General

  • Target

    30119e1f90ac99fdc496f0ce8c1a51a5e406667c1310588f792879647a9c1bf6.zip

  • Size

    44.5MB

  • MD5

    58a4ec2a6ff4d63bcd7f8d8f6b182e8f

  • SHA1

    7a13c703dddbdca3a54e095e64f674878cd604eb

  • SHA256

    30119e1f90ac99fdc496f0ce8c1a51a5e406667c1310588f792879647a9c1bf6

  • SHA512

    4cead44126dbfdef6f92550f9bcf5a53a968ddd175c62322583b49e9bf56f6f271e8587268253e234261f798f94b20adc97ab4ae86a8cd0fa80bb11de7f6689c

  • SSDEEP

    786432:npO7eL39aMcQkN9MOasMMkxkb71zzyILMl6uarcp8FKQMihmLf6dfrzONUiV:nQeLZcQ0MZIkSzGEMlqrw8FKQm6dNk

Score
10/10

Malware Config

Signatures

  • Detect Lumma Stealer payload V2 1 IoCs
  • Lumma family
  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • 30119e1f90ac99fdc496f0ce8c1a51a5e406667c1310588f792879647a9c1bf6.zip
    .zip
  • LazyCat
  • ar.ini
  • bg.ini
  • bin\ALL_base.dat
  • bin\BG.lng
  • bin\CA.lng
  • bin\CS.lng
  • bin\Config.dat
  • bin\DA.lng
  • bin\DE.lng
  • bin\EN.lng
  • bin\ES.lng
  • bin\ET.lng
  • bin\FN.lng
  • bin\FR.lng
  • bin\HR.lng
  • bin\HU.lng
  • bin\ICRDGT_base.dat
  • bin\ID.lng
  • bin\IT.lng
  • bin\LT.lng
  • bin\LV.lng
  • bin\NB.lng
  • bin\NL.lng
  • bin\NSOCR.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    ee7e9ae3ef629e19b12dcd9b44187e75


    Headers

    Imports

    Exports

    Sections

  • bin\NsBars.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    a4a784e5029279463818b31167e8f38b


    Headers

    Imports

    Exports

    Sections

  • bin\NsImgLdr.dll
    .dll windows:6 windows x86 arch:x86

    abaf983d68f2a272929e27030410d98d


    Headers

    Imports

    Exports

    Sections

  • bin\NsSpell.dll
    .dll windows:6 windows x86 arch:x86

    8053a7d12c214bceeb2cb723a962bce0


    Headers

    Imports

    Exports

    Sections

  • bin\PL.lng
  • bin\PT.lng
  • bin\RO.lng
  • bin\RU.lng
  • bin\SK.lng
  • bin\SL.lng
  • bin\SV.lng
  • bin\TR.lng
  • bin\Twaindsm.dll
    .dll windows:5 windows x86 arch:x86

    bf4602f11b8e8bdeb01899d2a942ed66


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin\gray.icc
  • bin\jnsocr.dll
    .dll windows:5 windows x86 arch:x86

    a1fddcfa0d53e9bdced4474042d654bd


    Headers

    Imports

    Exports

    Sections

  • bin\pdf_font.ttf
  • bin\rgb.icc
  • bin\sd.dat
  • br.ini
  • cz.ini
  • de.ini
  • de.pdf
    .pdf
  • en.ini
  • es.ini
  • fr.ini
  • gr.ini
  • hu.ini
  • iframe\rolloutfile.tv0.0.tv
  • iframe\rolloutfile.tv0.1.tv
  • iframe\rolloutfile.tv0.2.tv
  • iframe\rolloutfile.tv1.1.tv
  • iframe\rolloutfile.tv1.2.tv
  • iframe\rolloutfile.tv1.3.tv
  • iframe\rolloutfile.tv10.0.tv
  • iframe\rolloutfile.tv10.1.tv
  • iframe\rolloutfile.tv11.0.tv
  • iframe\rolloutfile.tv11.1.tv
  • iframe\rolloutfile.tv12.0.tv
  • iframe\rolloutfile.tv12.1.tv
  • iframe\rolloutfile.tv13.0.tv
  • iframe\rolloutfile.tv13.1.tv
  • iframe\rolloutfile.tv14.0.tv
  • iframe\rolloutfile.tv14.1.tv
  • iframe\rolloutfile.tv15.0.tv
  • iframe\rolloutfile.tv15.1.tv
  • iframe\rolloutfile.tv16.0.tv
  • iframe\rolloutfile.tv16.1.tv
  • iframe\rolloutfile.tv17.0.tv
  • iframe\rolloutfile.tv17.1.tv
  • iframe\rolloutfile.tv18.0.tv
  • iframe\rolloutfile.tv18.1.tv
  • iframe\rolloutfile.tv19.0.tv
  • iframe\rolloutfile.tv19.1.tv
  • iframe\rolloutfile.tv2.1.tv
  • iframe\rolloutfile.tv2.2.tv
  • iframe\rolloutfile.tv2.3.tv
  • iframe\rolloutfile.tv2.4.tv
  • iframe\rolloutfile.tv2.5.tv
  • iframe\rolloutfile.tv2.6.tv
  • iframe\rolloutfile.tv20.0.tv
  • iframe\rolloutfile.tv20.1.tv
  • iframe\rolloutfile.tv21.0.tv
  • iframe\rolloutfile.tv21.1.tv
  • iframe\rolloutfile.tv22.0.tv
  • iframe\rolloutfile.tv22.1.tv
  • iframe\rolloutfile.tv23.0.tv
  • iframe\rolloutfile.tv23.1.tv
  • iframe\rolloutfile.tv24.0.tv
  • iframe\rolloutfile.tv24.1.tv
  • iframe\rolloutfile.tv25.0.tv
  • iframe\rolloutfile.tv25.1.tv
  • iframe\rolloutfile.tv26.0.tv
  • iframe\rolloutfile.tv26.1.tv
  • iframe\rolloutfile.tv27.0.tv
  • iframe\rolloutfile.tv27.1.tv
  • iframe\rolloutfile.tv28.0.tv
  • iframe\rolloutfile.tv28.1.tv
  • iframe\rolloutfile.tv29.0.tv
  • iframe\rolloutfile.tv29.1.tv
  • iframe\rolloutfile.tv3.0.tv
  • iframe\rolloutfile.tv3.1.tv
  • iframe\rolloutfile.tv3.2.tv
  • iframe\rolloutfile.tv30.0.tv
  • iframe\rolloutfile.tv30.1.tv
  • iframe\rolloutfile.tv31.0.tv
  • iframe\rolloutfile.tv31.1.tv
  • iframe\rolloutfile.tv32.0.tv
  • iframe\rolloutfile.tv32.1.tv
  • iframe\rolloutfile.tv33.0.tv
  • iframe\rolloutfile.tv33.1.tv
  • iframe\rolloutfile.tv34.0.tv
  • iframe\rolloutfile.tv34.1.tv
  • iframe\rolloutfile.tv35.0.tv
  • iframe\rolloutfile.tv35.1.tv
  • iframe\rolloutfile.tv36.0.tv
  • iframe\rolloutfile.tv36.1.tv
  • iframe\rolloutfile.tv37.0.tv
  • iframe\rolloutfile.tv37.1.tv
  • iframe\rolloutfile.tv38.0.tv
  • iframe\rolloutfile.tv38.1.tv
  • iframe\rolloutfile.tv39.0.tv
  • iframe\rolloutfile.tv39.1.tv
  • iframe\rolloutfile.tv4.0.tv
  • iframe\rolloutfile.tv4.1.tv
  • iframe\rolloutfile.tv40.0.tv
  • iframe\rolloutfile.tv40.1.tv
  • iframe\rolloutfile.tv41.0.tv
  • iframe\rolloutfile.tv41.1.tv
  • iframe\rolloutfile.tv42.0.tv
  • iframe\rolloutfile.tv42.1.tv
  • iframe\rolloutfile.tv43.0.tv
  • iframe\rolloutfile.tv43.1.tv
  • iframe\rolloutfile.tv44.0.tv
  • iframe\rolloutfile.tv44.1.tv
  • iframe\rolloutfile.tv45.0.tv
  • iframe\rolloutfile.tv45.1.tv
  • iframe\rolloutfile.tv46.0.tv
  • iframe\rolloutfile.tv46.1.tv
  • iframe\rolloutfile.tv46.2.tv
  • iframe\rolloutfile.tv5.0.tv
  • iframe\rolloutfile.tv5.1.tv
  • iframe\rolloutfile.tv6.0.tv
  • iframe\rolloutfile.tv6.1.tv
  • iframe\rolloutfile.tv7.0.tv
  • iframe\rolloutfile.tv7.1.tv
  • iframe\rolloutfile.tv7.2.tv
  • iframe\rolloutfile.tv7.3.tv
  • iframe\rolloutfile.tv7.4.tv
  • iframe\rolloutfile.tv8.0.tv
  • iframe\rolloutfile.tv8.1.tv
  • iframe\rolloutfile.tv9.0.tv
  • iframe\rolloutfile.tv9.1.tv
  • it.ini
  • ko.ini
  • lib\Viewer.dll
    .dll windows:6 windows x86 arch:x86

    15879c08228ff9f12a2469eaa31547ec


    Headers

    Imports

    Exports

    Sections

  • lib\glib-2.0.dll
    .dll windows:6 windows x86 arch:x86

    c35847707776744578dd2e6ed68cea8b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\glibmm-2.4.dll
    .dll windows:6 windows x86 arch:x86

    dcaaaaa377d081f575e418245dd3d26b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\gmodule-2.0.dll
    .dll windows:6 windows x86 arch:x86

    306dae88a2aeb313e4f64c67cf4f8e05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\gobject-2.0.dll
    .dll windows:6 windows x86 arch:x86

    bd0e6a400d2a3948d4b3df1aafcceec5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\gthread-2.0.dll
    .dll windows:6 windows x86 arch:x86

    4fdf40bb83560d03f905c2399d860ff9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\guestStoreClient.dll
    .dll windows:6 windows x86 arch:x86

    e7756c5762a9ca135b16ba4680f9036f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\intl.dll
    .dll windows:6 windows x86 arch:x86

    cf0a4055a11a7828b015336906f907b6


    Headers

    Imports

    Exports

    Sections

  • lib\pcre.dll
    .dll windows:6 windows x86 arch:x86

    ab5dad2b5baf0a6ed6b8b1f0f47fa598


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\vmtools.dll
    .dll windows:6 windows x86 arch:x86

    24b03b73cd42dca1b2d8fb469c3b8627


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lib\vmtoolsd.exe
    .exe windows:6 windows x86 arch:x86

    c7952dc8be5b9c5513229e707872cc45


    Code Sign

    Headers

    Imports

    Sections

  • ru.ini
  • se.ini
  • setupz.exe
    .exe windows:5 windows x86 arch:x86

    82194d62560148a188204923283639d7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • tr.ini