LazyUI[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LazyUI.exe
Size 2.9MB
Sample260925-ka6nlatbpg
SHA256 3a960eb0f14a4d8c6b0ad5055cc8ec7e3b630bd8d3c92a04ae737144e82429bb
MD5 884fc1a7c0978d0532c814dce007d9cb
SHA1 732136254dbb12c931a4226832bb54de658df82a
SHA512 a62fade2e58b5984a3ed822aae38253d82e5192ac76dc15cd1f9e527260ae153a46870237ada27beb22101cedb9c97c53a680b25c049e6fd50c3f2b3a77b8458
SSDEEP 49152:BQoVWdUvFZIWnKe/02S8bi3U4K4LbP+gS+vFlpTAHe5OUfIbisTGNNtnTXEoDFo8:bWMIWt02SxfKibWg/npEHe5J8fTGjhbE
TLSH
T173E51246F2E903EDC12B5438D952A75BF7753889CB24C6DB13E84A991F933E04EBA311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LazyUI.exe

File Explorer

LazyUI.exe

.exe 2.9MB

LazyUI.exe

IMPHASH 64659c13a9486b1e5dde5cf6fb7525de
SHA256 3a960eb0f14a4d8c6b0ad5055cc8ec7e3b630bd8d3c92a04ae737144e82429bb
MD5 884fc1a7c0978d0532c814dce007d9cb
SHA1 732136254dbb12c931a4226832bb54de658df82a
SHA512 a62fade2e58b5984a3ed822aae38253d82e5192ac76dc15cd1f9e527260ae153a46870237ada27beb22101cedb9c97c53a680b25c049e6fd50c3f2b3a77b8458
SSDEEP 49152:BQoVWdUvFZIWnKe/02S8bi3U4K4LbP+gS+vFlpTAHe5OUfIbisTGNNtnTXEoDFo8:bWMIWt02SxfKibWg/npEHe5J8fTGjhbE
TLSH
T173E51246F2E903EDC12B5438D952A75BF7753889CB24C6DB13E84A991F933E04EBA311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

374892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sylnt\Downloads\gui\gui\Menu\build\Release\LazyUI.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx CloseHandle OutputDebugStringA FlushFileBuffers LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType HeapFree HeapAlloc WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW GetEnvironmentVariableW GetStringTypeW CreateFileW HeapSize ExitProcess ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue HeapReAlloc WriteConsoleW SetEndOfFile GetConsoleOutputCP RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc

user32

SetProcessDPIAware UpdateWindow CloseClipboard TranslateMessage GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard SetLayeredWindowAttributes EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow MessageBoxW SetWindowLongPtrW CreateWindowExW GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow DispatchMessageW PeekMessageW PostQuitMessage

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

523KB

Virtual Size

522KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

LazyUI.exe

d3d11

d3dcompiler_47

dwmapi

kernel32

user32

shell32

ole32

imm32

generic