lol1[.]exe | Triage™

resource
lol1.exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

lol1.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 ba113d03b400c41c0aa82764c5f5d1f75980f9ef89b604ee05750bd70f8c4cef
MD5 4907080634fa30ebf188afac8e0ce2a1
SHA1 8802db78eb10c94c8a114d734d90a74e346de5f7
SHA512 a644290b15ae903629728ca5fbddd53b4447955aae9eec4d16be9fe383dd83525695abf37000dd721554efaae58db7d7d9624eb96262b2659f083ff96f4e9f6b
SSDEEP 24576:tGATyazcBQEXWAmus7+tYORGQui2SqrTAZ7QnksbFxr+kRqgiMNRBT7JowlhEMCw:s+c7D2ORgXowzbb+kRTlXBFn3CJ2Mq
TLSH
T16E9533CA59A49823CCA14A3478F40649835BB5051972DFDB8F1ECF9D3982A03D1FDBDA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fb:5f:f6:75:fa:16:21:26:ec:fa:e1:8a:e1:ef:c1:0c:61:b1:c0:fe

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Chains

Jun 25, 2025

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=Kakao Corp.,O=Kakao Corp.,L=Jeju-si,ST=Jeju-do,C=KR

Serial Number

0f:3e:b9:ec:f3:77:90:50:22:07:bb:64:11:44:c3:d6

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2025 - May 14, 2027

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
TLSH
T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Birth.wp5

SHA256 95c0db3f551ddf35a86b640955cf6153c3cd0032421c74816f8db1b22d9bd7b6
MD5 b1a9277e01ed5452fc345063c473fd33
SHA1 fb75a6d6d9c36ca8be8106713940ac3436f314e9
SHA512 b86bb8628e4f07a863edc8b7e5e11c477bf65c51541fbec4f44d37e092c352720fa26be7d183fd6442515619a8b8d985eab325957a18de04f656086d76fa18a1
SSDEEP 6144:T1BoIHAicUeGosFAAB+DH9AND8No1UNeSzrAX2u:3oIH3cUeGHvB+DH9mDlUNBrAXv
TLSH
T12C2422A9B5D4DA34239F68F0256D06618A826A297AC3FD28C301BD2E05C2D5DFCCF177
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Deaf.wp5

SHA256 0591d84b28d4b907aa76daa2ac8d5f6fc1d2acdf7ae66efa14ec1b4e41940ac7
MD5 9993919d3828164c86ed7b5d7821e8ca
SHA1 e8cf27ee0bfd80ab014cd4c37ac628c5203a0441
SHA512 388a230dc266e63fd8e654997b9d9ed513ddf66309606e71fa73333cd097c1bea320bc5319f705b1ec14a93f0111ff7b8d79a6beacecb37530073ad9e2f3401e
SSDEEP 6144:Cu59B5TQQ4fwC6itU4RH7UxbtfNvRUCfF6/hHcq6tUK:R5ZQQ2r6it51MpfNJUuFC5D+UK
TLSH
T1CA54231E305D3134FF8634FF876A7352404A74EB620167743BFFAA9A378D62610EA916
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Division.wp5

SHA256 61886facc3289b35e5912b8d0dff2551a34b106607bfecb5091340ff2959c335
MD5 09ac5cc288e5a8e4b12c23785759c41d
SHA1 cc2fc87d778bcbbbe27726fe8987f08531ea0d88
SHA512 65a1a707970cea9c908cd20a784913956bfb82db955752d1514a557a4b3c396118f2e0b8c28da5a47529fcb6973a375e0e2b70c3acefd72c4e0c22c9a5fc23dc
SSDEEP 6144:D00FK8S8AKIH77jMwwFZAiqDnZBFjEjb4LKEAN+2sETZiTG0:D0QK8S8AtH7P5+AhZ836DM+STITG0
TLSH
T16154233BB0EB99DA631B3135D89B57CF56FDD93895C00324327AA31A23C60E01E55B6E
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Forgotten.wp5

SHA256 c463d0f7d74e1b09cbca26186979149406e7ae66b5721814d13567b3109a8c85
MD5 93bb40c5b85b1baabb5fa8ff19111832
SHA1 c5ae6bbbf27ff77a5459448df553acca9395eaf3
SHA512 43079d43712f2a585a3236454add3e279a00d3ef134570ff066adfca45065e09d3858fbd6cf67da352d5fdabf4c572fca0c29bd187478ded08b73e2593097898
SSDEEP 12288:+3lm7zn3nHGD3VxcykG26JJ5xI82yNIzJHnG2a5kZHNfIZ:+q3HQ3/clGG82yN0Hh5jo
TLSH
T14EC423C011BA77EF7CDC35FD1ED538C52F92EE84149487076A18B43BAE9CA95E0620DA
MD5 SHA1 SHA512 SSDEEP TLSH

Fiber

SHA256 99e66f4fe71551e1d68c888a79d9102538e012142a6dfcf8f48d25029759fc7b
MD5 5de5eb31be024ef3ec97b8a262a1287f
SHA1 3c5aa4c74f1c8dce846773b12dbe7360d339801c
SHA512 98c4141a72850995d2903c97189a2f0d19075c55664c4d7233a8c27324bc5c3e991386ed7bee279d936567e937bb8c6921a53edd8a0ecd6cdb0af3dba2b5acb9
SSDEEP 3072:KKenii0yD1LoanUveooL4x7KBgtEnsjAZNL1iZ:K1vRBHPoon8
TLSH
T145A37C59A16451AED1AB9075CE2DCF07DAB6348E3A207F2F03B00B521F23E81679F657
MD5 SHA1 SHA512 SSDEEP TLSH

Founded

SHA256 aad01dd8c51ae79e33f7d62e0ee7a80538af115121b1a24b02ebd2badc8f0012
MD5 91b33bd92c1d7c7684a8de9badf37d2d
SHA1 6f3f1526dc4c4e494d9e8fb4a58617348bb07649
SHA512 ae37af053af778aae9009ac4216b3be273fe7f9747d179ce35fbdf317e815a8218575004a4b3e87ceb6880f11528439d0710275af58b2b63c37d7b1feb904586
SSDEEP 1536:0EfGxfPkDiHyvlHFLppp14wJCybMj+rJSYB8G2tTSM+KzxwWGV:0EfGxciSvbDb4wo36sVtT61
TLSH
T183737B4A32B841EAC56BE025C603E51BDAF1BE4A0638C797D199EEB71F43B71186F704
MD5 SHA1 SHA512 SSDEEP TLSH

Goal

SHA256 d45e64dfb41fc2bdbea176085745676eadd88b5dfc08e7038289d3a300012b0d
MD5 9760ccd5c7b01e309c799690ed5ef7f2
SHA1 782cc24f1c04f9626fc201b2af9dc26ba5afa1b6
SHA512 340b83b40199367fc477dc3aae8b71ccd3934c3294eea62293f710845a2ada72e6ffac75f64e4c1fd39c66bcfab479b84504c56a83b84b4e70a3407346795555
SSDEEP 3072:d04k5h6m/Fy0UhMsqu5OonZkFNrsjeinlsgIhf:MZ/FfUhMsqu53mFxsjeilsgIhf
TLSH
T12BB33AAA32B482D9EDBEE061C613C50BE3F1B84687F9DA0F03BA5A561F13771552E311
MD5 SHA1 SHA512 SSDEEP TLSH

Holmes

SHA256 31b8796a1dd64cf96256e1e9c33cdb5d7f2b88865855f3315b37b0965b617577
MD5 5abfd424c381c12773a371cacb724ea7
SHA1 df57e89287b6bc9151713c9619a9c47f738bdb3d
SHA512 60fd8e621be9f10246103f89519b08c55518cc7b5dc0fc3806565b83a14af4868e2ec22d95f585d8dea13acd8fba26bf49b3b332093a319e740de121ebef6d4a
SSDEEP 1536:kh50sYpwy8c1BY/6Qaa2W+GOq7owMa4IY1GsCPeFmHz1vNq8S4pG+3DY0kkraxjt:kR1yciPWprowM3Qm23DjOH44
TLSH
T140934A1DB1F620E9C872BAF08F99C0D9D7B2F82612B14D3F51E4991B8FA3A205E15774
MD5 SHA1 SHA512 SSDEEP TLSH

Illustrations

SHA256 78872def2c20e30a25dab297af5b4c6e454ad7b963d8e6c602e4ba2a124b5b20
MD5 17ad7f11f2f7f5bb5b11afc371d2ed28
SHA1 3345d558f58c37ee239c0924b5bfdcd107cf90c9
SHA512 6977b8caf94981b96b84b10ddccd8b4f9cb6cf47bcfcbd445db5dd93dd11f8a618adea92d684b9a6a67d49c51c7b5e05591011a6f0296ab483b7003b3d2ae8bb
SSDEEP 1536:zTCUXIH42r7snyuXG5egqzIU15AG73prFC0:zZ4trwnNX51ztp
TLSH
T1A6737D5966A060FF91AF9175CB9D4C0BE3B2BA851710BBDB02E14FE21F27F80125E356
MD5 SHA1 SHA512 SSDEEP TLSH

Instructor

SHA256 6136434b86453046c3066802fcf9fa05ad139aaf7d332a1683c25af765c5c07d
MD5 a6a1a2d8044d660c3cbade354ac2765b
SHA1 4c9974f0f34227bff9bc10a40abadce821a0af8b
SHA512 c1794baac813266c3fd2ea2d79b6651baec6a5427a8504a5a1ed4e31546ae9609efab1799c66a20c44bc40e4bacb153d57b5dbcf577bfc18afc14d0389de788a
TLSH
T149217ADF47CA8CE9E9BC05B5C565438A3035B6BCE31B4E822FB8011AAC3E114DBAC419
MD5 SHA1 SHA512 TLSH

Li

SHA256 92e61d61d9cb004bec1e94bab872814df3995703c75f3d318f9385b9e1581ee3
MD5 6c15aa19d63562d7b12d6e3980c29f37
SHA1 f086b661f7ed660c162fd34e55284af936746f5c
SHA512 2632ec10a12003d1231eb67ed0571351885a0c1d622d40d79cad11798cb5a5dec831561bb543b855b20e408e23abf6c0e3cc67006b1f922a83699c0fd5cbec88
SSDEEP 768:oewwwQ/V4cBsOlZcETgKxp6+592mcvm4IY1yhsTr90zOZiQrRwjbb+gchN2gdbjz:o1wwQOchO+534IY1GsTrkerRIb+cgbrF
TLSH
T149634AD776164D4BC233873C55A29FF11519460013752DBE0E26AA593FAB2CBEB3CB82
MD5 SHA1 SHA512 SSDEEP TLSH

Lol

SHA256 91b8fe6fc501b46bfe8689b7c6e35acdefce257f3d25f78f39768eb8311202da
MD5 32dc2a49b94f941bf8485dccce2c9c96
SHA1 8c42abbe651f89bbffcc650b723d93674e61582e
SHA512 4aff6922495268bde27ffb1803a5b2d1388456cfc6ed40d0070969d9601a47d64a6af1bb3325ef8b340216085e934cfaab72167ae511f98c11abedc8bcccf8a1
SSDEEP 3072:DrVUhijUvlgTRMsKz50/0DIPEXbeTjDiNyR:fVUaUviTRS505EXoiNyR
TLSH
T1E6C35A02B9A604DCD62FE4346807E90BFA31FC19053DCD5BA1D09803EF57B616B6F2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Lovely

SHA256 279d917d137983a5601b566c74ec0add5204bd94f251427b6993f19aacb2f465
MD5 0803fd4f01aa8b89d9c50071a2444daf
SHA1 478dea24b5a02495e5080b5d85deb4feb97da882
SHA512 f4cf9deeb7ee6cb849cd0d66413cbad0f8fe564cb6cb67f0bb069be380f615b0f035e413c0b161deb3de9a3f9a6fd433a778ca758b4447a58ab643f34c051b0e
SSDEEP 1536:zHol9dlefIQu5aAwurPtRB6j6rs84dvTcAXjKd1bV:boVcfIHaAtrPzw6uId1bV
TLSH
T1BBD3710463B486AAFFC7E5BB5792C20547F96A9E9943412F582077B6BC307B10F7D821
MD5 SHA1 SHA512 SSDEEP TLSH

Serum

SHA256 a768f182e79cd52aa7a77e9851b9fdd83a262fab973c5d1a4795d71f488b2da5
MD5 8ebb6698a22f0ba996d86676dca78817
SHA1 91f1b534138e7916a147ab4a263845e7ddf4e22a
SHA512 ad7d92ccf137e7c2870a011b77590ddcd48593bcdd878e7d3fd8193444b603eef2262dc98726271d583d18afa75a5b835796a16ccb255e47b8d0d0a302e50f08
SSDEEP 1536:EN9KnmT1cg3ZDctGbKBXkWj4upDK9q4Dw3c61RG31Izxsmx:E3kmTmwZDgGbDHVAc6jG31IzxsU
TLSH
T1E6A33A593AA843CCD4BAF571A613C50BE3E2BC0587BD9A0F12BE86521F67723741E315
MD5 SHA1 SHA512 SSDEEP TLSH

Vermont

SHA256 f0bc4f419cb83b93f3287784b63d3d70a397287571e8c5608c56acc2c1bbf958
MD5 3f902777703de115ac94ae51b1a0971f
SHA1 87da880a49396210f224f5206c7a45b5862b4e24
SHA512 1f3fa961f2d115e5b233602b783276feda02fd4a18e885e83db861d34ae73f53f7483377c35a531bca1ab1e7408267d678a1aa8d9a8072b7aae95cede44b910b
SSDEEP 3072:kwQGq/hoVRgNkSXF/U8QCgh+qLzxc9TvNU7Dq:3rq/hoVqkSXFsczqkC7e
TLSH
T1F2C3AE6663B511BEC1AB9136CD066617E73278070774C7CB03E68AB62B237E11A7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Wed

SHA256 583406aa64ac7b959698b237854d7c14fcf89679632b24e2c636394460e57129
MD5 89b201f9a669b956ce0ba91394156a3a
SHA1 7c728f25d3bda639ab326175da012c8806a6aed1
SHA512 aee94b8d8d6849b225fd69290cca79d95bf7b0efa865b7659f53ad36fc94408a3def3f1935759f54b52687246e60d0a47beef9e026f77b492e913cfcea49a8fb
SSDEEP 768:uOgjcg9Qkw7s3T3Xr63EYr8qcDP8WBosd0bHazf0Tye4Ur2+9Bkk2TalOSVWV9+k:BoZwknr63EYrDWyu0uZo2+9B4u0SQ
TLSH
T154837F539A992347E0B3BA30B4AFC73F0A207C5F5B74B9BA031D3F0EA825A505A55331
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Light.wp5

SHA256 aa7fe932861091aba0c7345cbd9edafccdf70134642c36ce6092b6f9cedc3cf4
MD5 c770781f08b4fe5a64ea1b4ebb2edc9d
SHA1 8319495206df7d2f9cd6321e438838a7d279ad38
SHA512 0be6c6c28bcd149a1c31fde22e73ae9683b551429558a205dfcddc76b9342424b67c2f03a1ae98dabbdec5071798c3e1e073c165ab2fe421885c90c7f2ee16b3
SSDEEP 1536:AYoQTnNMzscrL44gEzdrCkpKyzKOqYNHZMT:fZTNMzscrLlgElCkYVSXk
TLSH
T130330203438799F5D0508A72169DEA0F53AC6256FAF610C849F17E81CF2941FE68D7BE
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Promoted.wp5

SHA256 60736e20dbfdb205797738b63626a02f4bdf4471d2b7c038001fd1430d4ff6d8
MD5 52cad60db48b24420877f5dbabf83a4b
SHA1 1c0d2e5b4517b3322936324058d71c4700017655
SHA512 296c53c7587dff43d9dca4125f5ccabd97f5d1d6d1c37ec58d780d6ed7627bb3f09b3df68f6b683f97ff47daf110da329755cc9fed3f7c2ff59ca821a3d31192
SSDEEP 384:QWa6z36EOGkiYi9x78oeYmT8GF1h9xFjdxo9g7:u6BkiYi9x7reYW8GF1LxFjdxo9g7
TLSH
T13B6239F866C912617776F663ADD08E0AF972D11B2A02115A7EFB16DEC005E0C5B338F5
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Reseller.wp5

SHA256 b5572e549dbb6687d4aceb993125701bc4798ef026a7fb84a9c1c93ea78f0933
MD5 737800f1eb7da98b15c6f8f60bdd03c9
SHA1 0920be50cbcfbda9d974e81147148794a21cbf9c
SHA512 dbef67910ccf77e9b8492bd974128b2e17e973dc6da3ccaa64f680bde787f070efd6cb9b539d093388dac3db9239ab993cb4e51c8da869a0a06c31454d73ca36
SSDEEP 3072:V954/snx1Ir0+OqLQVLkNb/E6zRW54XJNN6Yfvv6xeFrIEHSdtN2Rv:mgx1ZhNQNb/LRjJbHyAdybNqv
TLSH
T149B3136955CB878A4C7001512BCDAED93D39B02E32E46728F23B5D2627DEF4A71B844B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Scene.wp5

SHA256 43e9c5377f9507c7a76cf5138390c46c217957fc1c8d8e50d3b22977c20b785d
MD5 19d640ef695b5298560c8396cafc4a8b
SHA1 6117d1cb9ef771c404b57e8ec0a6a02e9286c719
SHA512 f04a9d98d47118a5843ff7a42267cbcbd24f659ecef346e0a495493116c244c27bbd5fa8742412b6318c192853c586b2783a7653013330d53f849e3c00da629b
SSDEEP 3072:sghI8SIa/xnEh6O0comyPsmk/MnR4GGD/bSY7uGOSv/a8oPdqxirgmhAaNAIuTm8:sghr3ahWrm+M+D/uYiLS2QegmhAaNAIC
TLSH
T14B0423165134AC24FC2C6AE35655DBBC50164AB388C7E373CDB82A60EC7BDBA450D47B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Str.wp5

SHA256 21edf4278e295084d89c994e94b2118bdcfe8efda1b341c892c7628ba2576f12
MD5 45c2ecfe0fd27a781b2c3dd49d368e50
SHA1 9c3af98f6c225207989b54cdc5f28200530df164
SHA512 cb61e849b862c149e9560b2fff7d86f7cc081846004b6ea1ae6f065c80c99d186dd238d87b881a1f792aee5fa081b89e4b65c4179bde4fbd8b2fc2ff79ab20cb
SSDEEP 3072:q7L6SnKZEOSYQIwUCfd/qDHcl43Pq4oglSZtywdwKa1uQTxe/s85aHjf:q7LZnKhSuwU+/qD84yDXywJLQV9iaHj
TLSH
T1D3141383B62045BC3A0C1171A0CDC50725F15BB8D7FA8890D2B6BF7615E8A91E56BFB3
MD5 SHA1 SHA512 SSDEEP TLSH

lol1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Birth.wp5

$TEMP/Deaf.wp5

$TEMP/Division.wp5

$TEMP/Forgotten.wp5

Fiber

Founded

Goal

Holmes

Illustrations

Instructor

Li

Lol

Lovely

Serum

Vermont

Wed

$TEMP/Light.wp5

$TEMP/Promoted.wp5

$TEMP/Reseller.wp5

$TEMP/Scene.wp5

$TEMP/Str.wp5

Sharing

General

Malware Config

Signatures

File Explorer

lol1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Birth.wp5

$TEMP/Deaf.wp5

$TEMP/Division.wp5

$TEMP/Forgotten.wp5

Fiber

Founded

Goal

Holmes

Illustrations

Instructor

Li

Lol

Lovely

Serum

Vermont

Wed

$TEMP/Light.wp5

$TEMP/Promoted.wp5

$TEMP/Reseller.wp5

$TEMP/Scene.wp5

$TEMP/Str.wp5