lunyq[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lunyq.exe
Size 9.4MB
Sample261022-s3c6ra1zhy
SHA256 303f9af07006f7e03bf9bc7f6739aaa41f634ed875056557b285b247c6b1f6a2
MD5 3aac39dbd32d623e00b0cd58026400d5
SHA1 1d45250c7880c073c9d0c74492389543ad2f8fcf
SHA512 488778797f07e469034e9514757f32e33dba9c83824bf73909c56667fe0232b924a4badfa9371872afa05e58a877e4d06d7a1796bbe3e566bb37cc978b6df2d5
SSDEEP 196608:CQkDIK4FZhrHJ3H8PQhdzrb6ijlrWWWzL6:WIK4FZhjJ3H8PQH6ilrqze
TLSH
T1FAA6CF03F6A185F9C0AEC1B483469637BB36BCCD8415B25B2BE43A512E76F546F0939C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lunyq.exe

File Explorer

lunyq.exe

.exe 9.4MB

lunyq.exe

IMPHASH 1930e035369c5bdf5b3996182400da48
SHA256 303f9af07006f7e03bf9bc7f6739aaa41f634ed875056557b285b247c6b1f6a2
MD5 3aac39dbd32d623e00b0cd58026400d5
SHA1 1d45250c7880c073c9d0c74492389543ad2f8fcf
SHA512 488778797f07e469034e9514757f32e33dba9c83824bf73909c56667fe0232b924a4badfa9371872afa05e58a877e4d06d7a1796bbe3e566bb37cc978b6df2d5
SSDEEP 196608:CQkDIK4FZhrHJ3H8PQhdzrb6ijlrWWWzL6:WIK4FZhjJ3H8PQH6ilrqze
TLSH
T1FAA6CF03F6A185F9C0AEC1B483469637BB36BCCD8415B25B2BE43A512E76F546F0939C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2695056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lunyq.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile RtlGetVersion NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

kernel32

LCIDToLocaleName RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue LoadLibraryA FlsSetValue FlsFree EncodePointer GetSystemTimeAsFileTime SleepConditionVariableSRW GetModuleHandleW InitializeSListHead WakeAllConditionVariable SetUnhandledExceptionFilter SwitchToThread RtlUnwindEx SetLastError lstrlenW AcquireSRWLockExclusive LoadLibraryW HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex MultiByteToWideChar HeapAlloc GetModuleHandleA FormatMessageW GetModuleFileNameW ReleaseSRWLockExclusive SetWaitableTimer ExitProcess GetSystemDirectoryW GetWindowsDirectoryW DuplicateHandle Sleep FreeEnvironmentStringsW GetEnvironmentStringsW CreateProcessW ReadFile CancelIo CreateEventW CreateWaitableTimerExW QueryPerformanceCounter ReadFileEx WriteFileEx CreateThread QueryPerformanceFrequency GetEnvironmentVariableW CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext GetCommandLineW SetEnvironmentVariableW GetOverlappedResult AddVectoredExceptionHandler GetFileAttributesW GetTempPathW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle CreateFileW CreateDirectoryW WriteConsoleW GetConsoleOutputCP GetProcAddress GetConsoleMode GetStdHandle CreatePipe GetFullPathNameW FindFirstFileExW GetCurrentThreadId FindClose FindNextFileW DeleteCriticalSection GetFinalPathNameByHandleW CloseHandle GetUserDefaultUILanguage GetProcessId CompareStringOrdinal GetLastError WaitForMultipleObjects FreeLibrary InitializeCriticalSectionEx WaitForSingleObject LoadLibraryExW OutputDebugStringW OutputDebugStringA GetSystemTimePreciseAsFileTime LoadLibraryExA GetExitCodeProcess SleepEx GetSystemInfo TerminateProcess

shell32

ShellExecuteW DragFinish DragQueryFileW ShellExecuteExW SHGetKnownFolderPath SHAppBarMessage ILFree SHOpenFolderAndSelectItems SHCreateItemFromParsingName ILCreateFromPathW

ole32

CoCreateFreeThreadedMarshaler CoTaskMemFree CoInitializeEx RevokeDragDrop RegisterDragDrop CoInitialize CoUninitialize CoCreateInstance CoTaskMemAlloc OleInitialize

user32

GetWindowTextLengthW EnableWindow SetParent SetPropW GetKeyboardState EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx GetKeyState MapVirtualKeyExW GetKeyboardLayout ShowCursor GetForegroundWindow InvalidateRect UpdateWindow ClipCursor GetSystemMetrics GetClipCursor SetCursorPos GetWindowPlacement IsWindowVisible SetWindowPlacement GetWindowTextW ChangeDisplaySettingsExW GetTouchInputInfo SetWindowLongW GetSystemMenu DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture SetCapture IsWindow RegisterTouchWindow SystemParametersInfoW RegisterWindowMessageA GetParent FindWindowExW SetFocus SetWindowRgn GetWindow GetMonitorInfoW IsProcessDPIAware MonitorFromWindow GetAsyncKeyState SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu TranslateAcceleratorW GetMenuItemInfoW TrackMouseEvent MsgWaitForMultipleObjectsEx DispatchMessageW MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetMessageW SetWindowLongPtrW SetWindowTextW IsIconic SetCursor EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW ScreenToClient PostMessageW GetWindowLongPtrW RedrawWindow AdjustWindowRect DestroyWindow LoadCursorW TrackPopupMenu CloseTouchInputHandle FlashWindowEx IsWindowEnabled

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

comctl32

DefSubclassProc SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass

shlwapi

SHCreateMemStream

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

gdi32

CreateRectRgn BitBlt CombineRgn GetDeviceCaps DeleteDC SelectObject DeleteObject CreateDIBSection CreateSolidBrush CreateCompatibleDC SetTextColor SetBkMode

advapi32

EventWriteTransfer RegOpenKeyExW RegQueryValueExW RegCloseKey EventUnregister EventSetInformation RegGetValueW EventRegister

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s _wcsicmp wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr floor round trunc roundf pow

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

exit _exit terminate __p___argc _initterm_e _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _initialize_onexit_table _seh_filter_exe __p___argv _set_app_type _register_onexit_function abort

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc calloc free _set_new_mode _callnewh