Leno Free[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Leno Free.exe
Size 16.4MB
Sample260819-ee4rxawdmb
SHA256 d17d25c427d7ee344ae086d502b637d50aa08a58246c8b81cae5f9c8352da570
MD5 cc32f7d5b5438c4e36633e50617f4422
SHA1 fd32859ffbdbf549532e1e96d95bfc8e36eb6200
SHA512 433d2007b222e01ac107fb5c044e208f081500faf0e707ae81542726eda0c145e5d257df5681770773d0a9630e451e74b8f85cc5f6225626ad1ab2944459ef68
SSDEEP 393216:UMELI+FXfVtfMoIH5gQNw2dpee9migNiK+T:SdFNtfMoIHeew2p7NgN
TLSH
T1DD0723C33BD5D1A8C4C3461466C36BD920E9B69A52BA891D3ECF58033A64F1BCD4D6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Leno Free.exe

File Explorer

Leno Free.exe

.exe 16.4MB

Leno Free.exe

IMPHASH fb03c18f731f7a1eaf08b5e88181b47e
SHA256 d17d25c427d7ee344ae086d502b637d50aa08a58246c8b81cae5f9c8352da570
MD5 cc32f7d5b5438c4e36633e50617f4422
SHA1 fd32859ffbdbf549532e1e96d95bfc8e36eb6200
SHA512 433d2007b222e01ac107fb5c044e208f081500faf0e707ae81542726eda0c145e5d257df5681770773d0a9630e451e74b8f85cc5f6225626ad1ab2944459ef68
SSDEEP 393216:UMELI+FXfVtfMoIH5gQNw2dpee9migNiK+T:SdFNtfMoIHeew2p7NgN
TLSH
T1DD0723C33BD5D1A8C4C3461466C36BD920E9B69A52BA891D3ECF58033A64F1BCD4D6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22371112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AreFileApisANSI

user32

SetProcessDPIAware

shell32

ShellExecuteA

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

imm32

ImmReleaseContext

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

crypt32

CertFreeCertificateChain

ws2_32

WSACreateEvent

d3d11

D3D11CreateDeviceAndSwapChain

winmm

timeBeginPeriod

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

ungetc

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-math-l1-1-0

sqrtf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-string-l1-1-0

wcsncmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

advapi32

GetLengthSid

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1}$

Size

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.@?3

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.7WQ

Size

16.4MB

Virtual Size

16.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

673B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Leno Free.exe

kernel32

user32

shell32

d3dcompiler_47

dwmapi

imm32

msvcp140

crypt32

ws2_32

d3d11

winmm

shlwapi

psapi

wintrust

dnsapi

userenv

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

generic