JustLuck[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
JustLuck.exe
Size 29.6MB
Sample260415-ve5xzag16w
SHA256 a62c9af4e08d7d752397e14a97885c009e4f53b281f2ccc3a943eb808ea44cc3
MD5 07bb94102a2dcac9185180c7a881d756
SHA1 3762ec9968cf07c0d4ea45b5a1024d2ccd5b991b
SHA512 ccbbc16e4169868aff603a9745ac992128eb4069890039dff2ab39c16a59acb4532533d6ad872517a892794bb2618890099c129617db8b0e6d5aa7634e5e8086
SSDEEP 393216:RXlBQRoR0EQDneIjT/VLvp5Ol7erXj+01zTb9s+DmVmlyupEJARWGOruteFd9WTF:RsSADD5zpjfC+CMGARWvVb9WV
TLSH
T1096773ACC58834B3F7F6B40FF7956A5E4D8EE9A88E952A09D24CF62536056C01C3394F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JustLuck.exe

File Explorer

JustLuck.exe

.exe 29.6MB

JustLuck.exe

IMPHASH dbb9126ff9a9589faf6907bae6a7342e
SHA256 a62c9af4e08d7d752397e14a97885c009e4f53b281f2ccc3a943eb808ea44cc3
MD5 07bb94102a2dcac9185180c7a881d756
SHA1 3762ec9968cf07c0d4ea45b5a1024d2ccd5b991b
SHA512 ccbbc16e4169868aff603a9745ac992128eb4069890039dff2ab39c16a59acb4532533d6ad872517a892794bb2618890099c129617db8b0e6d5aa7634e5e8086
SSDEEP 393216:RXlBQRoR0EQDneIjT/VLvp5Ol7erXj+01zTb9s+DmVmlyupEJARWGOruteFd9WTF:RsSADD5zpjfC+CMGARWvVb9WV
TLSH
T1096773ACC58834B3F7F6B40FF7956A5E4D8EE9A88E952A09D24CF62536056C01C3394F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA

comctl32

InitCommonControlsEx

gdi32

CreateFontA DeleteObject SetBkColor SetTextColor

kernel32

CloseHandle CloseThreadpoolWork CreateFileA CreateFileMappingA CreateProcessA CreateThreadpoolWork CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FindResourceA FlushFileBuffers GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemInfo GetTempPathA GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadResource LockResource MapViewOfFile MoveFileExA Process32First Process32Next ReadFile SetCurrentDirectoryA SetUnhandledExceptionFilter SizeofResource Sleep SubmitThreadpoolWork TlsGetValue UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForThreadpoolWorkCallbacks WriteFile __C_specific_handler lstrcatA lstrcmpiA lstrcpyA

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _exit _fmode _fpreset _initterm _ismbblead abort atexit calloc exit fprintf free malloc memcpy memset signal strlen strncmp vfprintf

user32

CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA GetSysColor GetSysColorBrush LoadCursorA LoadIconA PeekMessageA PostQuitMessage RegisterClassExA SendMessageA SetWindowTextA ShowWindow TranslateMessage UpdateWindow wsprintfA

Name

.tx

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pd

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cbebba

Size

1024B

Virtual Size

868B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nfwwrq

Size

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cfyquv

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cangru

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JustLuck.exe

advapi32

comctl32

gdi32

kernel32

msvcrt

user32

generic