LunarLoader.zip
- SHA256 afb846b578bfb16b822eeae9f9023e480c058d0d5333a749958b5a161a73a163
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LunarLoader.zip
Resource
win11-20260911-en
windows11-21h2-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
LunarLoader/Checker/CarbonChecker.exe
Resource
win11-20260911-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
LunarLoader/Debug/Debug.exe
Resource
win11-20260911-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
LunarLoader/Loader/Loader.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target LunarLoader.zip
- Size 10.4MB
- Sample261024-2zls6afh85
- SHA256 afb846b578bfb16b822eeae9f9023e480c058d0d5333a749958b5a161a73a163
- MD5 d895f7314b7f474664b9e5d09db2dd01
- SHA1 3a875570031882b43e2a987757f25bb55f833f58
- SHA512 c465680580f7fe180c1d851b065a1d2988eac940bf69ab0f6bcce0509940b763817a81d43d4ea8f96c8cf885ffd03f11b45fdb836fe9cb5fd920f7da99ebd9f3
- SSDEEP 196608:OfAs+HkNQLYNKBIKPGGLQtMhcf2FhB/5l19AnfyBtA+qLGkhQYXd:OfAnoQL1IKPjLQtMhthBRl1qItABLhd
- TLSH T19CB63365122E52CA17E841BDC4CA449AA756163B4E6D27E3BFEE0FC7438DE64000E7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/LunarLoader/Checker/CarbonChecker.exe unpack001/LunarLoader/Debug/Debug.exe unpack001/LunarLoader/Loader/Loader.exe
File Explorer
-
LunarLoader.zip.zip 10.4MB
-
LunarLoader/.DS_Store10KB
-
LunarLoader/Checker/CarbonChecker.exe.exe 1.7MB
-
LunarLoader/Debug/Debug.exe.exe 928KB
-
LunarLoader/Loader/.DS_Store6KB
-
LunarLoader/Loader/Loader.exe.exe 9.5MB
-
LunarLoader/Loader/loader.config32B
LunarLoader/.DS_Store
- SHA256 7b6e0e93e040413e5f9acce152d0cf1b78cd2e09c1a7c96cb13ef2ba4a9451d2
- MD5 3c9ac499c843b4a80e548ddd5a6c6d6b
- SHA1 a3185a40765778ccc016ccea08dc6fa227aef9f0
- SHA512 ce1cd9c6342b5eadd4898fea6f71ed2b53e9a79cea649b173ef2ccd9f36f717019d7012b8271f45a4f2100fbac0200191c1f234dc5e8c495d89b1796bf254ace
- SSDEEP 96:IvZkebkVih/Ry/4iWhAYEkebkVih/Ry/piWhADhAYi:qZkMkiDdhnEkMkiDchKhni
- TLSH T17B22E75B675400F9FEAB977D95D243716334D297B221924F27316686CD43F421E0DEB0
- MD5 SHA1 SHA512 SSDEEP TLSH
LunarLoader/Checker/CarbonChecker.exe
- IMPHASH c1c779eb4de3c5baa656df6ed62ab863
- SHA256 769f6f0d241428069a1f6fc289a7ed1ebdde6e908bc580d5f6c6f235b6d6389e
- MD5 3ae0e550478754b96141e3e6e3bc1eb1
- SHA1 8a3fc580aba8a3aca0269e188cd976fcde92e3ec
- SHA512 fe1f9da3038195ab77b8fc9519c637ead658610dd43892ae96c92b87063794ac41da9f7e02eb41d1c6a9c368cda01cf67c67ac152263668007d200db562101af
- SSDEEP 24576:XF4tuA25vAnJrgioeDr4SIpGPP95IsogsX+D+DOx/Gn1FhaIuN:et125v+qioeDPpPP95x+n7huN
- TLSH T19685AE05B7A442A8C17B907C8886D63AE7727C161B2096CB23F05E673F676E05F7B391
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
566400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\2TACT\Desktop\Carbonchecker\x64\Release\ConsoleApplication1.pdb
kernel32
GetEnvironmentVariableW
DeleteFileW
GetModuleFileNameW
GetTempPathW
GetTempFileNameW
GetVolumeInformationW
GetLogicalDrives
GetSystemTimes
GetLogicalProcessorInformationEx
GetDiskFreeSpaceExW
GetSystemInfo
GlobalMemoryStatusEx
WideCharToMultiByte
GetDriveTypeW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindClose
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
GetFileSizeEx
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
LoadLibraryExW
VirtualProtect
HeapFree
CreatePipe
UnhandledExceptionFilter
GetProcAddress
RtlVirtualUnwind
LoadLibraryA
CreateFileW
DeviceIoControl
CreateProcessW
TerminateProcess
SetConsoleMode
GetStdHandle
SetHandleInformation
ReadFile
RtlCaptureContext
WriteFile
ExitProcess
IsProcessorFeaturePresent
GetCurrentProcess
DuplicateHandle
SetFilePointerEx
GetFileType
ReadConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RtlUnwindEx
RtlLookupFunctionEntry
InitializeSListHead
LoadLibraryW
GetModuleHandleW
GetSystemFirmwareTable
FreeLibrary
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
RtlUnwind
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetExitCodeThread
Sleep
WaitForSingleObjectEx
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
CloseHandle
GetConsoleMode
WaitForSingleObject
IsDebuggerPresent
PeekNamedPipe
HeapAlloc
SetConsoleOutputCP
RaiseException
GetCurrentThreadId
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
user32
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
CloseClipboard
EmptyClipboard
GetClipboardData
GetForegroundWindow
GetKeyboardLayout
SetClipboardData
DefWindowProcW
DestroyWindow
CreateWindowExW
ScreenToClient
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
LoadIconW
LoadCursorW
PeekMessageW
PostQuitMessage
TranslateMessage
TrackMouseEvent
ClientToScreen
GetCapture
OpenClipboard
UpdateWindow
SetCapture
GetMessageExtraInfo
GetKeyState
advapi32
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
ShellExecuteA
ShellExecuteW
ole32
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
oleaut32
SafeArrayAccessData
VariantInit
VariantClear
SafeArrayUnaccessData
SysAllocString
SysFreeString
SafeArrayGetLBound
SafeArrayGetUBound
iphlpapi
GetIfTable2
FreeMibTable
GetIpNetTable2
GetAdaptersInfo
ws2_32
InetNtopW
rpcrt4
UuidCreateSequential
ntdll
NtCreateFile
RtlPcToFileHeader
NtClose
NtDeviceIoControlFile
bthprops.cpl
BluetoothFindNextRadio
BluetoothFindRadioClose
BluetoothFindFirstRadio
BluetoothGetRadioInfo
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptHash
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
dxgi
CreateDXGIFactory
pdh
PdhGetFormattedCounterArrayW
PdhAddCounterW
PdhCloseQuery
PdhOpenQueryW
PdhCollectQueryData
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
Name
.text
Size
750KB
Virtual Size
749KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
749KB
Virtual Size
749KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=16, id=259, version=33145,
count=25, id=260, version=33145,
count=18, id=260, version=35721,
count=12, id=259, version=35721,
count=98, id=261, version=35721,
count=41, id=257, version=33145,
count=249, id=1, productName=Unmarked objects,
count=28, id=265, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,
LunarLoader/Debug/Debug.exe
- IMPHASH cf9622d84eb9aa5ec17194cb2a450cad
- SHA256 4fd38fce6859a66fe8fdbf6d6d0ffa6cf307e4005c0b47fa9abe14d6b9dddb09
- MD5 a4129faea3ec88b5624ca3d991a8ff05
- SHA1 83b2ac2570a5ba5def672b9cb47121375a86851d
- SHA512 9915dc6a1e7bed6236b2db81f1a569e5ad9964f6898ef62606a66a56a86e4a8e414ed36e3dc3e17f53b51affb31f8ee35a402feccef79eb251a55c49e114b336
- SSDEEP 12288:g3SA5UVFcWbXEbr9MczThKAQ1Movm8odC1nwG/penX8zoeVvEY:eV5UUEUbr7fUj1MiPenszbVvEY
- TLSH T15C15CF06F2D442ACC017D9788977E31BEB36B89607265BC733E855A56F934D4AF3BA00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
515888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\2TACT\Desktop\Debug\x64\Release\Debug.pdb
ntdll
NtQuerySystemInformation
NtDeviceIoControlFile
NtClose
NtCreateFile
kernel32
GetSystemTime
GetExitCodeProcess
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
ReadFile
LocalFree
GetStdHandle
TerminateProcess
CreatePipe
PeekNamedPipe
CreateProcessW
LoadLibraryW
DeviceIoControl
CreateFileW
GetSystemTimeAsFileTime
GetProcAddress
CloseHandle
DeleteFileA
CreateProcessA
GetCurrentThread
CreateFileA
InitializeSListHead
MoveFileExA
GetLastError
GetTickCount64
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetCurrentThreadId
GetTempPathA
Sleep
OpenProcess
GetModuleHandleA
DuplicateHandle
GetSystemDirectoryW
lstrcmpA
LocalAlloc
WaitForSingleObject
GetProcessId
GetConsoleWindow
GetModuleHandleW
GetCurrentProcessId
GetSystemFirmwareTable
ExitProcess
SetHandleInformation
user32
GetMessageExtraInfo
ScreenToClient
GetKeyState
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCursor
GetClientRect
IsWindowUnicode
SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
GetCursorPos
CreateWindowExW
SendMessageW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
FindWindowExA
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
LoadImageW
ReleaseCapture
UpdateWindow
PostQuitMessage
SetCapture
LoadCursorW
advapi32
CloseServiceHandle
RegEnumKeyExW
RegDeleteTreeA
RegCloseKey
OpenServiceA
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
OpenSCManagerA
RegQueryValueExA
ole32
CoCreateGuid
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
oleaut32
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
msvcp140
?good@ios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
__crtLCMapStringA
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Mtx_lock
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_unlock
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
mpr
WNetGetProviderNameA
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
crypt32
CryptBinaryToStringA
bcrypt
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptDestroyKey
BCryptCreateHash
BCryptSetProperty
BCryptHashData
BCryptDestroyHash
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenerateSymmetricKey
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
iphlpapi
FreeMibTable
GetIpNetTable2
GetIfTable2
GetAdaptersInfo
ws2_32
InetNtopW
rpcrt4
UuidCreateSequential
bthprops.cpl
BluetoothFindRadioClose
BluetoothGetRadioInfo
BluetoothFindNextRadio
BluetoothFindFirstRadio
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__std_exception_copy
__C_specific_handler
__current_exception_context
__std_exception_destroy
__current_exception
__std_terminate
strchr
__RTtypeid
strstr
wcsstr
memcpy
memchr
memcmp
memmove
memset
__std_type_info_compare
api-ms-win-crt-string-l1-1-0
strncpy
strnlen
strlen
strcmp
toupper
strncmp
wcslen
tolower
wcsncmp
wcsnlen
api-ms-win-crt-stdio-l1-1-0
fputs
setvbuf
fwrite
_fileno
_close
ungetc
_dup
fsetpos
fread
_fseeki64
fgetpos
_get_stream_buffer_pointers
_dup2
fgetc
ftell
fseek
__stdio_common_vfprintf
fclose
_wfopen
__stdio_common_vsscanf
fflush
freopen_s
__stdio_common_vsprintf_s
putchar
__acrt_iob_func
__p__commode
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vswprintf_s
fputc
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
realloc
_callnewh
free
_set_new_mode
malloc
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
api-ms-win-crt-runtime-l1-1-0
__p___argv
_initterm_e
_register_onexit_function
_crt_atexit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_seh_filter_exe
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
__p___argc
system
terminate
_exit
exit
_cexit
_c_exit
_get_initial_narrow_environment
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
_wtoi
atoi
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
___lc_collate_cp_func
___lc_locale_name_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sinf
fmodf
cosf
acosf
ceilf
sqrtf
__setusermatherr
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
387KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=33145,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=35, id=261, version=35721,
count=6, id=257, version=35721,
count=39, id=257, version=33145,
count=366, id=1, productName=Unmarked objects,
count=18, id=265, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,
LunarLoader/Loader/.DS_Store
- SHA256 d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
- MD5 194577a7e20bdcc7afbb718f502c134c
- SHA1 df2fbeb1400acda0909a32c1cf6bf492f1121e07
- SHA512 58941214a8334331e52114aab851fc3d8d5da5dd14983f933da8735c24b0ddcac134e8f13692553199c4d9a14a4b3188b62878a30b9d696edda1204666b60837
- SSDEEP 6:VWAlXN6XkEslX/9ldlXSPnrtHP8//kHLEk0/ulXSPnrtHP8//k:QAXN9EEX/HnXw6XMLEk0/qXw6X
- TLSH T16BC1EA53C70425AFC83D2B7104E34B357BBAC0B1A7B2538B1A24467D7C673856F66AA4
- MD5 SHA1 SHA512 SSDEEP TLSH
LunarLoader/Loader/Loader.exe
- IMPHASH bc5a8c083097938d511d8fd48993228c
- SHA256 1ef1c3a821a1869c290eb58fdf24788495b4c90f8b6dc0174770d2757b112bc8
- MD5 bd1830bf33f4a54c6555bde08a088771
- SHA1 ba667fd54876db74838843e283a24ebe7180531e
- SHA512 fdf919b8426dff9aa51492bbb23d49f9e6af1e0cf58f6b176b0da76065f30ed163366cd51242fdb8d4dcafad7137a00f40cfd35aa2b72c21af822f8e5784b70b
- SSDEEP 196608:j2Xg7eNg1VgzeBge/y6XyxYJsvAtxfdLx9DiTd8pEyXqe7PTeRPm:y+AKBge/tXyxYJvxfdx9q6EyXqe7PF
- TLSH T1AAA623FD6148365CC85A8434D437DC88F2F6512E0AED96EAF2EB7BD1679A820D507F08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17634185
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntdll
NtQuerySystemInformation
setupapi
SetupDiCallClassInstaller
version
GetFileVersionInfoSizeA
bcrypt
BCryptOpenAlgorithmProvider
kernel32
DeleteCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
CharUpperBuffW
advapi32
CryptAcquireContextA
shell32
SHGetFolderPathW
ole32
CoInitializeEx
msvcp140
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToFileA
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCandidateWindow
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
gethostname
shlwapi
StrStrW
psapi
GetModuleInformation
iphlpapi
GetIpForwardTable
winhttp
WinHttpAddRequestHeaders
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
pow
rF2 �['7�4 m\�"W������9��<iꎕ[YF0s����F���{%�]Xݝ�4����2���6E��#b���θ�� �\L6���|� STX�'LqrdH� |1������ �Y�4��}0�7E� -��2��l4;�H'0����䐴�_Dv��6iW��\j�ݥO���=p�bԉ� �xU� ���Lo �4Ki��T�>f �դo5Mh�2���8 j�7uh(���H|�8�[�F��8��@1��(ݫT:%�uu.!M�( ��ޗ�&3�S���/��[���@�{j���q�8_`��T�2�w�I��"��3Dc#�6��oД^>���Q+Z�8�D?kƯ��[�>l�AUq�$��l�3���6���=#��]z����]
!2������u��I:��>x�zf����:rnb"A�/����������;��P1'a�QT�fk�����oX��MIo��n"� �&�Ӓ�X� �x*3�F�6f mg� U���C�����qpMS ^���}nh�f�9�4����z��s����3�8�z������($�Ӛ�)�tBc��tKZ��dl"����,�Z���acgY���bb�Q�f&r����j�t�*Ɛ����C�
���{ ��� $kX�1���sj Q$�u�PA�t���D���F�7�8�� '#�u��� ��K��/�e\$.�jYW c�t�`�� M�^����j^@N�3C�Vs ��:�z�6DÇq�����C;����n��ӸO3l�ߧ2?EK��,�x��~J5����iG�7H��e(=�C�+7�r�ih�=�Ϯ��B�[�oT�-D��� 5���l�' ��
#����V`s�.}/ļ(`�M��6r͢4M�� �_�8pZҸ�7� 7%���0.��H�u �9,et��$�d�VMJ�O�4ڢ�J��]�D�1��n��խo��kf���6��#n�h��"Z���O��݉�Q�V�g����a�@��锤 )���d�Bp��&��n�H+~px���O��!!l�����ֿрB`����܊e�e�M��b�p 2 D� (��a;��Ls�Re�+���=Y ������_�j�f��ݣ)��4�l� �-/�ȣ�f��
��Z�j kl}N[W�*�*�<Py+IOY$$w��s��������hZ~ҿ�_����������~t�N 6�@>�L} 5�Q�.C�^[ߺ!?�2��& ���aM1�*m��A�+rV��&�� %�Q������8Jg�"�_��
���ʧl� �Mu1<��*g �
��yu��턌��H�Av"(�2)�@e���<^���R|@!���Yٞ�t����W�<$ݾ�5d� �c=��i�L'��C���B��ώ<�_'���nq�9߹`� ��n�s��st6��
���{s���%D� ����zk�NsxVV!k1��EF�N$�}��V���'��X�����o�����,��(��Mw��#��guE���Pe#&~[ǐ��t'G]tN~�t�֒�����G#n��c���K���/3T7ՇD��70�1�\��A���dDV�-r h';P
�G6m.ؼ�k7X-x�L[:>��MLq�Ou}7���R(-�1 o�,� ;�}zT*��؏2=������õ�+��&���y���W��SK����d�E��1���Bp�wp.�{�� �A_r�En��E ���A?yd%D�s�b���ߨ`3a�6 �(wY�Z�� ���V]+�Y�Y���t�Q� �qGT��9�=�U�dKL�I3��I�� l}x�y�\i7����ķߺs{ZZC� ���+ �~�Nk�c3�g�E��^��� no
k D�1m��05참4i��3�`
���B' �ཤ/rX�
������c����I���ϥN��y������=%9�Ǹ�� �Ќ9=������\�&6 �F�}M|���4�[��Yy��^������,ȭ\�����f���>�
�!GK`�?�B������ �w��Z��_�L��o ZҼ�0�� ��M���@�r�����no�(N9n�Q
3�#M=uy_+ � P����_��28���������������[����d'�������)L�cL��p���1����PWy���*��.3��� 0����t��X>p�rJ�C����0���l�{,�Xp�k�G������y(a�
y�qhU�Aht� �T!2� ��g�%�4#�&MN����C��C����)c�'���s5�w���p��"wp�� �;},]cBTG���z��:�e0m��99 Lj�8&�V��1{+���;I��\�D�J� �vꑥMs�v2
��~��.3�BtWyh���g��# 3[�똂�{���lwſRT��yo$\$P�����9SD�nv�+
�lIE,ۈ�Q5K�ℏ���? ����խ� ��D�qPx�@!m$=@�Z���/ʋ���A �]�ͷV��M$x��=h�:kY�^F�b�\�'��~ ,˒�|��Vq >��ױCf�g�22�����0�Ar�{�x ыU�~f�>4ikS�L�����}��[c��$L���~��B�;��O��߆S��@26��ږ�!�-2��h���If<�y��h�������0f̾d0�,�,� �6���� ����.�������}ip;��Cx��^i�6x��s\��s���)���C�&¡���{� Pz�JG5
�xA�'?[�4���ږ�9�(W�p�k�/f��������a�*9�d�J�{" ����,']�5.�!4,����i��� _���5v���Wa��:���@e�m�8��q:�Ey=���i`����W�]��r��1t|]F��mH��Y[��ϥ�� ����I�%i�o!�u��g?d )�+`}���
5Iq��t��ʵ�i��5�G`r�%
�z�?zk X#Xu&u>������0gok��&�]� izf�Yn�ê�)Z��8���*)�PN��l�p��^��7
{�qg����!q� ��{�� @��P�4��S''��ג=C����;�Ɖ_gH��ҁ�0P�}�W��@��R����E��$�&�B
Name
.text
Size
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
569KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.qzI
Size
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
./oI
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.KZd
Size
9.5MB
Virtual Size
9.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LunarLoader/Loader/loader.config
- SHA256 bddcc57379cd5c508b65e4629ef1f5ad74b32dcf65625d8a8398b5c41ded0a8d
- MD5 09363f223b552038a1fd2dd62fa44aa1
- SHA1 4f414a5db0d6200e6c4e3cc33815da5bc59f7137
- SHA512 ff271325cf61f2540fc1958439367488f8b8bc8922164f5db3f4ed08e6f8eca5968f70ff6e8d0d20a166926875942d02c9c688b343d454964ce707fa7b37b7a9
- MD5 SHA1 SHA512