lumma | 99c16944cf866e0a9222f700238a94d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

99c16944cf866e0a9222f700238a94d9_JaffaCakes118
Size

4.9MB
MD5

99c16944cf866e0a9222f700238a94d9
SHA1

38d1426d676baa74e08d78b1a63d09d2fe94735f
SHA256

bd2f485c7e79cb069dca376acf19ac69cb365adb8fa7e6ea9697f51930e5b7e9
SHA512

3346c1bd4e5ca2bfe7836a27771ab246731aef1f5eb9a581c4f6e44d0641b0201c6bd60efa0f1f6484c8ce8a9fab9fc7c7e1b469242adb15fde59be89add3b96
SSDEEP

49152:H3ZKwaIejrKlURbgVXkBBFflxHNFKEFTYvyGVAmwj2UDqmAlXdWolk9Oh9Pab:HpKwaFWlURbnBYyGVAX2U+W

Score

10^/10

lumma

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
sample	family_lumma_v4

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99c16944cf866e0a9222f700238a94d9_JaffaCakes118

Files

99c16944cf866e0a9222f700238a94d9_JaffaCakes118
.exe windows:6 windows x86 arch:x86

eae70fcb5a1d4d818a49b782f1eb6a05

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\DEVS\Clientes\YouLose\Source\SrcGame\src\Release\game.pdb

Imports

dsound

ord1

kernel32

CreateFileA
FindFirstFileA
ReadFile
GetFileSize
GetSystemDirectoryA
ExitProcess
FindClose
FindNextFileA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateDirectoryA
WriteFile
GetLocalTime
OutputDebugStringA
CreateProcessA
WritePrivateProfileStringA
SetFilePointer
GlobalAlloc
GetComputerNameA
SuspendThread
DeleteFileA
ResumeThread
CopyFileA
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetThreadPriority
TerminateThread
GetExitCodeThread
_lopen
_lcreat
_lread
_lwrite
_lclose
CompareFileTime
GlobalUnlock
GlobalLock
GlobalHandle
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
LocalAlloc
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TerminateProcess
GetVersionExA
SetEndOfFile
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetConsoleCtrlHandler
GetTimeZoneInformation
lstrcmpiA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
FreeLibraryAndExitThread
GetTickCount
OpenThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcmpA
DuplicateHandle
CloseHandle
IsDebuggerPresent
DeleteCriticalSection
InitializeCriticalSectionEx
CreateEventW
SetLastError
FormatMessageA
lstrcatA
ExitThread
GetCurrentThread
Sleep
WriteConsoleW
Module32Next
Module32First
Thread32Next
Thread32First
CreateToolhelp32Snapshot
lstrlenA
lstrcpyA
FlushFileBuffers
lstrcpynA
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap

user32

LoadKeyboardLayoutA
MessageBoxA
GetKeyState
SendMessageA
OffsetRect
ClientToScreen
GetKeyboardLayoutNameA
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
RegisterClassA
CreateWindowExA
DestroyWindow
GetClientRect
ShowWindow
CreateDialogParamA
GetDlgItem
SetWindowTextA
LoadCursorA
WaitMessage
PostQuitMessage
SetTimer
GetSystemMetrics
LoadMenuA
GetMenu
SetMenu
CreateMenu
CheckMenuItem
EnableMenuItem
SetForegroundWindow
LoadIconA
DestroyIcon
SetWindowPos
GetAsyncKeyState
AdjustWindowRect
SetWindowLongA
CharToOemA
OemToCharA
CharUpperA
PostMessageA
CallWindowProcA
AdjustWindowRectEx
ShowCursor
GetWindowLongA
ReleaseDC
GetDC
UpdateWindow
UnregisterClassA
GetClassNameA
GetWindowTextA
FindWindowA
GetWindow
wsprintfA
EnumWindows
CharLowerA

gdi32

CreateSolidBrush
SetBkMode
GetTextColor
SetTextColor
GetStockObject
GetObjectA
SelectObject
GetDIBits
DeleteDC
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject

advapi32

RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegCreateKeyExA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

d3d9

Direct3DCreate9

d3dx9_43

D3DXGetImageInfoFromFileInMemory
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateFontA

winmm

mixerOpen
mixerClose
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mmioAdvance
mmioSetInfo
mmioCreateChunk
mmioSeek
mmioWrite
mmioRead
mmioClose
mmioOpenA
timeEndPeriod
timeBeginPeriod
timeKillEvent
mmioAscend
timeSetEvent
mixerGetDevCapsA
mmioDescend
timeGetTime
mmioGetInfo

shlwapi

PathFileExistsA

msvfw32

ICSendMessage
ICDecompress
ICLocate
ICClose

avifil32

AVIStreamOpenFromFileA
AVIStreamInfoA
AVIStreamRelease
AVIFileExit
AVIFileInit
AVIStreamRead
AVIStreamLength
AVIStreamReadFormat

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

wsock32

ioctlsocket
WSACleanup
accept
bind
connect
inet_ntoa
htons
inet_addr
listen
recv
send
setsockopt
closesocket
socket
gethostbyname
gethostname
WSAStartup
WSAGetLastError
WSAAsyncSelect
__WSAFDIsSet
select

imm32

ImmGetDescriptionA
ImmGetProperty
ImmGetContext
ImmReleaseContext
ImmGetCompositionStringA
ImmGetCandidateListCountA
ImmGetCandidateListA
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetOpenStatus

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 99.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eae70fcb5a1d4d818a49b782f1eb6a05

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dsound

kernel32

user32

gdi32

advapi32

shell32

ole32

d3d9

d3dx9_43

winmm

shlwapi

msvfw32

avifil32

iphlpapi

wininet

wsock32

imm32

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 431KB - Virtual size: 431KB

.data Size: 1.3MB - Virtual size: 99.2MB

.rsrc Size: 82KB - Virtual size: 82KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 431KB - Virtual size: 431KB

.data
Size: 1.3MB - Virtual size: 99.2MB

.rsrc
Size: 82KB - Virtual size: 82KB