
VirtualAlloc
VirtualQuery
CreateDirectoryW
ReadFile
GetFileSizeEx
WriteProcessMemory
VirtualProtect
HeapFree
SetLastError
EnterCriticalSection
GetHandleInformation
GetCurrentProcess
WriteFile
GetModuleHandleExW
GetModuleFileNameW
GetProcessId
LeaveCriticalSection
GetEnvironmentVariableW
InitializeCriticalSectionEx
GetEnvironmentVariableA
WaitForSingleObject
CreateFileW
FreeLibraryAndExitThread
HeapSize
CreateEventW
Sleep
GetLastError
K32GetModuleBaseNameW
DeleteFileW
HeapReAlloc
CloseHandle
GetNativeSystemInfo
FreeConsole
CreateThread
HeapAlloc
GetLocalTime
VirtualProtectEx
DecodePointer
HeapDestroy
GetProcAddress
VirtualAllocEx
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FlushInstructionCache
CreateRemoteThread
VirtualFreeEx
AllocConsole
IsWow64Process
LoadLibraryExW
VirtualQueryEx
HeapCreate
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadContext
SetThreadContext
OpenThread
WriteConsoleW
RaiseException
GetSystemInfo
FreeLibrary
LoadLibraryExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
CompareStringW
LCMapStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
SetEndOfFile
Sections
.text Size: 295KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ