aura[.]lol[.]v1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
aura.lol.v1.exe
Size 1.3MB
Sample260905-eqa9qswfme
SHA256 34f57e6d595462204721569d5188b445919940bbe6e21d59d6fd5e0a2f2872e9
MD5 76923d5a09b3d96507ed966f74c93546
SHA1 84a6f3abee8c2e6210b810475b8d624c978661a1
SHA512 ba3daa7a6ed40d39730e9bcc2bc99cdbc5939d529ba4211cdfc4bb1c9cfdb85918d39af32ecb8c448bd30da086b8412f10f7b6669ed05a1301472113c0c9cd03
SSDEEP 24576:MHofNrX4wY01QVJ3I6EHiShrUHp6nvAWBUTRl5jHA1Cucf9b3le7nY97r25XRGhr:MoGAnvbD8f9b3SnY9m5XXip
TLSH
T1E9558EA1E29041EAEA669134D07BFA1796727CBC9B6044D737FD70683FF23E01636612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aura.lol.v1.exe

File Explorer

aura.lol.v1.exe

.exe 1.3MB

aura.lol.v1.exe

IMPHASH 142b62330e6ff1539957c734820d9dbf
SHA256 34f57e6d595462204721569d5188b445919940bbe6e21d59d6fd5e0a2f2872e9
MD5 76923d5a09b3d96507ed966f74c93546
SHA1 84a6f3abee8c2e6210b810475b8d624c978661a1
SHA512 ba3daa7a6ed40d39730e9bcc2bc99cdbc5939d529ba4211cdfc4bb1c9cfdb85918d39af32ecb8c448bd30da086b8412f10f7b6669ed05a1301472113c0c9cd03
SSDEEP 24576:MHofNrX4wY01QVJ3I6EHiShrUHp6nvAWBUTRl5jHA1Cucf9b3le7nY97r25XRGhr:MoGAnvbD8f9b3SnY9m5XXip
TLSH
T1E9558EA1E29041EAEA669134D07BFA1796727CBC9B6044D737FD70683FF23E01636612
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

720696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ezema\Downloads\Chocola\Chocola Main\bin\UniversalNoRecoil.pdb

kernel32

LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess GetTickCount GlobalUnlock RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetPrivateProfileStringA GetModuleHandleA WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc UnhandledExceptionFilter GetPrivateProfileIntA WritePrivateProfileStringA GetModuleHandleW MultiByteToWideChar Sleep SetUnhandledExceptionFilter

user32

BringWindowToTop SetCursor SetWindowLongW SetFocus SetCapture LoadCursorW PeekMessageW GetWindowLongW AdjustWindowRectEx GetKeyState GetDC MonitorFromWindow EnumDisplayMonitors ScreenToClient SetWindowTextW WindowFromPoint GetCapture GetMonitorInfoW ClientToScreen IsChild TrackMouseEvent SetLayeredWindowAttributes OpenClipboard CloseClipboard GetClientRect ReleaseCapture SetForegroundWindow IsIconic SetCursorPos ReleaseDC GetCursorPos EmptyClipboard GetClipboardData SetClipboardData MapVirtualKeyW GetActiveWindow TranslateMessage LoadIconW PostQuitMessage UpdateWindow DestroyWindow ShowWindow SendInput GetForegroundWindow RegisterClassExW UnregisterClassW CreateWindowExW GetAsyncKeyState DefWindowProcW SetWindowPos DispatchMessageW

gdi32

GetDeviceCaps

comdlg32

GetSaveFileNameA GetOpenFileNameA

shell32

ShellExecuteA

msvcp140

_Thrd_join _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Thrd_yield ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy memset memcmp memchr __current_exception_context _CxxThrowException __C_specific_handler strchr strstr __std_exception_copy __std_exception_destroy __std_terminate __current_exception

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fread _wfopen fwrite fclose __stdio_common_vfprintf fseek fflush __acrt_iob_func ftell __stdio_common_vsscanf __stdio_common_vsprintf __p__commode __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof strtof

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _exit exit _invoke_watson _initterm_e _errno _initterm _get_narrow_winmain_command_line terminate _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _beginthreadex

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy toupper

api-ms-win-crt-math-l1-1-0

pow powf sinf sqrtf acosf atan2f cosf __setusermatherr log floorf ceilf logf fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale