lightphotos-windows-x86_64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
lightphotos-windows-x86_64.zip
Size 11.3MB
Sample261029-wdwtcaex8k
SHA256 9e58ae769fc14be8631a8a7ee0033387be524ae04296cb3cc0e4e9b923fdee0c
MD5 b190a7f48cf3d378416a48a59d18fc7e
SHA1 01b733a2e9e3a09bd351cc37077189d7aa558fc3
SHA512 3669b27b4b9453acb53cdb809359df4d5f0299b768f4165b1bc3029eb34fe41134672d3dab15fa06af41ee1fb89d9f5fa77acf13c91b4dffda4eafbdcc288e4e
SSDEEP 196608:Ts9/TGHhyIrjhRAD0zHXSMWOCIoONhPVe2AySdxSC5QjUwFVKfUE+4w97/w8chm:TOGxWMWErMpdxSiQjn4x+4w97w8om
TLSH
T1F8C63384AB9DC5857DFE0AE54FDD2F6096C1EB1EB2A407036352A6C302247B97FC16B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lightphotos.exe

File Explorer

lightphotos-windows-x86_64.zip

.zip 11.3MB
LICENSE-APACHE

11KB
LICENSE-LGPL

26KB
LICENSE-MIT

1KB
THIRD-PARTY-LICENSES.txt

377KB
lightphotos.exe

.exe 28.0MB

lightphotos-windows-x86_64.zip

SHA256 9e58ae769fc14be8631a8a7ee0033387be524ae04296cb3cc0e4e9b923fdee0c
MD5 b190a7f48cf3d378416a48a59d18fc7e
SHA1 01b733a2e9e3a09bd351cc37077189d7aa558fc3
SHA512 3669b27b4b9453acb53cdb809359df4d5f0299b768f4165b1bc3029eb34fe41134672d3dab15fa06af41ee1fb89d9f5fa77acf13c91b4dffda4eafbdcc288e4e
SSDEEP 196608:Ts9/TGHhyIrjhRAD0zHXSMWOCIoONhPVe2AySdxSC5QjUwFVKfUE+4w97/w8chm:TOGxWMWErMpdxSiQjn4x+4w97w8om
TLSH
T1F8C63384AB9DC5857DFE0AE54FDD2F6096C1EB1EB2A407036352A6C302247B97FC16B1
MD5 SHA1 SHA512 SSDEEP TLSH

lightphotos.exe

IMPHASH f8d5c029b24a813b62c68b63f8c72543
SHA256 107037a2396b7028f2e11ea49ae34ad25072e61436fe28aa0916de43007d785c
MD5 c56862183d563f0bbdd890118247bf77
SHA1 4fa9383874d01d3470fa396ddb94adb3a4cfc93e
SHA512 d93b9bbcab163c0f8756f12ce69fa0965133e9e880c6208e0a90b09bb33083c917d54ac74c1356026cbf7e2bc8b69f7db05b55b7eddced9f69ce8e6c5986247d
SSDEEP 393216:f1A7H9wjNONUQ6dNX/ae0NmscY3LU/Bp0WLxCt7viU:tAJNmscY3LU/B+Lvi
TLSH
T134574A01B69B58ACE15AC8B0D3469A736F2134DB0B2AB9FF41C445783F6DBE06B38715
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20751680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lightphotos.pdb

bcryptprimitives

ProcessPrng

kernel32

SetLastError SleepEx WaitForSingleObject GetModuleHandleA SetHandleInformation Sleep CreateProcessW DuplicateHandle CreateThread FormatMessageW GetCurrentThreadId InitializeSListHead AddVectoredExceptionHandler SetUnhandledExceptionFilter SwitchToThread GlobalFree SetThreadStackGuarantee GetModuleHandleExW GetModuleFileNameW ExitProcess CreateWaitableTimerExW GetProcessHeap HeapFree HeapAlloc FreeLibrary LoadLibraryExW AttachConsole GetStdHandle SetWaitableTimer GetConsoleMode GetConsoleOutputCP HeapReAlloc SetThreadErrorMode GlobalAlloc GlobalLock GetLastError GetTimeZoneInformationForYear MultiByteToWideChar GlobalUnlock MapViewOfFile UnmapViewOfFile GlobalSize ReleaseMutex FlsFree FlsAlloc GetModuleHandleW CloseHandle CreateMutexA SetFilePointerEx GetSystemInfo GetSystemTimePreciseAsFileTime GetCurrentProcessId FindClose LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte GetSystemTimeAsFileTime GetCurrentProcess VirtualProtect CreateFileMappingW lstrlenW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CompareStringOrdinal GetProcAddress ReadFileEx WriteFileEx GetFullPathNameW GetCurrentThread IsThreadAFiber FlsSetValue QueryPerformanceCounter QueryPerformanceFrequency CreateEventA RemoveVectoredExceptionHandler WriteConsoleW LoadLibraryExA FindNextFileW GetTempPathW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateDirectoryW GetCurrentDirectoryW GetCommandLineW MoveFileExW FindFirstFileExW GetFinalPathNameByHandleW GetFileAttributesW DeleteFileW GetEnvironmentVariableW

advapi32

SystemFunction036 RevertToSelf ImpersonateAnonymousToken

gdi32

ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers CreateRectRgn DeleteObject GetDeviceCaps GetPixelFormat

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

GetWindowLongPtrW PeekMessageW ToUnicodeEx DispatchMessageW TranslateMessage EnumDisplayMonitors RedrawWindow SendInput SetWindowLongPtrW MapVirtualKeyW MonitorFromPoint DestroyWindow GetRawInputData GetMonitorInfoW RegisterRawInputDevices MonitorFromWindow IsIconic GetWindowRect GetKeyboardLayout RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable CloseTouchInputHandle CloseClipboard SetClipboardData EmptyClipboard GetTouchInputInfo TrackMouseEvent SetCapture MapVirtualKeyExW RegisterTouchWindow ReleaseCapture GetAsyncKeyState SystemParametersInfoA ValidateRect MsgWaitForMultipleObjectsEx SetWindowDisplayAffinity IsProcessDPIAware DestroyIcon DestroyCursor RegisterWindowMessageA ShowCursor ClipCursor GetClipCursor AdjustWindowRectEx GetWindowLongW SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu ShowWindow SetForegroundWindow CreateWindowExW RegisterClassExW ClientToScreen GetCursorPos DefWindowProcW MonitorFromRect ScreenToClient GetMenu InvalidateRgn SetWindowPos SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW PostMessageW GetClientRect GetSystemMetrics SetCursor SetWindowTextW GetKeyState GetActiveWindow GetKeyboardState DefWindowProcA RegisterClassExA GetClassInfoExA LoadCursorW ReleaseDC GetDC CreateWindowExA OpenClipboard

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

opengl32

wglDeleteContext wglCreateContext wglGetProcAddress wglMakeCurrent wglGetCurrentContext

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

combase

CoTaskMemFree

imm32

ImmGetContext ImmReleaseContext ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmSetCandidateWindow

bcrypt

BCryptGenRandom

ws2_32

recv getaddrinfo WSAGetLastError send ioctlsocket WSAStartup getsockopt connect closesocket select WSASocketW WSADuplicateSocketW getpeername accept freeaddrinfo listen bind getsockname setsockopt

shell32

DragQueryFileW DragFinish SHCreateItemFromParsingName

ole32

RevokeDragDrop RegisterDragDrop CoInitializeEx CoCreateInstance CoUninitialize OleInitialize

shlwapi

AssocQueryStringW

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

__current_exception __current_exception_context __CxxFrameHandler3 memcpy memmove memset memcmp _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

cos expf cbrtf cosf fmod sin sinf log10 powf atan _hypotf log2 pow acosf atanf exp2f log1p __setusermatherr asin asinf acos log1pf tanh tanhf tanf sinh sinhf acoshf cosh coshf atan2f acosh asinhf exp2 fmaf log2f asinh logf exp fma atan2 _hypot tan cbrt log fmodf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _register_onexit_function _crt_atexit _c_exit _cexit __p___argv __p___argc strerror _exit terminate _register_thread_local_exe_atexit_callback _initialize_onexit_table _configure_narrow_argv exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free