Program[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Program.zip
Size 485KB
Sample261006-pec93ayxgz
SHA256 03aec7e0a63fca7ad548fa22dedfe3ba15dafc7c2cb816a2349d74e002051c0c
MD5 0158ead47af5bbf5f5fe8deb170fd58c
SHA1 b50dd0653be1576b6adfa59a1c4258cce6fb3535
SHA512 2a75023d1989298321dfa17ef253186d60b8b6de2262a51dbd71e61acef94ce1665a6b6e4dd7528abf0471597c5e11059d311b401b100cbab34d95a17adbbf53
SSDEEP 12288:02h8UZ7cUNk0BP2a5sbPLqHcU5JN04Scg/4An8bW:9pjOM2a5Aq8G304ScNAn8q
TLSH
T157B42347E0424735DCA4DD317D227DB35892ACAA2913A2E06B7D784743CD2E71DAAF28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lua51.dll
unpack001/luajit.exe

File Explorer

Program.zip

.zip 485KB
Application.bat

2KB
config.txt

.js 232KB
lua51.dll

.dll 592KB
luajit.exe

.exe 89KB

Program.zip

SHA256 03aec7e0a63fca7ad548fa22dedfe3ba15dafc7c2cb816a2349d74e002051c0c
MD5 0158ead47af5bbf5f5fe8deb170fd58c
SHA1 b50dd0653be1576b6adfa59a1c4258cce6fb3535
SHA512 2a75023d1989298321dfa17ef253186d60b8b6de2262a51dbd71e61acef94ce1665a6b6e4dd7528abf0471597c5e11059d311b401b100cbab34d95a17adbbf53
SSDEEP 12288:02h8UZ7cUNk0BP2a5sbPLqHcU5JN04Scg/4An8bW:9pjOM2a5Aq8G304ScNAn8q
TLSH
T157B42347E0424735DCA4DD317D227DB35892ACAA2913A2E06B7D784743CD2E71DAAF28
MD5 SHA1 SHA512 SSDEEP TLSH

lua51.dll

IMPHASH 9466a71df1d3a59794f8605626534abe
SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
MD5 3dff7448b43fcfb4dc65e0040b0ffb88
SHA1 583cdab08519d99f49234965ffd07688ccf52c56
SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
TLSH
T162D4BF41B6C3C0F2E5E21171047AAB760E3E2D114716CCEB97E439AD8D346E0B6776EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

343186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetLastError VirtualAlloc VirtualFree VirtualQuery VirtualProtect FreeLibrary GetModuleHandleExA GetProcAddress LoadLibraryExA FormatMessageA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep CreateThread RtlUnwind GetModuleFileNameA GetModuleHandleA IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile CloseHandle DuplicateHandle CreateProcessA GetTempPathW QueryPerformanceFrequency MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetStdHandle GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW DecodePointer GetACP SetFilePointerEx GetExitCodeProcess GetFileAttributesExW CreatePipe CreateFileW GetTimeZoneInformation DeleteFileW MoveFileExW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle GetStringTypeW HeapSize HeapReAlloc WriteConsoleW

luaJIT_profile_dumpstack luaJIT_profile_start luaJIT_profile_stop luaJIT_setmode luaJIT_version_2_1_0_beta3 luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_execresult luaL_fileresult luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadbufferx luaL_loadfile luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushmodule luaL_pushresult luaL_ref luaL_register luaL_setfuncs luaL_setmetatable luaL_testudata luaL_traceback luaL_typerror luaL_unref luaL_where lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_copy lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_isyieldable lua_lessthan lua_load lua_loadx lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tointegerx lua_tolstring lua_tonumber lua_tonumberx lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove lua_yield luaopen_base luaopen_bit luaopen_debug luaopen_ffi luaopen_io luaopen_jit luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

luajit.exe

IMPHASH d0264e200554ef617c521261fe8fe2a4
SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
TLSH
T1FC935C00F5D2D071D5B3593558B5DAB04A2EF9311F259FAB339813AA4F301C19E3AEAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

lua51

lua_gettop luaJIT_version_2_1_0_beta3 luaL_openlibs luaL_traceback luaL_newstate luaL_loadbuffer luaL_loadfile luaL_where luaL_callmeta lua_sethook lua_concat lua_error lua_gc lua_cpcall lua_pcall lua_call lua_rawseti lua_setfield lua_createtable lua_rawgeti lua_getfield lua_gettable lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushstring lua_pushlstring lua_pushnil lua_objlen lua_tolstring lua_toboolean lua_type lua_isstring lua_insert lua_remove lua_pushvalue lua_settop lua_close

kernel32

TlsAlloc DecodePointer ReadConsoleW ReadFile WriteConsoleW CreateFileW CloseHandle HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType LCMapStringW CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW SetConsoleCtrlHandler GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc

Program.zip

Application.bat

config.txt

lua51.dll

kernel32

generic

luajit.exe

lua51

kernel32

generic