MultiLuckywareCleaner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MultiLuckywareCleaner.exe
Size 549KB
Sample260810-texe6ahc25
SHA256 c5d48fff10f0ead8ab155474e1d202fddcea1d95ba36eac1138fb72fb2d02258
MD5 66d36f7c530fb47ccae61ca67bd710d5
SHA1 bf7de08b59a70312d3e3782f59db686501811b1b
SHA512 ad3d5347c5b75973ef89abaf7a2b6437eb72cfffd82162e6f5d795301e0028dc0bf6670a683d31058550b0c5c8ac3cb8b7bf3410dd30dbc40af317dfa5e6b0aa
SSDEEP 12288:HI3rYqVRaHnWnq7pHwGIZHJgUY0iGYluiFJIIXEee:HwYqVcr712JgUY0NyFJ4
TLSH
T1F3C45C1967A403F9E1B7C279CE524902EB7278494770A6DF03A045A75F27BE05F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MultiLuckywareCleaner.exe

File Explorer

MultiLuckywareCleaner.exe

.exe 549KB

MultiLuckywareCleaner.exe

IMPHASH 1a9623b28896233b8facedcdb910ed64
SHA256 c5d48fff10f0ead8ab155474e1d202fddcea1d95ba36eac1138fb72fb2d02258
MD5 66d36f7c530fb47ccae61ca67bd710d5
SHA1 bf7de08b59a70312d3e3782f59db686501811b1b
SHA512 ad3d5347c5b75973ef89abaf7a2b6437eb72cfffd82162e6f5d795301e0028dc0bf6670a683d31058550b0c5c8ac3cb8b7bf3410dd30dbc40af317dfa5e6b0aa
SSDEEP 12288:HI3rYqVRaHnWnq7pHwGIZHJgUY0iGYluiFJIIXEee:HwYqVcr712JgUY0NyFJ4
TLSH
T1F3C45C1967A403F9E1B7C279CE524902EB7278494770A6DF03A045A75F27BE05F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

221212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

StrStrIW StrTrimW

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

RegDeleteValueW QueryServiceConfigW OpenServiceW OpenSCManagerW EnumServicesStatusExW DeleteService ControlService CloseServiceHandle RegQueryValueExA AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegOpenKeyExA RegEnumValueW RegOpenKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree

user32

GetAsyncKeyState

kernel32

FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetStdHandle ExpandEnvironmentStringsW CreateFileW ReadFile GetTempPathW CloseHandle SetHandleInformation GetLastError CreatePipe GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObject OpenMutexW CreateEventA Sleep WaitForMultipleObjects GetCurrentProcessId ExitProcess TerminateProcess CreateThread CreateProcessW OpenProcess GetLocalTime VirtualQueryEx GetModuleFileNameW MoveFileExW ReadDirectoryChangesW MultiByteToWideChar WideCharToMultiByte SetConsoleCP SetConsoleOutputCP GetConsoleScreenBufferInfo SetConsoleCursorPosition CreateToolhelp32Snapshot Process32FirstW Process32NextW GetConsoleMode QueryPerformanceCounter LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI RtlUnwind GetModuleHandleW GetProcAddress GetFileInformationByHandleEx GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc GetExitCodeProcess FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP