LostLife_1[.]52[.]exe

General

Target
LostLife_1.52.exe
Size 10.3MB
Sample260519-dk4tesbt4p
SHA256 0feb5e6b98860dbe5350598ce7b0e3e8203c2944255f6515f955dcc9cbd5607f
MD5 711bed74593777e813592f9ae0c35693
SHA1 39e53796dc8dc8a0659598084758710c54628994
SHA512 b4bbd9ec406c254b280cc95751f5535aaa836f409846d2429df359a46407e8edba91823a6284da658ea2d5a1dd185226fe1650e831ed7c16ab6a7bbcbc45ca69
SSDEEP 196608:eMO3UEy7hmFkSMYMv2/gkBX143lIUlOLuQMPGnuzSDBX+c:et3UEy7wFY2/gkB8gBMP1zSF
TLSH
T13CB6BF23E54080E1C5932276CC3ABEA9A17E7E264B7864CB33587C2775736C2E239757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LostLife_1.52.exe

File Explorer

LostLife_1.52.exe

.exe 10.3MB

LostLife_1.52.exe

IMPHASH 901f487907aea119888450003c24d2ea
SHA256 0feb5e6b98860dbe5350598ce7b0e3e8203c2944255f6515f955dcc9cbd5607f
MD5 711bed74593777e813592f9ae0c35693
SHA1 39e53796dc8dc8a0659598084758710c54628994
SHA512 b4bbd9ec406c254b280cc95751f5535aaa836f409846d2429df359a46407e8edba91823a6284da658ea2d5a1dd185226fe1650e831ed7c16ab6a7bbcbc45ca69
SSDEEP 196608:eMO3UEy7hmFkSMYMv2/gkBX143lIUlOLuQMPGnuzSDBX+c:et3UEy7wFY2/gkB8gBMP1zSF
TLSH
T13CB6BF23E54080E1C5932276CC3ABEA9A17E7E264B7864CB33587C2775736C2E239757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3455299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Jenkins\workspace\FlashPlayer\FlashPlayerWin\code\build\win\results\standalone\Release\Win32\FlashPlayer.pdb

kernel32

GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetStartupInfoW GetCommandLineA GetCommandLineW GetSystemDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW RemoveDirectoryW CreateFileA CreateFileW GetFileAttributesA DeleteFileW FindFirstFileW CopyFileW HeapCreate HeapDestroy HeapAlloc HeapFree HeapSize HeapLock HeapUnlock HeapWalk DebugBreak CreateThread OpenThread SetThreadPriority QueueUserAPC TlsAlloc TlsFree SleepEx VirtualAlloc VirtualFree VirtualProtect VirtualQuery FreeLibrary GetProcessTimes GetCurrentProcess GlobalAlloc GlobalSize GlobalLock GlobalUnlock LoadLibraryA GetModuleHandleExW SetCurrentDirectoryW GetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency GetACP MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId SetUnhandledExceptionFilter FindNextFileW GetCPInfo IsDBCSLeadByte VerSetConditionMask LockResource GlobalFree ExitThread LoadResource CreateProcessA FindResourceExA FindResourceExW GetSystemDirectoryA GetFileAttributesW MoveFileExW GetVersionExW VerifyVersionInfoW GetUserDefaultUILanguage GetUserDefaultLangID GetLongPathNameW GetFileInformationByHandle GetFileSizeEx DeviceIoControl SetFilePointerEx lstrlenW CreateMutexA CreateProcessW ExpandEnvironmentStringsA ExpandEnvironmentStringsW OutputDebugStringA GetTempPathA GetTempFileNameA GetSystemWow64DirectoryW CreateDirectoryA GetFullPathNameW GetFileAttributesExW LoadLibraryW GetVolumeInformationW SetLastError SetEvent ResetEvent WaitForMultipleObjects GetTickCount CreateEventW GetSystemTime GetTimeZoneInformation SystemTimeToFileTime GetCurrentThread GetExitCodeThread DuplicateHandle MapViewOfFile UnmapViewOfFile LCMapStringW GetLocaleInfoW TerminateThread CreateWaitableTimerW ReleaseSemaphore CreateSemaphoreW SetThreadAffinityMask ReleaseMutex CreateFileMappingA CompareFileTime IsDebuggerPresent OutputDebugStringW EncodePointer GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime RtlUnwind LoadLibraryExW GetStdHandle GetStringTypeW GetFileType GetDateFormatW GetTimeFormatW CompareStringW GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler FlushFileBuffers GetConsoleCP GetConsoleMode HeapReAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA SetConsoleMode TlsSetValue TlsGetValue GetSystemInfo CloseHandle FindClose SetFilePointer SetEndOfFile ReadFile WriteFile GetFileSize Sleep WaitForSingleObject DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId SwitchToThread RaiseException GetExitCodeProcess ExitProcess GetProcAddress InterlockedCompareExchange InterlockedExchange InterlockedDecrement InterlockedIncrement CreateEventA CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer InterlockedExchangeAdd GetVersionExA GetVersion VerifyVersionInfoA GetNumberFormatW GetCurrencyFormatW GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FreeLibraryAndExitThread DeleteFileA DecodePointer GetProcessAffinityMask

advapi32

CryptAcquireContextA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptReleaseContext CryptAcquireContextW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCreateKeyExW RegCreateKeyExA RegCloseKey RegOpenKeyA

generic

count=41, id=241, version=40116,

count=177, id=243, version=40116,

count=36, id=242, version=40116,

count=1, id=199, version=41118,

count=26, id=259, version=24123,

count=20, id=260, version=24123,

count=3, id=261, version=23013,

count=18, id=264, version=24233,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=766, id=260, version=24233,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=651, id=1, productName=Unmarked objects,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=46, id=261, version=24123,

count=901, id=261, version=24233,

count=1, id=256, version=24233,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, version=24233,

Sharing