lighttpd-service-tools-v1.1.1.zip
- SHA256 8e1a949df0f5964e5d2df814dac33243358e54e0855f95b603a198d24fb6ef17
Overview
overview
5Static
static
5lighttpd-s...ll.cmd
windows10-2004-x64
3lighttpd-s...ll.cmd
windows11-ltsc_2024-x64
3lighttpd-s...ll.exe
windows10-2004-x64
5lighttpd-s...ll.exe
windows11-ltsc_2024-x64
5lighttpd-s...ve.cmd
windows10-2004-x64
3lighttpd-s...ve.cmd
windows11-ltsc_2024-x64
3lighttpd-s...ve.exe
windows10-2004-x64
5lighttpd-s...ve.exe
windows11-ltsc_2024-x64
5Behavioral task
behavioral1
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-install.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-install.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target lighttpd-service-tools-v1.1.1.zip
- Size 127KB
- Sample260925-pmlleaea89
- SHA256 8e1a949df0f5964e5d2df814dac33243358e54e0855f95b603a198d24fb6ef17
- MD5 3fcbe30b454193cab47d0c2194036d13
- SHA1 bbe6ff3816f84005c40a81c9c5540262ffd8ac26
- SHA512 fb82c0577432fc498ebacd4475e677cfe7017600b172cf93ca82a2060b3a33cbc9dbed6ef954af4fa04f66d0acf1391e87f44cd0d2704b95cee0bc2af7c9d97b
- SSDEEP 3072:5YvcX1HkFf/1bsM7iFX0KfeLpXDD5YViMU:5YvSmNsUcBkXDD7b
- TLSH T1F3D312CDCB988948D05C44AAEAE9B51EC089FDEB0B5FFA913DF529214A4BCCDC199403
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe upx static1/unpack001/lighttpd-service-tools-v1.1.1/lighttpd-service-remove.exe upx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe unpack002/out.upx unpack001/lighttpd-service-tools-v1.1.1/lighttpd-service-remove.exe unpack003/out.upx
File Explorer
-
lighttpd-service-tools-v1.1.1.zip.zip 127KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-install.cmd3KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe.exe 63KB
-
out.upx.exe 127KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-install.ico3KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-install.res4KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.cmd1KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.exe.exe 63KB
-
out.upx.exe 127KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.ico3KB
-
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.res4KB
lighttpd-service-tools-v1.1.1/lighttpd-service-install.cmd
- SHA256 152d4b39b7ec4e74c2d4f41225440d9018eeebc694b6f4be35af69ec3dbd34df
- MD5 ac9d7c1411348ce907422c26bc05a6d7
- SHA1 e9a6dba66720024af1574f522d8954465dc20370
- SHA512 8a0d940e4c2477783d329f8243388be29e965a17a5e3698b3dbd9f5da64cdd0b16c95bcba8cb4124d3f6c882b377127b3ca62de8228a13798222c606b05c1f76
- TLSH T159610ED619D906E051926383BF43D206D22BB286A90D6A4936DDF80E1BCFF5C44BB4DF
- MD5 SHA1 SHA512 TLSH
lighttpd-service-tools-v1.1.1/lighttpd-service-install.exe
- SHA256 753c8a5f46643aafb158c03a2b0271ba20c7009a50c14657c171c4da4110b97d
- MD5 d690679f5f6a857dacdbc5ee6ce7e736
- SHA1 01fd9a97220c5fce3dcd7c756b07deff4428b240
- SHA512 f8e11de83a8511f7e7c1e363426eff955b600e78dcfa47fd3ef1cdfbbbfbd56ae799381b05daa738f3ea7066437958f35ae220473031d597261f6c0987c6910c
- SSDEEP 1536:IU9RNMwPS/OWg1gDlU62RBWx5DaC1ByfelAqFBokxN7HI1:FhMyGLxiLRBc5DdBiqQkxNE1
- TLSH T1375302D473D9982CE34A85782FF286453B19DD9D3FB4AF0B936060D617B430C536CAA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
166640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
55KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 e41382eb9daaa3eba4a3efbb0d9c1a8bcfd998c51cb72264ffc287002cb0fa00
- MD5 4518abf1af61163169a27ad80f1537ff
- SHA1 d0072604f99c7078c3f85ff79b54c9546793cbbc
- SHA512 268010ea6ec68fdff6ce1369094902e18d67c77474ebb8986959ac971a9c233f143066be9d7285348e068fe21c47370d78e6676413109360a06c824bf9f049be
- SSDEEP 3072:iHNJfdFMeHw41WhR5btEzv3GCTyjHI/2GRI:iHPYH02fHI/2
- TLSH T189D37D67F1C298B2D1661A7C9C068599E83EFE923D39346B7BE80D0D4E3D2C1295D2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
lighttpd-service-tools-v1.1.1/lighttpd-service-install.ico
- SHA256 6128ff1348bc4d07216879840f626ebfeeff55d5b59aefaf338ac9374e51528a
- MD5 9d6fd6eb69bf41ea42f8c78b613b707f
- SHA1 b2399bd1abf14c872ee5b48be7cbcc8057cda5a1
- SHA512 d3371f23eb31e5ba4be0a535e313bf183ecdc0911e6622a5d6de0ecd4deafb9639eece2413c94aef2d8776b5c272b44ce8fc732a92bdcbcbe4a4689108a9cde5
- TLSH T1787109DE5A0CDD52C08C437B28268B69E3054C5F707883126A197D30BF3E2EFA60A604
- MD5 SHA1 SHA512 TLSH
lighttpd-service-tools-v1.1.1/lighttpd-service-install.res
- SHA256 429e0985fb10eed49388f07d29eaba5612dba32958d78c3333f5cfc280ba0462
- MD5 47c1bdb13bb2caf648599265a831367f
- SHA1 bc1c8ca8aaf5c172020fbaeb115d72fb5799fe74
- SHA512 ffe82c291aed3766e92a8da8c89a5e20595b1f12bb8293f3a4a2c244a1c06650598d59ace4ae1d3470466c3e23001de5a41d24dba7d7f69838f16df66d86de5b
- SSDEEP 48:h1C1uFxWxUtX68uzXRtSzio3gKxhsTXZEt6FInJs2RwuliUQ6elvJS9OY8:a1oxKUtX6PD76io3gKfsTe64JzRwuAIa
- TLSH T149A1D7C67BECAA59F0EE0B763C3243566124BD9BE438C31C255039393E3879BD911B65
- MD5 SHA1 SHA512 SSDEEP TLSH
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.cmd
- SHA256 b61928942b93277e63052deb241566681f51d1437c8289845625dc612d2ce7df
- MD5 8d428654302c3d3a855d701b88aee578
- SHA1 c9900ae9dcf5a48aa76db30afe692bb9d8f645e2
- SHA512 398880cde40f594b7e291b5d8a01030c85bba1049a2371cedc51d378ac648c26f9dc508ff034ead0b3527a6d6d1f00bf13c97dad63e4373eb870b71b6f257b9f
- TLSH T1922198D96CCA09A05191F2437C02C445E32BB194BC0D348E35DDED596B8DBA8167F89F
- MD5 SHA1 SHA512 TLSH
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.exe
- SHA256 23df204c49bb0f82a670f928a4c11f8a36051c855b098431d1b4035b2aadea81
- MD5 1a86599cf0f45c8dbbf5c02b15b05b2c
- SHA1 2c62c81a179e1aa2ae64dc80bbe218fee2e68ec6
- SHA512 11cd15569a54f53b8f058006ce566ff9e1b6149e62afa030540faced4c3987eb64a91b3bef70854e41f0382538f99eb83f54cade93421e1f82087fc3a8622c7a
- SSDEEP 1536:M9RNMwPS/OWg1gDlU62RBWx5DaC1ByfelAqFBokxNIsX:MhMyGLxiLRBc5DdBiqQkxNjX
- TLSH T1815302E8B3D5981CE246C4741FF386413719ADAD3FB4AF0F936060DA27B960C936C695
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
166640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
55KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 742d68d73c4db3481cd6de05f4ac96f794b209d793c1500811bd1ad79d9a850c
- MD5 fb3d5148328630cd83d5c5a9d7d2f44a
- SHA1 97a9e0b3e344a75a14fe9ce3dfdc179745208a27
- SHA512 cdd71bb7c29f5e9012f1f68a65f7da00097ee73afbb6d9f47241e2f154430a726c9506f77cf1098152e2509446817fa329f6aa5e39904eb7595d79248311975a
- SSDEEP 3072:yHNJfdFMeHw41WhR5btEzv3GCTyjHI/2lrI:yHPYH02fHI/2
- TLSH T1A1D37D67F1C298B2D1661A7C9C068599E83EFE923D39346B7BE80D0D4E3D2C1295D2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.ico
- SHA256 a841ab10d8e6e355c1b2891968365b4cf071e5273284e433cc57f78cb5d28540
- MD5 ee46a4d9dc223abd64f7296a3c79edb4
- SHA1 ea5848f4c1110361ab298ab1810380cb219e427f
- SHA512 10d5d32ed70a54ad53fa40a01147fbecfb521ac92814559c1b9d3e2f0d09389ad264f8ebace43ae544ebba3321e9d3c9512f0dd1096bc0b85edba6e9aed9d165
- TLSH T1AF71C9DEA60C8949EE91473330164EF973145C5FB064A106AA643DB17F3F4DBE30A541
- MD5 SHA1 SHA512 TLSH
lighttpd-service-tools-v1.1.1/lighttpd-service-remove.res
- SHA256 d489661193c882f90127f02f0078a1e468fa11f80076656aec817d50aa6b5b42
- MD5 b970bf393ee0f341806cf36c18334fe3
- SHA1 f753edd1955a98982c7841377dd6b67df3004e0e
- SHA512 a33b34663945c531d4c7e4eea7c67f91ecf8e4f3f8f9a37734bd4648187e769547394a1ade7c506ac4a2828171e5c1aa1ad8fcefad0ab78fa5cbd18336a5ccaa
- SSDEEP 96:0411oxIKXBwRdiio3gKfsTe6VoIXGbUEj:0coxlwuio2ea2Tj
- TLSH T122A1B5DA77EC9A0CF9F64B31303202953124BD9AE434D30D35A03A793E3A987CA55B51
- MD5 SHA1 SHA512 SSDEEP TLSH