DiscordLookup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DiscordLookup.exe
Size 986KB
Sample260822-sdw8bsfd25
SHA256 1599c9215aa9c0e6ccbdb2a7b19ea97f1da2836716b936029fbcbdb7ee981fba
MD5 82d4b4675d3a27e8c297191e795538e6
SHA1 790e1f53fcf3f9183b8f2bb1b36fabcbbe6a7261
SHA512 d5409aab6b88ed6fa0fe43f16d5aa9dcc5833832841f51aa7bfb87bfceb6c15abd200c76c39803ef5f4b26882aa9bfe4d7dbf7aa215c3693cc99ce3c603ff3b9
SSDEEP 12288:0y+qSDlFukjZoc2TPDupdPQxE/1w5bWEmatnCuXfpYHN7:Z/ctLp9nEmatCofpYHN7
TLSH
T12E255A47B3E48EEACC5A663994DB2709B734FCA017939AC7571042315E03AE98E7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DiscordLookup.exe

File Explorer

DiscordLookup.exe

.exe 986KB

DiscordLookup.exe

IMPHASH 3b357d7665ebba72943fc65242a93f8e
SHA256 1599c9215aa9c0e6ccbdb2a7b19ea97f1da2836716b936029fbcbdb7ee981fba
MD5 82d4b4675d3a27e8c297191e795538e6
SHA1 790e1f53fcf3f9183b8f2bb1b36fabcbbe6a7261
SHA512 d5409aab6b88ed6fa0fe43f16d5aa9dcc5833832841f51aa7bfb87bfceb6c15abd200c76c39803ef5f4b26882aa9bfe4d7dbf7aa215c3693cc99ce3c603ff3b9
SSDEEP 12288:0y+qSDlFukjZoc2TPDupdPQxE/1w5bWEmatnCuXfpYHN7:Z/ctLp9nEmatCofpYHN7
TLSH
T12E255A47B3E48EEACC5A663994DB2709B734FCA017939AC7571042315E03AE98E7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

gdi32

GetStockObject

user32

CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetClientRect GetClipboardData GetKeyState GetSystemMetrics GetWindowLongPtrW LoadCursorW LoadIconW MessageBoxW OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassExW ReleaseCapture ScreenToClient SetCapture SetClipboardData SetWindowLongPtrW ShowWindow TranslateMessage UpdateWindow wsprintfW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vswprintf_s _fileno _setmode fflush fputc fputwc setvbuf

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp strnlen wcscpy_s wcslen wcsnlen

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___wargv __p__wcmdln __sys_nerr _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr cosf sinf

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DeleteCriticalSection DeleteFileW EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FormatMessageA FreeLibrary GetActiveProcessorCount GetCommandLineW GetCurrentThreadId GetLastError GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadId GlobalAlloc GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile lstrcpynW

api-ms-win-crt-convert-l1-1-0

mbrtowc strtof strtol strtoll strtoul strtoull wcrtomb wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

296KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DiscordLookup.exe

d2d1

dwrite

dwmapi

gdi32

user32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic