General

  • Target
    Lunar Client - Installer.exe
  • Size 2.3MB
  • Sample250127-zfevdsvpgr
  • SHA256 8a83c12a66924710db869166506f67079af11ec06ad06c4ca6d59db34d890b29
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Lunar Client - Installer.exe
    .exe 2.3MB
  • $PLUGINSDIR/CommandLine.dll
    .dll 60KB
  • $PLUGINSDIR/DotNetZip.dll
    .dll 467KB
  • $PLUGINSDIR/INetC.dll
    .dll 34KB
  • $PLUGINSDIR/Microsoft.Win32.TaskScheduler.dll
    .dll 116KB
  • $PLUGINSDIR/Newtonsoft.Json.dll
    .dll 692KB
  • $PLUGINSDIR/OWInstaller.exe
    .exe 308KB
  • $PLUGINSDIR/OWInstaller.exe.config
    .xml 632B
  • $PLUGINSDIR/OverWolf.Client.CommonUtils.dll
    .dll 658KB
  • $PLUGINSDIR/SharpRaven.dll
    .dll 82KB
  • $PLUGINSDIR/System.dll
    .dll 21KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 14KB
  • $PLUGINSDIR/app/_locales/de/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/en/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/es/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/fr/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/it/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/ja/messages.json
    13KB
  • $PLUGINSDIR/app/_locales/ko/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/pl/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/pt/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/ru/messages.json
    15KB
  • $PLUGINSDIR/app/_locales/tr/messages.json
    12KB
  • $PLUGINSDIR/app/_locales/vi/messages.json
    13KB
  • $PLUGINSDIR/app/_locales/zh-tw/messages.json
    11KB
  • $PLUGINSDIR/app/_locales/zh/messages.json
    11KB
  • $PLUGINSDIR/app/assets/fonts/klavika/KlavikaWebBasicMedium.eot
    27KB
  • $PLUGINSDIR/app/assets/fonts/klavika/KlavikaWebBasicRegular.eot
    30KB
  • $PLUGINSDIR/app/assets/fonts/lato/LatoLatin-Regular.eot
    66KB
  • $PLUGINSDIR/app/cmp.html
    .html .js 5KB
  • $PLUGINSDIR/app/css/styles.min.css
    14KB
  • $PLUGINSDIR/app/game_detection_database.json
    27KB
  • $PLUGINSDIR/app/images/big-icon-fallback.png
    .png 413B
  • $PLUGINSDIR/app/images/bottom-arrow-hover.png
    .png 294B
  • $PLUGINSDIR/app/images/bottom-arrow.png
    .png 279B
  • $PLUGINSDIR/app/images/checkbox-checked.png
    .png 161B
  • $PLUGINSDIR/app/images/close-hover.png
    .png 185B
  • $PLUGINSDIR/app/images/close-normal.png
    .png 330B
  • $PLUGINSDIR/app/images/header-logo.png
    .png 1KB
  • $PLUGINSDIR/app/images/icon-fallback.png
    .png 213B
  • $PLUGINSDIR/app/images/icon.ico
    149KB
  • $PLUGINSDIR/app/images/large-logo.png
    .png 486B
  • $PLUGINSDIR/app/images/minimize-hover.png
    .png 171B
  • $PLUGINSDIR/app/images/minimize-normal.png
    .png 150B
  • $PLUGINSDIR/app/images/more-info.png
    .png 539B
  • $PLUGINSDIR/app/images/plus.png
    .png 178B
  • $PLUGINSDIR/app/images/progress-01-overwolf.png
    .png 12KB
  • $PLUGINSDIR/app/images/progress-02.png
    .png 9KB
  • $PLUGINSDIR/app/images/progress-app-image-01.png
    .png 2KB
  • $PLUGINSDIR/app/images/progress-app-image-02.png
    .png 2KB
  • $PLUGINSDIR/app/images/progress-app-image-03.png
    .png 1KB
  • $PLUGINSDIR/app/images/small-logo.png
    .png 523B
  • $PLUGINSDIR/app/images/tile-fallback.png
    .png 935B
  • $PLUGINSDIR/app/images/v-check.png
    .png 885B
  • $PLUGINSDIR/app/images/welcome-logo.png
    .png 995B
  • $PLUGINSDIR/app/index.html
    .html .js 20KB
  • $PLUGINSDIR/app/js/app.js
    .js 21KB
  • $PLUGINSDIR/app/js/block_inputs.js
    .js 789B
  • $PLUGINSDIR/app/js/libs/cmp.bundle.js
    .js 348KB
  • $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
    .js 90KB
  • $PLUGINSDIR/app/js/models/notifications.js
    .js 5KB
  • $PLUGINSDIR/app/js/utils/analytics.js
    .js 4KB
  • $PLUGINSDIR/app/js/utils/commands.js
    .js 13KB
  • $PLUGINSDIR/app/js/utils/cookies.js
    .js 1KB
  • $PLUGINSDIR/app/js/utils/modal-events-delegate.js
    .js 1KB
  • $PLUGINSDIR/app/js/utils/strings-loader.js
    .js 5KB
  • $PLUGINSDIR/app/js/utils/utils.js
    .js 118B
  • $PLUGINSDIR/app/js/windows/cri/cri-controller.js
    .js 3KB
  • $PLUGINSDIR/app/js/windows/cri/template.js
    1KB
  • $PLUGINSDIR/app/js/windows/finish-with-recommended-app/finish-with-recommended-app-controller.js
    .js 1KB
  • $PLUGINSDIR/app/js/windows/finish-with-recommended-app/template.js
    681B
  • $PLUGINSDIR/app/js/windows/finish/finish-controller.js
    .js 1KB
  • $PLUGINSDIR/app/js/windows/finish/template.js
    1KB
  • $PLUGINSDIR/app/js/windows/main/main-controller.js
    .js 11KB
  • $PLUGINSDIR/app/js/windows/main/template.js
    3KB
  • $PLUGINSDIR/app/js/windows/modal/modal-controller.js
    .js 2KB
  • $PLUGINSDIR/app/js/windows/privacy/privacy-controller.js
    .js 2KB
  • $PLUGINSDIR/app/js/windows/privacy/template.js
    655B
  • $PLUGINSDIR/app/js/windows/progress/progress-1-controller.js
    .js 1KB
  • $PLUGINSDIR/app/js/windows/progress/template.js
    242B
  • $PLUGINSDIR/app/js/windows/settings/settings-controller.js
    .js 6KB
  • $PLUGINSDIR/app/js/windows/settings/template.js
    4KB
  • $PLUGINSDIR/app/js/windows/welcome/template.js
    1KB
  • $PLUGINSDIR/app/js/windows/welcome/welcome-controller.js
    .js 2KB
  • $PLUGINSDIR/app/manifest.json
    691B
  • $PLUGINSDIR/app/progress.html
    .js 20KB
  • $PLUGINSDIR/log4net.dll
    .dll 270KB
  • $PLUGINSDIR/nsProcess.dll
    .dll 14KB
  • $PLUGINSDIR/nsis7z.dll
    .dll 96KB
  • $PLUGINSDIR/nsis7z64.dll
    .dll 514KB
  • $PLUGINSDIR/partner-custom-asset.png
    .png 2KB
  • $PLUGINSDIR/uac.dll
    .dll 24KB
  • $PLUGINSDIR/utils.dll
    .dll 58KB
  • $PLUGINSDIR/websocket-sharp.dll
    .dll 259KB

Lunar Client - Installer.exe

  • IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
  • SHA256 8a83c12a66924710db869166506f67079af11ec06ad06c4ca6d59db34d890b29
  • MD5 SHA1 SHA512 SSDEEP
Digest
a5:84:49:d2:89:9c:53:cf:c5:40:c0:d5:0d:a8:bd:78:d2:3a:f1:44:13:51:7a:e1:0e:d7:78:85:e4:af:d7:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=514330331,CN=Overwolf Ltd,O=Overwolf Ltd,L=Tel Aviv-Yafo,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c
Minor OS version
0
Major OS version
4
Entry point
13613
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths