lua53-64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lua53-64.exe
Size 1.1MB
Sample260922-srbhsasy3r
SHA256 436f6bf9ac414e7e7259bef4f6e287702a41e1fddbdd9af7d43350d47539a3c9
MD5 b2d53e47d838cf917f90a9a6977c31e0
SHA1 7189c2dc9aa6136ca5f210b5ebd242d3491a91fe
SHA512 1efe3b14d7eac03ad7f2286ca42fbe235481195fa5906b3068dd97d4b4f5b2f9517cdcd78b6907794f6d2979944899ec97dcaae495077282b791260c41aaffe4
SSDEEP 24576:Px5ACjuRUvIY5cfisR23K16TpoJol/nj30sIcqqD7FE5sF8+:PgCYUG2uCFwsT
TLSH
T1EC45493432A810A6D17AC17DC84B4BA6DDB0300A573C55FB5195C6E4AF237EC2B7EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

lua53-64.exe

.dll 1.1MB

lua53-64.exe

IMPHASH 05545aa845d751a39d411a0cc7ef6dec
SHA256 436f6bf9ac414e7e7259bef4f6e287702a41e1fddbdd9af7d43350d47539a3c9
MD5 b2d53e47d838cf917f90a9a6977c31e0
SHA1 7189c2dc9aa6136ca5f210b5ebd242d3491a91fe
SHA512 1efe3b14d7eac03ad7f2286ca42fbe235481195fa5906b3068dd97d4b4f5b2f9517cdcd78b6907794f6d2979944899ec97dcaae495077282b791260c41aaffe4
SSDEEP 24576:Px5ACjuRUvIY5cfisR23K16TpoJol/nj30sIcqqD7FE5sF8+:PgCYUG2uCFwsT
TLSH
T1EC45493432A810A6D17AC17DC84B4BA6DDB0300A573C55FB5195C6E4AF237EC2B7EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

5b:ec:d1:32:4d:23:34:b2:1a:c9:0c:98:7e:de:a9:72:59:a2:91:b4:14:f5:9b:e9:35:a7:5f:64:b5:a3:4e:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 18, 2025

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

94:5e:b9:59:f4:e4:47:07:ae:5a:0d:1c:48:fd:c2:0d:e8:38:11:99

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 18, 2025

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

49:65:cf:96:a5:44:99:8c:47:68:a7:30

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 18, 2024 - Sep 4, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

454627

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb

kernel32

FreeLibrary GetProcAddress GetLastError FormatMessageA LoadLibraryExA GetModuleFileNameA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CreateThread GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW HeapAlloc HeapFree GetProcessHeap VirtualQuery RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader QueryPerformanceFrequency ReadFile CloseHandle DuplicateHandle CreateProcessA CreateProcessW GetTempPathW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode ReadConsoleW GetACP HeapReAlloc SetConsoleCtrlHandler SetFilePointerEx WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe CreateFileW GetStringTypeW GetTimeZoneInformation DeleteFileW MoveFileExW GetCPInfo FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW HeapSize SetEndOfFile OutputDebugStringA OutputDebugStringW WaitForSingleObjectEx RtlUnwind

luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_buffinitsize luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_checkversion_ luaL_error luaL_execresult luaL_fileresult luaL_getmetafield luaL_getsubtable luaL_gsub luaL_len luaL_loadbufferx luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffsize luaL_pushmodule luaL_pushresult luaL_pushresultsize luaL_ref luaL_requiref luaL_setfuncs luaL_setmetatable luaL_testudata luaL_tolstring luaL_traceback luaL_unref luaL_where lua_absindex lua_arith lua_atpanic lua_callk lua_checkstack lua_close lua_compare lua_compat lua_concat lua_copy lua_createtable lua_dump lua_error lua_gc lua_getallocf lua_getfield lua_getglobal lua_gethook lua_gethookcount lua_gethookmask lua_geti lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_getuservalue lua_iscfunction lua_isinteger lua_isnumber lua_isstring lua_isuserdata lua_isyieldable lua_len lua_load lua_newstate lua_newthread lua_newuserdata lua_next lua_pcallk lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawgetp lua_rawlen lua_rawset lua_rawseti lua_rawsetp lua_resume lua_rotate lua_setallocf lua_setfield lua_setglobal lua_sethook lua_seti lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_setuservalue lua_status lua_stringtonumber lua_toboolean lua_tocfunction lua_tointegerx lua_tolstring lua_tonumberx lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove lua_yieldk luaopen_base luaopen_bit32 luaopen_coroutine luaopen_debug luaopen_io luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table luaopen_utf8

Name

.textbss

Size

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

899KB

Virtual Size

899KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lua53-64.exe

kernel32

generic