luau-lsp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
luau-lsp.exe
Size 16.3MB
Sample260728-eeattsxene
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
luau-lsp.exe

File Explorer

luau-lsp.exe

.exe 16.3MB

luau-lsp.exe

IMPHASH 3f8598ffe56eda61b40e2aa98e11b949
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112001

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\luau-lsp\luau-lsp\build\RelWithDebInfo\luau-lsp.pdb

dbghelp

StackWalk64 SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpSetCredentials WinHttpQueryHeaders WinHttpOpenRequest

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA RegSetKeyValueW SystemFunction036

kernel32

GetOEMCP GetACP IsValidCodePage FlushFileBuffers HeapQueryInformation HeapSize GetCurrentDirectoryW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetCurrentDirectoryW GetNamedPipeInfo GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent VirtualProtect GetCurrentThreadStackLimits InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce CreateDirectoryW DeleteFileW RemoveDirectoryW GetLastError GetModuleFileNameW GetCurrentProcess TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 CloseHandle GetCurrentProcessId VirtualQuery FreeLibrary LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadLibraryA RaiseException DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetModuleHandleA GetModuleFileNameA RtlCaptureStackBackTrace CreateFileW LockFileEx SetEndOfFile UnlockFileEx CreateProcessW GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler SetEvent SleepEx CreateEventW Sleep GetCurrentThreadId GetExitCodeThread FlushInstructionCache OpenProcess GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule RemoveVectoredExceptionHandler GetFileSizeEx ReadFile SetFilePointerEx WriteFile RtlUnwind FindFirstFileExW GetFileTime MoveFileExW LoadLibraryW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx ReadProcessMemory SetLastError SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime FormatMessageW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection IsValidLocale GetLocaleInfoW LCMapStringW VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable WaitForSingleObjectEx SwitchToThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetSystemTimePreciseAsFileTime InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW GetFullPathNameW IsProcessorFeaturePresent GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc HeapFree GetTempPathW IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW

shell32

CommandLineToArgvW

Name

.text

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

631KB

Virtual Size

630KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

luau-lsp.exe

dbghelp

version

winhttp

advapi32

kernel32

shell32

generic