lunar[.]cc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lunar.cc.exe
Size 193KB
Sample260716-ff4zqsgy21
SHA256 6b1614b344b28032ad4f41170d5e32cdec64f1c161e3a7d9f2d5350355bfe738
MD5 3615dcb8c90ff21b94183819acdc9bd3
SHA1 f6eddb06286645e08fc35478b32d3d8ddd49bbb9
SHA512 3f67da9393427f6f42e991dc6885565c7a95e3d444b140be504b7a79daec00ecd9c6a08053f997cfa192cb4b0fec3cb8d07987ed89f008b023c4dcf73cd0c382
SSDEEP 3072:HFx7n9nyvNmXS82Qe5h6CQWpCf1o+kfP9etk4O/+6BrPfEO6846zyhl7:l/nyvgzKNQJ1DM4OT796Bkyhl7
TLSH
T130146D4A72F910F9F173C178C9A65616E33278651771ABEF07A006BA5F22AD09C3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lunar.cc.exe

File Explorer

lunar.cc.exe

.exe 193KB

lunar.cc.exe

IMPHASH 61439f01b0a9ed018f391c1de7faaa22
SHA256 6b1614b344b28032ad4f41170d5e32cdec64f1c161e3a7d9f2d5350355bfe738
MD5 3615dcb8c90ff21b94183819acdc9bd3
SHA1 f6eddb06286645e08fc35478b32d3d8ddd49bbb9
SHA512 3f67da9393427f6f42e991dc6885565c7a95e3d444b140be504b7a79daec00ecd9c6a08053f997cfa192cb4b0fec3cb8d07987ed89f008b023c4dcf73cd0c382
SSDEEP 3072:HFx7n9nyvNmXS82Qe5h6CQWpCf1o+kfP9etk4O/+6BrPfEO6846zyhl7:l/nyvgzKNQJ1DM4OT796Bkyhl7
TLSH
T130146D4A72F910F9F173C178C9A65616E33278651771ABEF07A006BA5F22AD09C3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmExtendFrameIntoClientArea

kernel32

QueryPerformanceCounter QueryPerformanceFrequency Sleep CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle CloseHandle CreateDirectoryW GetProcessHeap LCMapStringW LoadLibraryExW VirtualProtect FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo CreateFileW WriteConsoleW GetFileType SetLastError GetOEMCP GetACP SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetStdHandle WriteFile IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage

user32

TranslateMessage GetMessageW TrackMouseEvent KillTimer PostMessageW LoadIconW LoadCursorW GetCursorPos GetWindowRect GetClientRect InvalidateRect SetWindowRgn EndPaint BeginPaint UpdateWindow GetSystemMetrics DefWindowProcW SetTimer ReleaseCapture SetCapture SetWindowPos ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DispatchMessageW

gdi32

CreateRoundRectRgn

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoInitializeEx CoUninitialize

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW

urlmon

URLDownloadToFileW

Name

.text

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lunar.cc.exe

d2d1

dwrite

dwmapi

kernel32

user32

gdi32

shell32

ole32

advapi32

urlmon

generic