luau-lsp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
luau-lsp.exe
Size 16.1MB
Sample260702-sn97yagy4x
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
luau-lsp.exe

File Explorer

luau-lsp.exe

.exe 16.1MB

luau-lsp.exe

IMPHASH 3f8598ffe56eda61b40e2aa98e11b949
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

110416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\luau-lsp\luau-lsp\build\RelWithDebInfo\luau-lsp.pdb

dbghelp

StackWalk64 SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpSetCredentials WinHttpQueryHeaders WinHttpOpenRequest

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA RegSetKeyValueW SystemFunction036

kernel32

GetOEMCP GetACP IsValidCodePage FlushFileBuffers HeapQueryInformation HeapSize GetCurrentDirectoryW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetCurrentDirectoryW GetNamedPipeInfo GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent VirtualProtect GetCurrentThreadStackLimits InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce CreateDirectoryW DeleteFileW RemoveDirectoryW GetLastError GetModuleFileNameW GetCurrentProcess TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 CloseHandle GetCurrentProcessId VirtualQuery FreeLibrary LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadLibraryA RaiseException DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetModuleHandleA GetModuleFileNameA RtlCaptureStackBackTrace CreateFileW LockFileEx SetEndOfFile UnlockFileEx CreateProcessW GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler SetEvent SleepEx CreateEventW Sleep GetCurrentThreadId GetExitCodeThread FlushInstructionCache OpenProcess GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule RemoveVectoredExceptionHandler GetFileSizeEx ReadFile SetFilePointerEx WriteFile RtlUnwind FindFirstFileExW GetFileTime MoveFileExW LoadLibraryW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx ReadProcessMemory SetLastError SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime FormatMessageW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection IsValidLocale GetLocaleInfoW LCMapStringW VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable WaitForSingleObjectEx SwitchToThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetSystemTimePreciseAsFileTime InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW GetFullPathNameW IsProcessorFeaturePresent GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc HeapFree GetTempPathW IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW

shell32

CommandLineToArgvW

Name

.text

Size

13.5MB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

622KB

Virtual Size

621KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

luau-lsp.exe

dbghelp

version

winhttp

advapi32

kernel32

shell32

generic