Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe
Resource
win7-20241010-en
General
-
Target
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.zip
-
Size
488KB
-
MD5
4e54c5e3ad2d51863f7bc5ba732f3b3d
-
SHA1
db604b209f42ab64a3af4d7d81d54ae51c520188
-
SHA256
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad
-
SHA512
30522976db4dc4fd512fb1c61e8d43a42b27b8d1b12ea5028743cd2a7fe3b9300e6551b0180bf462d433aa1c76f570985b842e4153819dae8d911c3705ed92d0
-
SSDEEP
12288:EQNbVxTVzC+QjqzIUBVDN/u3JBLdih8dEho8HzA0l8mbH3su8d:EQNJtVzC+QjqzDtu3JBRw8dES8zjl
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.zip
Files
-
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.zip.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 485KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ