corellaser 2018.02 .rar
- SHA256 6de17233b868efd524cf7b8f9d34f8bfbc1900b021038e3e8d29a583014c0604
Behavioral task
behavioral1
Sample
CorelLASER 2018.02/CorelLASER 2018.02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
CorelLASER 2018.02/CorelLASER 2018.02.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
CorelLASER 2018.02/lpk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
CorelLASER 2018.02/lpk.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target corellaser 2018.02 .rar
- Size 1.9MB
- Sample260801-wwj79sek21
- SHA256 6de17233b868efd524cf7b8f9d34f8bfbc1900b021038e3e8d29a583014c0604
- MD5 ae72a312f78d354b4715dc844556d65e
- SHA1 33ccd618b4d9a6dd21a0372f9617105e3312e55a
- SHA512 cd3f2b314b8806069c5b9191004daf55ebf9ea4e321a2fb735bea4e45c5d4240359afe53a427f2d788c3fed0f244eded95191bef74f3f053c80a0272c2994d74
- SSDEEP 49152:HZy32X6FdykG6hGG5e2BL+L/HRc0p+TaZJM6SOw2zs+wC+:W2X6Fdyl6hThoy0+ktSgcC+
- TLSH T12C95331856DF8D0193C29D3FB9F9B028D3918C9A34E7427B59CB2FD41E958ED03D84AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CorelLASER 2018.02/CorelLASER 2018.02.exe unpack001/CorelLASER 2018.02/lpk.dll - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/CorelLASER 2018.02/CorelLASER 2018.02.exe innosetup
File Explorer
-
corellaser 2018.02 .rar.rar 1.9MB
-
CorelLASER 2018.02/CorelLASER 2018.02.exe.exe 1.9MB
-
CorelLASER 2018.02/Manufacturer/EngraverSetting.ini680B
-
CorelLASER 2018.02/Manufacturer/Logo.bmp123KB
-
CorelLASER 2018.02/Manufacturer/Manufacturer.ini272B
-
CorelLASER 2018.02/lpk.dll.dll 47KB
CorelLASER 2018.02/CorelLASER 2018.02.exe
- IMPHASH 48aa5c8931746a9655524f67b25a47ef
- SHA256 7d9080ad05cd58933f0e47070d8f7c9a6321130ca4e30db8be699a5e5e64f58e
- MD5 0d87d9c8baf37688d71f6037c2107bd5
- SHA1 53d6a319af7830e94a4b545f1f08b7740e464845
- SHA512 4bbb00bb956eeeaf7a15617951d90690438a086b3c6b23f50a198bfef8073ad77cce26313fbe71344e8b56a121d5d883d61e491afff67a5143c056269d0d18ac
- SSDEEP 49152:FwoH3cWlxl1YPtVKgiG6ZbLxdX0jdwlTVlQvmOMkPh:SasWlxl1MijZbLT4WVlQvyS
- TLSH T1A0952301F3C3543AF4940938CC669060AE2BBCBD29E1B1362CB4DB4E55796D6ED7AB70
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Minor OS version
0
Major OS version
5
Entry point
62396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CorelLASER 2018.02/Manufacturer/EngraverSetting.ini
- SHA256 1e6269ab98e4d8cb7471ae2dd75f0b8755448ef4d946fbea6a5ea4080a41b7a0
- MD5 b1872cfbd103f4f5f98b7b011292a518
- SHA1 d2062efff4d6c9a14161e3ecdfce61309ca3afc7
- SHA512 0eb14b1c0cea9e127138f7f0e9d06ac1e079d7fd7d9071debcfe848380414e01fc5e151a0ee6ba0ee54bc2df93cd709cac64ace1ca48b1e78fd089ae3b2e7713
- TLSH T1F701FE485710470DC0745764ECFF410402DF118C0DD48A7DAC97084C9D9AE40143F45F
- MD5 SHA1 SHA512 TLSH
CorelLASER 2018.02/Manufacturer/Logo.bmp
- SHA256 bfe54dbcab9364a6d6761209a39e844b4aa90b5f4e089efab63d06cdfd5b672d
- MD5 09f18667e9d1964ac8c129058803ae09
- SHA1 b75966f785eaf10cb875ae65cfec7809f8c25b7c
- SHA512 bbe239ef17aff948c2e90f5df30e212abbb5201092b0f50b1ec27aad3a209a14b4108e4d6b8fe0d610e41db86f0a044a7452ec2e5a2a1d1a70b8f96e063f81bb
- SSDEEP 1536:OYZ5eORUYi5/n9fdWvQfazRdmfU2ozGnVlroqGWUBafs7A2sHan/Ik3p7/FN56Ka:FmFpH4JnYLiAD
- TLSH T16FC3916D4DBC119785096B8F58371ECC429AAE633CBDF08D9EDDF16EAB3EDA16011048
- MD5 SHA1 SHA512 SSDEEP TLSH
CorelLASER 2018.02/Manufacturer/Manufacturer.ini
- SHA256 5af95bcca1e5f5b157955383d0edc38075afe67f06cbd00b2abecf86623af19e
- MD5 1a111a1d850f2a7d9084fa01bb0399e9
- SHA1 d63a0a1359a3561dcce32d2190df9f249909ba92
- SHA512 4614f961ab5c935084a38cf2b8c8fcca9f1166799cf3081831f8be279d514a2adf34c37a6e136b53bcee5085d3b63f67ee53f862c8b7bbfe8a991f1ac6515406
- TLSH T13ED02B6B600005A16617877A202872CAF442362C6AD14C8BAC1CC18D381146CE65D240
- MD5 SHA1 SHA512 TLSH
CorelLASER 2018.02/lpk.dll
- IMPHASH 00c5fd00087020a0645079ce30f4148b
- SHA256 e5843c68039035de8844708786956a07d1469f75afb92373a28d9e93bb49bbf7
- MD5 08d2ae67f2007ff5f69fe3281d81412c
- SHA1 642b52c34e080e902f122c420b63061298bc0c9c
- SHA512 227be9db5c86156d457210f79447ca95d6f5a578bb86a10d9b4b8db0786e9109a7e340f0627383a52f1a8caf306397cbab7b4af32cd412ba22224ff66fb1affc
- SSDEEP 768:lojY9PXAum/U12tZAW/BXcTjX/O8KDbZS3n6yHEojY9Po:wmXiI2tZ7XqYZmn6yH1mg
- TLSH T1CF236A57EED540F2E02600B4317B9BBA99BB4C374B1F21ABDF51CD8E2C75250F622259
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
GetProcAddress
RtlMoveMemory
LoadLibraryW
lstrcatW
GetSystemDirectoryW
FreeLibrary
lstrcpynA
LockResource
LoadResource
SizeofResource
FindResourceW
CreateProcessW
RtlZeroMemory
CloseHandle
WriteFile
CreateFileW
GetTempFileNameW
GetTempPathW
GetLastError
CreateMutexA
lstrcmpiW
GetModuleFileNameW
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
GetCurrentThreadId
GetFileAttributesW
lstrcpyW
GetTickCount
GetLogicalDrives
FindNextFileW
SetFileAttributesW
CopyFileW
FindClose
FindFirstFileW
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
SetEvent
CreateEventW
DisableThreadLibraryCalls
user32
wsprintfW
shell32
ord64
ord92
shlwapi
SHRegGetValueW
PathFindExtensionW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
StrStrIW
LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
494B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=53, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,