14cd726c88cafd335d3c4e25677e6ff9c161953a5da1b17af7810f7e3d0a1a38[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

14cd726c88cafd335d3c4e25677e6ff9c161953a5da1b17af7810f7e3d0a1a38.exe
Size

32KB
MD5

09cbc95554a15fcb35097a4335da6aa0
SHA1

191f9189d14f6892f5f8db00d81c3cf5809b5a39
SHA256

14cd726c88cafd335d3c4e25677e6ff9c161953a5da1b17af7810f7e3d0a1a38
SHA512

b3e03a9ba11074ac51631ad336e8c2211677f6a0407f328de6764580ac5e3c57a55cc57e7a5bbf8941fcbb6cea1a697afd0eb53b1c7830429717921a4df8fa27
SSDEEP

768:DnXW/oHK5NEZoAUNg6CvhCoGvAFC18p+VOs:DXgEZiNrTvAFC18p+VO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
14cd726c88cafd335d3c4e25677e6ff9c161953a5da1b17af7810f7e3d0a1a38.exe

Files

14cd726c88cafd335d3c4e25677e6ff9c161953a5da1b17af7810f7e3d0a1a38.exe
.dll windows:4 windows x86 arch:x86

2736c1493d2edf4be8f4744bbcb25b4e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lua

lua_settag
lua_setglobal
lua_pushcclosure
ord3
ord4
ord2
ord5
lua_open
lua_close
lua_bytecode
lua_freebytecode
lua_setgcthreshold
lua_dobuffer
lua_next
lua_getglobals
luaL_argerror
luaL_opt_lstr
lua_pushnil
lua_newtag
luaL_openlib
luaL_check_number
lua_type
lua_getglobal
lua_pushvalue
lua_rawcall
lua_settop
luaL_check_lstr
lua_tag
lua_touserdata
lua_tonumber
lua_isnumber
lua_tostring
lua_isstring
lua_gettop
lua_pushstring
lua_pushusertag
lua_error
lua_settable
lua_newtable
lua_pushnumber

user32

SetTimer
PostMessageA
KillTimer
FindWindowA
MessageBoxA

shell32

ShellExecuteA

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA

msvcrt

strchr
_initterm
_adjust_fdiv
realloc
strncpy
strpbrk
malloc
sprintf
free
_iob
fputs
floor
_ftol
_stricmp
strrchr

kernel32

LoadLibraryA
GetProcAddress
GetLastError
FindClose
FindNextFileA
FindFirstFileA
Sleep
FormatMessageA
FreeLibrary
CreateMutexA
GetTickCount
DisableThreadLibraryCalls
ReleaseMutex
CloseHandle
GetTempPathA
GetModuleFileNameA
GetModuleHandleA
WaitForSingleObject

Exports

Exports

close_list_variables
deinit_registers
delete_variable
free_bytecode
get_bytecode
get_double_variable
get_first_variable
get_int_variable
get_lua_state
get_next_double_variable
get_next_int_variable
get_next_string_variable
get_string_variable
get_variable_type
init_registers
my_free
my_parse
open_help
open_list_variables
reset_registers
run_parser
run_parser_ex
set_double_variable
set_int_variable
set_string_variable
set_variable_window

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2736c1493d2edf4be8f4744bbcb25b4e

Headers

File Characteristics

Imports

lua

user32

shell32

advapi32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 976B

.reloc Size: 4KB - Virtual size: 1008B

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 976B

.reloc
Size: 4KB - Virtual size: 1008B