Application[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Application.zip
Size 904KB
Sample260805-pffftafl9x
SHA256 dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b
MD5 630f428bf3c25dfca46e91edde334342
SHA1 f6a648b2c8b097248f7d25af322b91607fc8fae2
SHA512 03a4e9748f66d10de4aaf698c62d313f0d498bfce2ddb4701487631b4c15a24b4a00d02508246d0f97a9acd8fd7afd804d074cbfae085e4e68d7333e8f035938
SSDEEP 12288:XBE/nJIRs2wv8s7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S4:XGRADwkc/u/7IoRnUKfq1Dl4DYt
TLSH
T1E215AFC0F5C241F2E6E611718476DE36463E3D2187028CEB7798BAF55E305D0A637AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lua.exe
unpack001/lua51.dll

File Explorer

Application.zip

.zip .js 904KB
Launcher.bat

2KB
config.txt

.js 220KB
lua.exe

.exe 89KB
lua51.dll

.dll 592KB

Application.zip

SHA256 dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b
MD5 630f428bf3c25dfca46e91edde334342
SHA1 f6a648b2c8b097248f7d25af322b91607fc8fae2
SHA512 03a4e9748f66d10de4aaf698c62d313f0d498bfce2ddb4701487631b4c15a24b4a00d02508246d0f97a9acd8fd7afd804d074cbfae085e4e68d7333e8f035938
SSDEEP 12288:XBE/nJIRs2wv8s7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S4:XGRADwkc/u/7IoRnUKfq1Dl4DYt
TLSH
T1E215AFC0F5C241F2E6E611718476DE36463E3D2187028CEB7798BAF55E305D0A637AAE
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

lua.exe

IMPHASH d0264e200554ef617c521261fe8fe2a4
SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
TLSH
T1FC935C00F5D2D071D5B3593558B5DAB04A2EF9311F259FAB339813AA4F301C19E3AEAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

lua51

lua_gettop luaJIT_version_2_1_0_beta3 luaL_openlibs luaL_traceback luaL_newstate luaL_loadbuffer luaL_loadfile luaL_where luaL_callmeta lua_sethook lua_concat lua_error lua_gc lua_cpcall lua_pcall lua_call lua_rawseti lua_setfield lua_createtable lua_rawgeti lua_getfield lua_gettable lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushstring lua_pushlstring lua_pushnil lua_objlen lua_tolstring lua_toboolean lua_type lua_isstring lua_insert lua_remove lua_pushvalue lua_settop lua_close

kernel32

TlsAlloc DecodePointer ReadConsoleW ReadFile WriteConsoleW CreateFileW CloseHandle HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType LCMapStringW CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW SetConsoleCtrlHandler GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc

lua51.dll

IMPHASH 9466a71df1d3a59794f8605626534abe
SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
MD5 3dff7448b43fcfb4dc65e0040b0ffb88
SHA1 583cdab08519d99f49234965ffd07688ccf52c56
SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
TLSH
T162D4BF41B6C3C0F2E5E21171047AAB760E3E2D114716CCEB97E439AD8D346E0B6776EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

343186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetLastError VirtualAlloc VirtualFree VirtualQuery VirtualProtect FreeLibrary GetModuleHandleExA GetProcAddress LoadLibraryExA FormatMessageA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep CreateThread RtlUnwind GetModuleFileNameA GetModuleHandleA IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile CloseHandle DuplicateHandle CreateProcessA GetTempPathW QueryPerformanceFrequency MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetStdHandle GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW DecodePointer GetACP SetFilePointerEx GetExitCodeProcess GetFileAttributesExW CreatePipe CreateFileW GetTimeZoneInformation DeleteFileW MoveFileExW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle GetStringTypeW HeapSize HeapReAlloc WriteConsoleW

luaJIT_profile_dumpstack luaJIT_profile_start luaJIT_profile_stop luaJIT_setmode luaJIT_version_2_1_0_beta3 luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_execresult luaL_fileresult luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadbufferx luaL_loadfile luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushmodule luaL_pushresult luaL_ref luaL_register luaL_setfuncs luaL_setmetatable luaL_testudata luaL_traceback luaL_typerror luaL_unref luaL_where lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_copy lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_isyieldable lua_lessthan lua_load lua_loadx lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tointegerx lua_tolstring lua_tonumber lua_tonumberx lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove lua_yield luaopen_base luaopen_bit luaopen_debug luaopen_ffi luaopen_io luaopen_jit luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

Application.zip

Launcher.bat

config.txt

lua.exe

lua51

kernel32

generic

lua51.dll

kernel32

generic