antiluckyware[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
antiluckyware.exe
Size 7.2MB
Sample260810-whreesek8y
SHA256 710fb33858925411ad7cb1d9ad006783ae239bef4f06b3776c06397b1593df6d
MD5 8219af6af2b150fe6b8ffc695af2395b
SHA1 74f1c6cc24cfc4d5a776dcb11a9f7d9c0ac55775
SHA512 7cd885e0feb2a3f2d0761f0229f319056d1e1da9ada902c0dad839c6d808c0feff96fe3810ecce5d6deda16bb2f3f6f1bc4c731dae76e736e8a8f70bb17250d1
SSDEEP 49152:ODb1zpsmV4BrBqXhbqURrXR0AG2z6+Nf5A+azeQ0odtE6EMf9XP0BQpzIU6iFOTt:cps+XfNfroKZQ9/c+cb7Y
TLSH
T135766B12BB4A99ACD05AC4B0834686735A7174CB0B35B9FF45C896393F6AAF05F3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
antiluckyware.exe

File Explorer

antiluckyware.exe

.exe 7.2MB

antiluckyware.exe

IMPHASH 595307ca26d21666883123270f37a11d
SHA256 710fb33858925411ad7cb1d9ad006783ae239bef4f06b3776c06397b1593df6d
MD5 8219af6af2b150fe6b8ffc695af2395b
SHA1 74f1c6cc24cfc4d5a776dcb11a9f7d9c0ac55775
SHA512 7cd885e0feb2a3f2d0761f0229f319056d1e1da9ada902c0dad839c6d808c0feff96fe3810ecce5d6deda16bb2f3f6f1bc4c731dae76e736e8a8f70bb17250d1
SSDEEP 49152:ODb1zpsmV4BrBqXhbqURrXR0AG2z6+Nf5A+azeQ0odtE6EMf9XP0BQpzIU6iFOTt:cps+XfNfroKZQ9/c+cb7Y
TLSH
T135766B12BB4A99ACD05AC4B0834686735A7174CB0B35B9FF45C896393F6AAF05F3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

4229344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

antiluckyware.pdb

kernel32

GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter MoveFileExW OpenMutexW CloseHandle FindNextFileW ReadProcessMemory GetTempPathW WaitForMultipleObjects HeapAlloc GetProcessIoCounters GetModuleHandleW GetSystemTimes GetFileAttributesW GetConsoleOutputCP WriteConsoleW FormatMessageW DeleteFileW ReleaseMutex GetCurrentThreadId LoadLibraryExA SwitchToThread ExitProcess FindClose FindFirstFileExW OpenProcess HeapFree lstrlenW GetProcessHeap CreateEventW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler LoadLibraryW SetFilePointerEx CreateDirectoryW WaitForSingleObject GetStdHandle CreateMutexA GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime CreateFileW DuplicateHandle GlobalLock GlobalAlloc GetProcessTimes GlobalUnlock GetCurrentProcess FlushFileBuffers VirtualQueryEx GlobalSize WideCharToMultiByte GetOverlappedResult ReadFile MultiByteToWideChar ReadFileEx GetCurrentProcessId GetCurrentThread SetHandleInformation LoadLibraryExW SetThreadErrorMode GetModuleFileNameW Sleep CreateThread GetModuleHandleA GetSystemInfo LocalFree QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle FreeLibrary CreateWaitableTimerExW SetWaitableTimer GetFullPathNameW SleepEx WriteFileEx FreeEnvironmentStringsW GetLastError CompareStringOrdinal CreateSemaphoreW CancelIo WaitForSingleObjectEx ReleaseSemaphore ReadDirectoryChangesW GetProcAddress GetConsoleMode GetFileInformationByHandle GlobalFree LoadLibraryA SetLastError

oleaut32

SysFreeString SafeArrayCreateVector SysStringLen SysAllocStringLen VariantClear GetErrorInfo SetErrorInfo SafeArrayPutElement

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

CopySid RegQueryValueExW SystemFunction036 RegCloseKey RegEnumValueW RevertToSelf ImpersonateAnonymousToken GetTokenInformation OpenProcessToken RegOpenKeyExW GetLengthSid IsValidSid

ntdll

NtQuerySystemInformation RtlVirtualUnwind NtReadFile RtlNtStatusToDosError RtlCaptureContext RtlLookupFunctionEntry NtWriteFile NtOpenFile RtlGetVersion NtQueryInformationProcess NtCreateNamedPipeFile

ws2_32

WSAStartup closesocket WSACleanup bind getsockname WSADuplicateSocketW accept WSASocketW listen select connect WSASend WSARecv getpeername send recv ioctlsocket getsockopt setsockopt WSAGetLastError getaddrinfo freeaddrinfo

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

ole32

OleInitialize CoUninitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW DragFinish DragQueryFileW

user32

GetWindowLongPtrW RedrawWindow CreateIconFromResourceEx SendMessageW GetSystemMetrics GetActiveWindow GetClientRect ReleaseDC PostMessageW DispatchMessageW TranslateMessage ChangeDisplaySettingsExW DestroyWindow GetRawInputData GetClipCursor SetWindowPlacement ClipCursor DestroyIcon EmptyClipboard MonitorFromPoint IsClipboardFormatAvailable OpenClipboard SetClipboardData GetCursorPos MonitorFromWindow RegisterClipboardFormatW CloseClipboard MsgWaitForMultipleObjectsEx ToUnicodeEx GetKeyboardLayout MapVirtualKeyW SetPropW GetWindowPlacement GetClassNameW GetClassInfoExW SetWindowLongPtrW GetPropW CallWindowProcW DefWindowProcW RemovePropW GetDC RegisterClassExW GetKeyState CreateWindowExW ClientToScreen GetAsyncKeyState SetCursorPos GetForegroundWindow SetWindowPos InvalidateRgn FlashWindowEx GetKeyboardState MapVirtualKeyExW ValidateRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent MonitorFromRect ScreenToClient ShowCursor CreateIcon LoadCursorW ShowWindow RegisterRawInputDevices EnumDisplayMonitors GetClipboardData SetCursor RegisterWindowMessageA SetCapture ReleaseCapture SystemParametersInfoA PeekMessageW GetSystemMenu EnableMenuItem RegisterTouchWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SetForegroundWindow SendInput SetWindowLongW GetWindowLongW IsIconic GetWindowRect GetMenu AdjustWindowRectEx IsProcessDPIAware SetWindowDisplayAffinity GetMonitorInfoW DestroyCursor

opengl32

wglGetCurrentDC wglDeleteContext wglCreateContext wglShareLists wglGetCurrentContext wglGetProcAddress wglMakeCurrent

gdi32

SetPixelFormat DescribePixelFormat ChoosePixelFormat SwapBuffers DeleteObject CreateRectRgn GetDeviceCaps

shlwapi

AssocQueryStringW

uiautomationcore

UiaLookupId UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue

imm32

ImmAssociateContextEx ImmSetCompositionWindow ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmSetCandidateWindow

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

vcruntime140

__current_exception_context __CxxFrameHandler3 memcpy memmove memcmp memset _CxxThrowException __C_specific_handler __current_exception

api-ms-win-crt-math-l1-1-0

ceilf cbrtf acosf expf sinf cos sin truncf round exp2f __setusermatherr roundf atan2f _hypotf cosf powf trunc floorf floor

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _initialize_narrow_environment terminate strerror _configure_narrow_argv _get_initial_narrow_environment _initterm _set_app_type _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit _c_exit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale