sample

Sharing

Copy URL Twitter E-mail

General

Target
sample
Size 340KB
Sample260801-pkgvfaap4z
SHA256 6f1da6ac5027b612216ef6215465bc0cde7463a80a8f696e79b0b9d020a07b68
MD5 7744757b1121011f8b40350266702585
SHA1 1a968ec44f9f76b26dc59a586fa1d7842734d0c1
SHA512 1752f141670010042d54a5cf90ead3b03052257771c43f5c6be1e36a0109a9eb513fe4b605ac2e3a2f33da71c4d603aeca45f8187316ebad7cb1beaef158dce0
SSDEEP 6144:j7w4tzkISZY7PvmMAyDHQiJS5Ol7R0dVC4gnEZjLdQi1FUfH:74ZaPdXGsl7y3gyai1FUfH
TLSH
T1BD744B1BE2A3547DC2ABE034866357B2B471BCA81230BD7F56A4DB311D21D609B9FD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sample

File Explorer

sample

.dll 340KB

IMPHASH 132befe78645d0884ac8a227fc1d4c19
SHA256 6f1da6ac5027b612216ef6215465bc0cde7463a80a8f696e79b0b9d020a07b68
MD5 7744757b1121011f8b40350266702585
SHA1 1a968ec44f9f76b26dc59a586fa1d7842734d0c1
SHA512 1752f141670010042d54a5cf90ead3b03052257771c43f5c6be1e36a0109a9eb513fe4b605ac2e3a2f33da71c4d603aeca45f8187316ebad7cb1beaef158dce0
SSDEEP 6144:j7w4tzkISZY7PvmMAyDHQiJS5Ol7R0dVC4gnEZjLdQi1FUfH:74ZaPdXGsl7y3gyai1FUfH
TLSH
T1BD744B1BE2A3547DC2ABE034866357B2B471BCA81230BD7F56A4DB311D21D609B9FD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection FormatMessageA FreeLibrary GetCPInfo GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetTempPathA InitializeCriticalSection LeaveCriticalSection LoadLibraryExA MultiByteToWideChar Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func __setusermatherr _amsg_exit _close _errno _fdopen _gmtime64 _initterm _localtime64 _lock _mktime64 _open _pclose _popen _setjmp _strdup _time64 _unlock abort acos asin difftime calloc clearerr clock cosh exit fclose feof ferror fflush fgets fopen fprintf fputc fread free freopen fseek ftell fwrite getc getenv isalnum isalpha iscntrl isgraph islower ispunct isspace isupper isxdigit localeconv log10 longjmp malloc memchr memcmp memcpy memmove memset rename rand realloc remove setlocale setvbuf sinh srand strchr strcmp strcoll strerror strftime strlen strncmp strpbrk strrchr strspn strstr system tan tanh tmpnam tolower toupper ungetc vfprintf wcslen

Java_party_iroiro_luajava_lua53_Lua53Natives_getRegistryIndex Java_party_iroiro_luajava_lua53_Lua53Natives_initBindings Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1compare Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1dobuffer Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1dumptobuffer Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1gc Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1getfield Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1getglobal Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1geti Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1getmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1gettable Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1initloader Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1invokespecial Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1isinteger Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1isobject Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1len Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1loadbuffer Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1newthread Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1openlib Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1pusharray Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1pushclass Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1pushfunction Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1pushlstring Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1pushobject Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1pushstring Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1rawget Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1rawgeti Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1removestateindex Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1resume Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1setmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1tobuffer Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1todirectbuffer Java_party_iroiro_luajava_lua53_Lua53Natives_luaJ_1toobject Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1callmeta Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1dostring Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1execresult Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1fileresult Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1getmetafield Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1getmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1getsubtable Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1gsub Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1len Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1loadstring Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1newmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1newstate Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1openlibs Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1ref Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1setmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1testudata Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1tolstring Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1traceback Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1typename Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1unref Java_party_iroiro_luajava_lua53_Lua53Natives_luaL_1where Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1absindex Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1arith Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1checkstack Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1close Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1compare Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1concat Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1copy Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1createtable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1error Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1gc Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1getextraspace Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1getfield Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1getglobal Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1gethookcount Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1gethookmask Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1geti Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1getmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1gettable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1gettop Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1getupvalue Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1getuservalue Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1insert Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isboolean Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1iscfunction Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isfunction Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isinteger Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1islightuserdata Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isnil Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isnone Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isnoneornil Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isnumber Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isstring Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1istable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isthread Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isuserdata Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1isyieldable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1len Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1newtable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1newthread Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1newuserdata Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1next Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pcall Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pop Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushboolean Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushglobaltable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushinteger Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushlightuserdata Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushnil Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushnumber Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushstring Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushthread Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1pushvalue Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawequal Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawget Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawgeti Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawgetp Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawlen Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawset Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawseti Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rawsetp Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1remove Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1replace Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1resume Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1rotate Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1setfield Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1setglobal Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1seti Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1setmetatable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1settable Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1settop Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1setupvalue Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1setuservalue Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1status Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1stringtonumber Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1toboolean Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1tointeger Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1tointegerx Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1tonumber Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1tonumberx Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1topointer Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1tostring Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1tothread Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1touserdata Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1type Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1typename Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1upvalueid Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1upvalueindex Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1upvaluejoin Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1version Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1xmove Java_party_iroiro_luajava_lua53_Lua53Natives_lua_1yield Java_party_iroiro_luajava_lua53_Lua53Natives_reopenGlobal

Name

.text

Size

271KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sample

kernel32

msvcrt

generic