LB%40_l5xmfb.zip
- SHA256 11007d9e770004600c19af5a67056ca577c96fc09fdb438d35588e66bfa18bd2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
update_l5xmfb.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
update_l5xmfb.bat
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
usbmon_l5xmfb.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
usbmon_l5xmfb.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target LB%40_l5xmfb.zip
- Size 907KB
- Sample260705-pdfnssct4w
- SHA256 11007d9e770004600c19af5a67056ca577c96fc09fdb438d35588e66bfa18bd2
- MD5 884219b58fc1de0c1605a22763390a5d
- SHA1 11082b37190ceb8bd43defb62de0eb4245d2d4df
- SHA512 cb82d835102144b8e01c55192e15953d6b236f2fd8dff9392007859e4017ab125f0a85b28f24df24f50af3b0f32e4f34f6d22b073e7e23da95fe33ec15bc7ecc
- SSDEEP 12288:EuXJY6yE6nB7AqQYwhaOsBJ3onWejjE1gbKsRnxY6i3hI5MR7u00ZUCwlqnGIZCb:Za7DnB7dwWvQIjsRxYN3Ljkw6jZ0x
- TLSH T1051533D89381CD783868377AAAA335B0BCC0791FD957C4E12F73CBA04653591EE84A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/usbmon_l5xmfb.dll
File Explorer
-
LB%40_l5xmfb.zip.zip 907KB
-
own.enc442KB
-
update_l5xmfb.bat.bat 657KB
-
usbmon_l5xmfb.dll.dll 14KB
own.enc
- SHA256 2b97d6874ea27060cea6d72bdb208493e7df27d363148fbc901faf8819fd77ed
- MD5 3878e9c9512a1d485d07f26ff87e45b4
- SHA1 91c5f53f91a81b734f3f213703af9c7f5fbe4a52
- SHA512 c649ccd758275a0462e3d15c6f5dccf0b28399fa25a2f3b21ac594f16398bfcde6326f250b003ef86e0c07b3373baa54414c4e2ed6853868f4602e6711a1ca19
- SSDEEP 6144:jKXJUVPRbm1tlTy6y+6lR3NRHD3ynCEjrY+hai23qJpoFNL3SADB6KmIG+UYFonx:jKXJG6y+6lB7WCQY+haiKBRXonk01
- TLSH T10DA42384E710DB7C2418259DDD611FB039812F1FCD3A94922777C294B68F5EAFF88A29
- MD5 SHA1 SHA512 SSDEEP TLSH
update_l5xmfb.bat
- SHA256 1f2766971b02e8e7014e8c31071d8cede5288768c986ebd81452437dee15a6d0
- MD5 0d1316c3d60ce063dbc0299a7a00c341
- SHA1 97471ea4755913626d000e61ed9c8664dd2c800b
- SHA512 ea53d485f157f28975612f58275579523a888af5270f5b57f335c214b083d57e15b5d156b1893f54489281e1bb793973a69718242ac8e811fc9c999c5297b36d
- SSDEEP 12288:kQQyMmiW6+/uP7zGtVWYwEdz7iXjX7u3LolMr/N7LGTkxk:FMMuP7zgw8nyPZ6FHxxk
- TLSH T18CE4237E3F86A9557C2D9896DB3DA40C7C2FF0A74BB4CCA0A987F0B251554C8BB1C41A
- MD5 SHA1 SHA512 SSDEEP TLSH
usbmon_l5xmfb.dll
- IMPHASH efd7f22fecb87f90fef74b8027a9ff28
- SHA256 f270886b12702cb3c74be3b80a834a184bddf19137dacdb948e43a0abcdc1b90
- MD5 3827f7b4f2275f15667992eb156fd236
- SHA1 3a259062413d606ad979715bed0f70fdd5bcba88
- SHA512 a524db68aa0a021d6103ef2bbfdeb00a0a8c1cb5e1f474c10963c04959c92d3863cb771cbbc2021969c034f256b561f6a7203f8075e3eb69de1b0206acd7fd50
- SSDEEP 192:BoutinExrCuLW2LH7Ilv81KM215voyvm01d4L/:BoutiFuLWMH4gdWtom1d4L/
- TLSH T1B552A80D3292D8E9C50DC47981EBCF79AAF5B801C9D75B3C4734DA362EA07A5362AE05
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcessHeap
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
OpenProcess
Process32First
Process32Next
ReadFile
Sleep
TlsGetValue
VirtualAllocEx
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WriteProcessMemory
lstrcmpiA
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
wcscat
wcsrchr
Run
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ