lightphotos-windows-x86_64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
lightphotos-windows-x86_64.zip
Size 11.3MB
Sample261029-2r4c8sty3l
SHA256 80b9232cc4f00d82b83725a11e5e902e2519b80d6c1aae2d611d39e1c470befb
MD5 a4f7849aa74560af0cd2ccfe247418a3
SHA1 185fdfac49229da4ce5fe4ee70712669bdc0e4df
SHA512 0d38e6a9885bc86b6c396742af5ed73a3e225778a4d9307b9fb83aedabf2b7dceed35ea76433c4e1c22d665cf11fde959379a55d5450118be7e192a52954fb0b
SSDEEP 196608:2b8C25EbscEZGbF0gIC3nFOwsuoeYCyPe3CV5Z5cFyR26Mgy3MIINFtsSKG+PbUS:zEwcE03IIOwsu1yPeqj2yRvKMTNFts9Z
TLSH
T103C63370F175D4BACE7EA200DF78E20E7AB649897F3D9E9403C7013A413A61266971F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lightphotos.exe

File Explorer

lightphotos-windows-x86_64.zip

.zip 11.3MB
LICENSE-APACHE

11KB
LICENSE-LGPL

26KB
LICENSE-MIT

1KB
THIRD-PARTY-LICENSES.txt

377KB
lightphotos.exe

.exe 28.2MB

lightphotos-windows-x86_64.zip

SHA256 80b9232cc4f00d82b83725a11e5e902e2519b80d6c1aae2d611d39e1c470befb
MD5 a4f7849aa74560af0cd2ccfe247418a3
SHA1 185fdfac49229da4ce5fe4ee70712669bdc0e4df
SHA512 0d38e6a9885bc86b6c396742af5ed73a3e225778a4d9307b9fb83aedabf2b7dceed35ea76433c4e1c22d665cf11fde959379a55d5450118be7e192a52954fb0b
SSDEEP 196608:2b8C25EbscEZGbF0gIC3nFOwsuoeYCyPe3CV5Z5cFyR26Mgy3MIINFtsSKG+PbUS:zEwcE03IIOwsu1yPeqj2yRvKMTNFts9Z
TLSH
T103C63370F175D4BACE7EA200DF78E20E7AB649897F3D9E9403C7013A413A61266971F6
MD5 SHA1 SHA512 SSDEEP TLSH

lightphotos.exe

IMPHASH 7fd9257b83aff0fe0258d7f7f9705097
SHA256 48cede915704f14d3234c789be5dc884ebbfd385d35fc2f8c8d8200e2cdb7746
MD5 0bfeefeb6cd787b0bc5a3358d0ef51c6
SHA1 fd59c68d720f9da935794553aa390f1cfdd86afb
SHA512 24477591972dacd2b65d01414137f059258ffee1ed6b413a4357a893b7debb9ed387b42b66d403609c87560c6505ecba5844cab2168d46abfb628d178550656d
SSDEEP 393216:4eHL+qRijxNTkvOUp6PZaZ4fERpIC9ut:dHQaZbRI
TLSH
T1FA574A01B69B58ACE15AC8B0D3469A735E2134DB0B2AB9FF41C445383FBDBE46B38715
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20896320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lightphotos.pdb

bcryptprimitives

ProcessPrng

kernel32

FlsFree SetWaitableTimer CreateWaitableTimerExW ExitProcess SetThreadStackGuarantee AddVectoredExceptionHandler CreateProcessW SetHandleInformation QueryPerformanceCounter SetLastError WaitForSingleObject SleepEx GetModuleHandleA GetModuleHandleW Sleep DuplicateHandle CreateThread FormatMessageW GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter SwitchToThread GetProcessHeap HeapFree HeapAlloc GlobalFree GetModuleHandleExW AttachConsole GetStdHandle WriteConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc GetModuleFileNameW GlobalAlloc IsThreadAFiber FreeLibrary LoadLibraryExW SetThreadErrorMode MultiByteToWideChar GlobalUnlock GetLastError GetTimeZoneInformationForYear GlobalSize FlsSetValue QueryPerformanceFrequency CreateEventA MapViewOfFile UnmapViewOfFile SetFilePointerEx GetSystemInfo GetSystemTimePreciseAsFileTime ReleaseMutex FindClose CloseHandle CreateMutexA GetSystemTimeAsFileTime GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx VirtualProtect CreateFileMappingW WideCharToMultiByte GetCurrentProcess lstrlenW CompareStringOrdinal ReadFileEx WriteFileEx RtlVirtualUnwind GetFullPathNameW RtlLookupFunctionEntry RtlCaptureContext FlsAlloc GetProcAddress GetCurrentThread RemoveVectoredExceptionHandler GlobalLock LoadLibraryExA FindNextFileW GetTempPathW GetFileAttributesW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateDirectoryW GetCurrentDirectoryW GetCommandLineW MoveFileExW FindFirstFileExW GetFinalPathNameByHandleW GetEnvironmentVariableW DeleteFileW

advapi32

ImpersonateAnonymousToken SystemFunction036 RevertToSelf

gdi32

GetPixelFormat CreateRectRgn SetPixelFormat GetDeviceCaps ChoosePixelFormat DeleteObject SwapBuffers DescribePixelFormat

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

SetWindowPos InvalidateRgn SendInput GetRawInputData SetWindowPlacement GetWindowPlacement MonitorFromWindow SetWindowTextW GetSystemMetrics SetCursor MapVirtualKeyW GetMonitorInfoW PeekMessageW RegisterRawInputDevices MonitorFromPoint TranslateMessage DispatchMessageW GetWindowLongPtrW EnumDisplayMonitors RegisterClipboardFormatW GetClipboardData LoadCursorW OpenClipboard DestroyWindow SetClipboardData EmptyClipboard ToUnicodeEx ChangeDisplaySettingsExW GetKeyboardLayout GetAsyncKeyState GetKeyState GetTouchInputInfo RedrawWindow SystemParametersInfoA ValidateRect MsgWaitForMultipleObjectsEx SetWindowDisplayAffinity IsProcessDPIAware DestroyIcon DestroyCursor RegisterWindowMessageA ShowCursor ClipCursor GetClipCursor AdjustWindowRectEx GetWindowLongW SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu ShowWindow SetForegroundWindow CreateWindowExW RegisterClassExW ClientToScreen GetCursorPos DefWindowProcW MonitorFromRect ScreenToClient GetMenu TrackMouseEvent SetCapture ReleaseCapture CloseTouchInputHandle GetActiveWindow GetKeyboardState RegisterTouchWindow MapVirtualKeyExW DefWindowProcA RegisterClassExA GetClassInfoExA GetClientRect ReleaseDC GetDC CreateWindowExA CloseClipboard PostMessageW IsClipboardFormatAvailable GetWindowRect IsIconic IsWindowVisible SetWindowLongPtrW

ntdll

NtOpenFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtWriteFile

opengl32

wglCreateContext wglDeleteContext wglGetProcAddress wglGetCurrentContext wglMakeCurrent

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

oleaut32

GetErrorInfo SetErrorInfo SysStringLen SysFreeString

combase

CoTaskMemFree

imm32

ImmReleaseContext ImmGetContext ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmSetCompositionWindow

bcrypt

BCryptGenRandom

ws2_32

WSAGetLastError send closesocket getaddrinfo getsockname ioctlsocket getsockopt recv connect select WSASocketW WSADuplicateSocketW getpeername freeaddrinfo listen bind accept WSAStartup setsockopt

ole32

CoInitializeEx RevokeDragDrop CoUninitialize RegisterDragDrop OleInitialize CoCreateInstance

shell32

SHCreateItemFromParsingName DragFinish DragQueryFileW

shlwapi

AssocQueryStringW

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

vcruntime140

memset __current_exception_context __current_exception __C_specific_handler _CxxThrowException __CxxFrameHandler3 memcpy memmove memcmp

api-ms-win-crt-math-l1-1-0

cbrtf atan2f tanhf tanf acos _hypotf sinh asinh sinhf sin sinf cosh cosf powf asin expf coshf fmod fmodf atanf log tanh __setusermatherr cbrt tan _hypot atan2 fma exp atan cos log2 logf log2f fmaf exp2 log1p acoshf pow asinf asinhf log10 acosf log1pf exp2f acosh

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment strerror _configure_narrow_argv _seh_filter_exe _set_app_type terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode