Copy of LLTweaks Macro[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Copy of LLTweaks Macro.exe
Size 1.5MB
Sample260720-tddxeshs3x
SHA256 2adb86c6ce84689cb71e62bf4dda4a77106ee3fbddee605435a9bf54785c928a
MD5 10ab4807a7a40b1977081bb6f855417d
SHA1 9cbb3b89cd82d31d044a0d2b248ea1a826fd96c4
SHA512 a2dbf0e579e1df628bdffa920c1c3780bb1e71712359038b4837e7ad7a776c23f8fcac6a2906fe9d8637adaf4ce29aac65439d257a8494e58f4de038601a3a6f
SSDEEP 49152:h1FYwNeesf/OnCQiOhZM45hN9xyDWcLunMGdp:GwMyiOhZM45hN9xyDbbA
TLSH
T1D075AF57F3A501FED0AB913C91079207E67134192320DBDB27D98A692F53BE1AE7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Copy of LLTweaks Macro.exe

File Explorer

Copy of LLTweaks Macro.exe

.exe 1.5MB

Copy of LLTweaks Macro.exe

IMPHASH 0e222cb94854d4b01b38176e6dc8afa9
SHA256 2adb86c6ce84689cb71e62bf4dda4a77106ee3fbddee605435a9bf54785c928a
MD5 10ab4807a7a40b1977081bb6f855417d
SHA1 9cbb3b89cd82d31d044a0d2b248ea1a826fd96c4
SHA512 a2dbf0e579e1df628bdffa920c1c3780bb1e71712359038b4837e7ad7a776c23f8fcac6a2906fe9d8637adaf4ce29aac65439d257a8494e58f4de038601a3a6f
SSDEEP 49152:h1FYwNeesf/OnCQiOhZM45hN9xyDWcLunMGdp:GwMyiOhZM45hN9xyDbbA
TLSH
T1D075AF57F3A501FED0AB913C91079207E67134192320DBDB27D98A692F53BE1AE7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

977256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Güncel\Documents\Macro\x64\Release\LLTweaks Macro.pdb

vigemclient

vigem_target_ds4_update vigem_connect vigem_target_ds4_alloc vigem_alloc vigem_target_free vigem_free vigem_target_add

interception

interception_is_keyboard interception_set_filter interception_create_context interception_receive interception_wait interception_send

kernel32

EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW GetFileSizeEx GetModuleHandleW GetModuleFileNameW GetCurrentProcess CloseHandle CreateFileW GetProcessHeap DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc GetLastError GetTickCount64 Sleep HeapSize InitializeCriticalSectionEx GetStartupInfoW IsDebuggerPresent WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter AcquireSRWLockExclusive RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId SleepConditionVariableSRW HeapFree QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar VirtualAlloc VirtualFree FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA ReleaseSRWLockExclusive InitializeSListHead GetFileInformationByHandleEx AreFileApisANSI OutputDebugStringW GetSystemTimeAsFileTime InitializeCriticalSection FormatMessageW SetLastError RtlVirtualUnwind GetFileAttributesExW

user32

SetClipboardData GetClipboardData DefWindowProcW DispatchMessageA GetWindowRect VkKeyScanA ShowWindow GetAsyncKeyState GetWindowLongA MapVirtualKeyA MessageBoxA MoveWindow TranslateMessage PeekMessageA PostQuitMessage EmptyClipboard CloseClipboard GetKeyState OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect

advapi32

CryptReleaseContext OpenProcessToken CryptEncrypt GetLengthSid GetTokenInformation CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextW ConvertSidToStringSidA CopySid RegCreateKeyExA IsValidSid

ole32

CoCreateInstance

sdl3

SDL_GetGamepadName SDL_free SDL_OpenGamepad SDL_Init SDL_GetGamepadButton SDL_PollEvent SDL_GetGamepads SDL_Delay SDL_Quit SDL_GetError

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ??1_Lockit@std@@QEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

ws2_32

gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen getsockopt htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt WSACreateEvent recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton send WSACloseEvent WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents

crypt32

CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertGetNameStringW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception memmove wcschr strrchr __current_exception_context memcmp memchr _CxxThrowException memset memcpy strstr __std_terminate __std_exception_copy __std_exception_destroy strchr

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free realloc malloc

api-ms-win-crt-runtime-l1-1-0

__sys_errlist __sys_nerr abort exit _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _beginthreadex _resetstkoflw _invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_narrow_winmain_command_line _initterm _initterm_e _exit system _c_exit _register_thread_local_exe_atexit_callback _errno

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-string-l1-1-0

tolower strncmp strcmp wcsncmp _wcsdup strncpy strpbrk strncpy_s strcspn _strdup wcspbrk strspn wcsncpy strcpy_s

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vfprintf _read _write fputs _set_fmode _fileno _close ftell fseek fgetc fwrite fread __stdio_common_vsprintf fopen_s _lseeki64 fclose fflush __acrt_iob_func fgetpos __stdio_common_vsscanf fputc setvbuf __stdio_common_vfscanf fgets _wopen feof ungetc _wfopen _get_stream_buffer_pointers _fseeki64 fsetpos

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtoll wcstombs strtod strtoul atoi

api-ms-win-crt-time-l1-1-0

_localtime64 clock _gmtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlock_file _lock_file _unlink _wstat64

api-ms-win-crt-math-l1-1-0

pow logf fmodf _fdopen cosf _dsign sinf __setusermatherr ceilf acosf powf sqrtf sqrt

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func