D:\Code\acc\003Code\LemonClients\Installer\LemonClient.Installer\Out\Installer\lemoner.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e440544da8734d50583de3dbcb627e6d05ea11e7d49f7cd65b302caa73ddb82b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e440544da8734d50583de3dbcb627e6d05ea11e7d49f7cd65b302caa73ddb82b.exe
Resource
win10v2004-20240412-en
General
-
Target
e440544da8734d50583de3dbcb627e6d05ea11e7d49f7cd65b302caa73ddb82b
-
Size
658KB
-
MD5
f23a634e0114abacd6db4d6e53a05b80
-
SHA1
077d91752a3ae593d6e951ece44000faa84218a3
-
SHA256
e440544da8734d50583de3dbcb627e6d05ea11e7d49f7cd65b302caa73ddb82b
-
SHA512
0c4f8a6450983093b2d5ae3be1eedb6eb367d475e3e69e271663667d496f0d761fbf21a44a5abc46d053c8ca8de32fc76adee1275e1ecabc783a65fbc573d15b
-
SSDEEP
6144:qj4UgPZ33GxvxTStUZ0N/PW+CpN4gDHLjwfPs3F2V5ff92B:DUgFGx4N/PW+CMgDHL4G49m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e440544da8734d50583de3dbcb627e6d05ea11e7d49f7cd65b302caa73ddb82b
Files
-
e440544da8734d50583de3dbcb627e6d05ea11e7d49f7cd65b302caa73ddb82b.exe windows:6 windows x86 arch:x86
1b07f154b933f33416d77fe401c96ae7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LocalFree
lstrcpyW
lstrcatW
VerSetConditionMask
CreateFileW
GetFileSize
ReadFile
OutputDebugStringA
TerminateProcess
OpenProcess
GetProcAddress
LoadLibraryW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InitializeCriticalSection
SetThreadPriority
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetCurrentThread
ExitProcess
GetCurrentProcess
GetLastError
FindFirstFileW
FindClose
GetEnvironmentVariableW
GetModuleFileNameW
GetNativeSystemInfo
CreateProcessW
GetExitCodeProcess
CreateEventW
CreateMutexW
WaitForSingleObject
ReleaseMutex
CloseHandle
UnhandledExceptionFilter
SetPriorityClass
EnterCriticalSection
DebugBreak
GetSystemTimeAsFileTime
user32
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
MessageBoxW
ScreenToClient
PtInRect
GetForegroundWindow
PostQuitMessage
MessageBoxA
advapi32
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
shell32
SHCreateItemFromParsingName
SHChangeNotify
SHCreateItemFromRelativeName
SHCreateItemInKnownFolder
SHCreateDirectoryExW
ShellExecuteExW
SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
ole32
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateGuid
CoInitialize
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
_Thrd_detach
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_function_call@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?__ExceptionPtrRethrow@@YAXPBX@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
_Thrd_join
_Thrd_id
_Mtx_current_owns
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_timedwait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
StrCmpW
PathAddBackslashW
comctl32
ord410
ord413
vcruntime140
memcmp
memset
_purecall
unexpected
__std_type_info_name
memchr
__std_terminate
__current_exception
__current_exception_context
_except_handler4_common
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
terminate
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_controlfp_s
_initialize_wide_environment
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
_open
__stdio_common_vsprintf
_set_fmode
_close
__p__commode
__stdio_common_vsnprintf_s
_write
api-ms-win-crt-time-l1-1-0
_ftime64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 347KB - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 82KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ