lucefskid[.]exe | Triage™

General

Target
lucefskid.exe
Size 115KB
Sample260708-sbnheagy6w
SHA256 782902c39a07c9c938f5ef16b6cb19108c39173f59ebc7a0f6209e13703b440e
MD5 12da951d0d838215fd20058f9ec6ac02
SHA1 c4c8c58281ba26a4842aebc21390ca43b738c14f
SHA512 793a2dd945023ea3fb5ae12de6e221032a0f1c71700dd65bcc241263b7486e70d5208e1b8f0d2dc6ddb6221dd070329300cd3f36cf115b08deae7065e660bfde
SSDEEP 3072:Efy94r4a3dLJ7KRzbDM7JapwDxOXoVxoGFZ2k:Or4a3dLUzbDM7spNQZ2k
TLSH
T12FC35B4B77E530F8E5768638C5A50A05EBB2B43107609FEF07A482561F273E1AD3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lucefskid.exe

File Explorer

lucefskid.exe

.exe 115KB

lucefskid.exe

IMPHASH 0ea0361b519418101ea990f507d1f89f
SHA256 782902c39a07c9c938f5ef16b6cb19108c39173f59ebc7a0f6209e13703b440e
MD5 12da951d0d838215fd20058f9ec6ac02
SHA1 c4c8c58281ba26a4842aebc21390ca43b738c14f
SHA512 793a2dd945023ea3fb5ae12de6e221032a0f1c71700dd65bcc241263b7486e70d5208e1b8f0d2dc6ddb6221dd070329300cd3f36cf115b08deae7065e660bfde
SSDEEP 3072:Efy94r4a3dLJ7KRzbDM7JapwDxOXoVxoGFZ2k:Or4a3dLUzbDM7spNQZ2k
TLSH
T12FC35B4B77E530F8E5768638C5A50A05EBB2B43107609FEF07A482561F273E1AD3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile Process32First WriteProcessMemory FindFirstFileA HeapFree GetCurrentProcess FindNextFileA Thread32Next Thread32First FindClose SuspendThread ResumeThread DuplicateHandle GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA CopyFileA CreateFileA LoadLibraryA DeleteFileA Process32Next CloseHandle K32GetModuleBaseNameA K32GetModuleInformation HeapAlloc VirtualProtectEx GetProcAddress VirtualAllocEx GetFileSize ReadProcessMemory GetProcessHeap FreeLibrary K32EnumProcessModules GetTempFileNameA OpenThread VirtualQueryEx WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW InitializeCriticalSectionAndSpinCount LoadLibraryExW CompareStringW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP

ntdll

NtCreateSection NtMapViewOfSection

user32

wsprintfA

Sharing