LewdFiles[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LewdFiles.exe
Size 201.8MB
Sample261017-xe74fabs8p
SHA256 ad3a01d9216e21c308e0a3253ce568359962ab4dd1e551dd2afc4b1b4f9911f1
MD5 0940873dd555dcf23a1e6be0f3330710
SHA1 7a2f4f0af5c4f8a86f09868f3700cc92b19beb4a
SHA512 a0820f630245e1672422dd35e29ac4cbba9ffb46fc803b549aad27d8f701fbb1209cb71af5a11130755d27818079285035a8bfd26e02002aa2e196b57d3396ee
SSDEEP 6291456:7dI929x75xido4bYY736wazwFZMjqYJ3MpTto:7O2TdxixZZazwZMjN3mTt
TLSH
T1A6A8330BBE9404B1D4B29D39C5775B65F572BC2603A1929F1294B28ACFFB3C05E3A784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LewdFiles.exe

File Explorer

LewdFiles.exe

.exe 201.8MB

LewdFiles.exe

IMPHASH 101eb8c89ba2eff86c234f345373b068
SHA256 ad3a01d9216e21c308e0a3253ce568359962ab4dd1e551dd2afc4b1b4f9911f1
MD5 0940873dd555dcf23a1e6be0f3330710
SHA1 7a2f4f0af5c4f8a86f09868f3700cc92b19beb4a
SHA512 a0820f630245e1672422dd35e29ac4cbba9ffb46fc803b549aad27d8f701fbb1209cb71af5a11130755d27818079285035a8bfd26e02002aa2e196b57d3396ee
SSDEEP 6291456:7dI929x75xido4bYY736wazwFZMjqYJ3MpTto:7O2TdxixZZazwZMjN3mTt
TLSH
T1A6A8330BBE9404B1D4B29D39C5775B65F572BC2603A1929F1294B28ACFFB3C05E3A784
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

240588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msiwrapper.exe.pdb

msi

ord145 ord64 ord34 ord103 ord32 ord74 ord118 ord190 ord88 ord70 ord169 ord137 ord141 ord8 ord120 ord123 ord115 ord116 ord125 ord121 ord17 ord92 ord158 ord163 ord160 ord159 ord49

ole32

CoCreateGuid StringFromGUID2 IIDFromString

shell32

CommandLineToArgvW

shlwapi

PathIsDirectoryEmptyW

user32

MessageBoxW

kernel32

WideCharToMultiByte WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetCurrentDirectoryW ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW GetProcessId AssignProcessToJobObject GetCurrentThreadId OpenMutexW LoadLibraryExW GetCurrentProcessId GetLocalTime LoadResource LockResource SizeofResource FindResourceW AllocConsole AttachConsole FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryW LocalFree FormatMessageW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetShortPathNameW RemoveDirectoryW SetFileAttributesW SetLastError GetTickCount CopyFileW MoveFileExW GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW GetTempPathW GetSystemDirectoryW GetModuleFileNameW MultiByteToWideChar SetEndOfFile GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead HeapFree RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind GetFullPathNameW GetDriveTypeW ExitProcess GetStdHandle WriteFile HeapAlloc

Name

.text

Size

406KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

201.3MB

Virtual Size

201.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

LewdFiles.exe

msi

ole32

shell32

shlwapi

user32

kernel32

generic