lumma | 1fc7f0e2755cc273a7b4688d43ed9b7f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1fc7f0e2755cc273a7b4688d43ed9b7f_JaffaCakes118
Size

2.1MB
MD5

1fc7f0e2755cc273a7b4688d43ed9b7f
SHA1

eb7b826ebf9496210dead77b3bec2c3fae0f043f
SHA256

f414f55854cb3c47db16dbf12ed0ddf7ee811a8d7babfd8996be16cbcc91f5bb
SHA512

ebdbfc8bafa267965a6e25c42d0bb664536d88c220045b18fb155bc20d0efc052ee8e41d68c469266b3db2250872d24145af87ad642a4ebe435bcc028a06b5b6
SSDEEP

49152:C/9JD8FbPp58Rr/ReoDC7r2gsUt2JhrMUy4halzXPwC1Ux1TsTUMSd37Q6Uv:ZTp585ZemCrRsy2no+2Y1TspS37Q6I

Score

10^/10

lumma

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
static1/unpack001/Game.exe	family_lumma_v4

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Game.exe

Files

1fc7f0e2755cc273a7b4688d43ed9b7f_JaffaCakes118
.zip
Game.exe
.exe windows:6 windows x86 arch:x86

a6957d051e11846d25d8b562cfb8eb2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Source RenewalPT\SrcGame\src\Release\Game.pdb

Imports

dsound

ord1

kernel32

GetPrivateProfileStringA
CreateDirectoryA
WriteFile
OutputDebugStringA
GetCurrentDirectoryA
CreateProcessA
WritePrivateProfileStringA
SetFilePointer
VirtualProtect
VirtualQuery
GlobalAlloc
GetTickCount64
GetComputerNameA
SuspendThread
ResumeThread
CopyFileA
WaitForSingleObject
SetThreadPriority
TerminateThread
GetExitCodeThread
_lopen
_lcreat
_lread
_lwrite
_lclose
CompareFileTime
GlobalUnlock
GlobalLock
GlobalHandle
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
LocalAlloc
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TerminateProcess
GetVersionExA
SetEndOfFile
HeapSize
CreateFileW
SetStdHandle
OutputDebugStringW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
CreateThread
FindNextFileW
FindFirstFileExW
FindNextFileA
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
DecodePointer
EncodePointer
FormatMessageW
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
FindClose
ExitProcess
GetFileSize
ReadFile
FindFirstFileA
lstrcmpiA
lstrcmpA
lstrcatA
ExitThread
GetCurrentThread
Sleep
Module32Next
Module32First
Thread32Next
Thread32First
GetCurrentProcessId
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
WriteConsoleW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
lstrlenA
lstrcpyA
lstrcpynA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
FreeLibraryAndExitThread
GetTickCount
OpenThread
GetPrivateProfileIntA
GetTimeZoneInformation
InitializeCriticalSection
DuplicateHandle
CloseHandle
IsDebuggerPresent
GetLocalTime
DeleteFileA
CreateFileA
GetCurrentThreadId
IsValidCodePage

user32

SetMenu
LoadMenuA
CheckMenuItem
EnableMenuItem
SetForegroundWindow
CreateMenu
GetMenu
LoadIconA
DestroyIcon
SetWindowPos
GetAsyncKeyState
AdjustWindowRect
SetWindowLongA
CharToOemA
OemToCharA
CharUpperA
GetWindowTextA
FindWindowA
GetSystemMetrics
wsprintfA
CharLowerA
EnumWindows
GetClassNameA
GetDC
ReleaseDC
SetWindowTextA
GetClientRect
ClientToScreen
OffsetRect
SendMessageA
GetKeyState
MessageBoxA
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
PostMessageA
CallWindowProcA
SetFocus
GetForegroundWindow
AdjustWindowRectEx
ShowCursor
GetWindowLongA
SetTimer
GetWindow
RegisterClassA
CreateWindowExA
DestroyWindow
ShowWindow
CreateDialogParamA
GetDlgItem
WaitMessage
UpdateWindow
LoadCursorA

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteDC
DeleteObject
GetDIBits
SelectObject
GetObjectA
SetBkMode
GetStockObject
SetTextColor
GetTextColor
CreateSolidBrush
BitBlt

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyA

shell32

ShellExecuteA
Shell_NotifyIconA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateFontA
D3DXCreateTextureFromFileInMemoryEx
D3DXGetImageInfoFromFileInMemory

winmm

mmioClose
timeBeginPeriod
mmioWrite
mmioGetInfo
mmioSetInfo
mmioOpenA
timeEndPeriod
timeKillEvent
mixerGetControlDetailsA
timeSetEvent
timeGetTime
mmioRead
mmioAdvance
mmioDescend
mmioAscend
mmioCreateChunk
mixerGetDevCapsA
mixerOpen
mixerClose
mixerGetLineInfoA
mixerGetLineControlsA
mixerSetControlDetails
mmioSeek

shlwapi

PathFileExistsA

msvfw32

ICDecompress
ICSendMessage
ICClose
ICLocate

avifil32

AVIStreamInfoA
AVIStreamOpenFromFileA
AVIStreamRelease
AVIStreamRead
AVIFileExit
AVIStreamLength
AVIStreamReadFormat
AVIFileInit

wininet

InternetOpenUrlA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenA

iphlpapi

GetAdaptersInfo

wsock32

closesocket
ioctlsocket
WSACleanup
accept
bind
connect
inet_ntoa
htons
inet_addr
select
__WSAFDIsSet
WSAAsyncSelect
WSAGetLastError
WSAStartup
gethostname
gethostbyname
socket
setsockopt
send
recv
listen

imm32

ImmSetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListA
ImmGetDescriptionA
ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext
ImmGetProperty
ImmGetCandidateListCountA

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 524KB - Virtual size: 523KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 97.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6957d051e11846d25d8b562cfb8eb2c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

d3d9

d3dx9_43

winmm

shlwapi

msvfw32

avifil32

wininet

iphlpapi

wsock32

imm32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 524KB - Virtual size: 523KB

.data Size: 1.2MB - Virtual size: 97.9MB

_RDATA Size: 2KB - Virtual size: 1KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 524KB - Virtual size: 523KB

.data
Size: 1.2MB - Virtual size: 97.9MB

_RDATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB