liblzma-5[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
liblzma-5.dll.exe
Size 2.0MB
Sample261110-j6s7psea57
SHA256 ee4228f721b68d8620326e8d75370bbc693193cb8840af8e5e23cb91d1892334
MD5 d220f87ab7d8f87d699915fad2bfb243
SHA1 8c691eb52c8a6b6f6b6a822e1978c28b67ab35e4
SHA512 b1b2a41cbd0eaabf7fd8c9bae1458ff103a72b4adeb7bea6dc929086785ab1b9726eea82b92cba2f4d28ac69a7922b266c51089f351750a15e29684f6f73fd8f
SSDEEP 49152:GkkjGMm8/8pUEqnF7pmK/Aidp7ICWJ79dxLxYKa+I6IHG3:Nidp7cJ79dnYN+IPm3
TLSH
T127A58C133EA9778ED611133746F7E200E5A3ADD80F52CFCF50C181E5599A362AFA816B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
liblzma-5.dll.exe

File Explorer

liblzma-5.dll.exe

.dll 2.0MB

liblzma-5.dll.exe

IMPHASH 4fdeb096de1649c7b13373ee97465c11
SHA256 ee4228f721b68d8620326e8d75370bbc693193cb8840af8e5e23cb91d1892334
MD5 d220f87ab7d8f87d699915fad2bfb243
SHA1 8c691eb52c8a6b6f6b6a822e1978c28b67ab35e4
SHA512 b1b2a41cbd0eaabf7fd8c9bae1458ff103a72b4adeb7bea6dc929086785ab1b9726eea82b92cba2f4d28ac69a7922b266c51089f351750a15e29684f6f73fd8f
SSDEEP 49152:GkkjGMm8/8pUEqnF7pmK/Aidp7ICWJ79dxLxYKa+I6IHG3:Nidp7cJ79dnYN+IPm3
TLSH
T127A58C133EA9778ED611133746F7E200E5A3ADD80F52CFCF50C181E5599A362AFA816B
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b1:91:55:41:91:7f:40:65:e1:8b:2c:8f:54:2f:81:75:7c:83:87:a2:71:be:9f:0f:28:a6:28:43:99:58:69:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

298784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

OpenProcess CreateToolhelp32Snapshot Sleep FormatMessageW Process32NextW DisableThreadLibraryCalls Process32FirstW CloseHandle FreeConsole GetWindowsDirectoryW GetProcAddress ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW GetConsoleWindow IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess GetTickCount CreateDirectoryW ReadFile SizeofResource VirtualProtect GetModuleHandleA VirtualAlloc MultiByteToWideChar LockResource CreateThread LoadResource FindResourceW LocalFree FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime FlsFree FlsAlloc SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ResumeThread GetFileAttributesW CreateFileW WaitForSingleObject FindClose CreatePipe CreateJobObjectW GetModuleFileNameW TerminateProcess AssignProcessToJobObject DeviceIoControl GetModuleHandleExW WriteFile GetCurrentProcess FindNextFileW GetCommandLineW SetHandleInformation FindFirstFileW SetInformationJobObject IsBadStringPtrW GetProcessHeap DeleteCriticalSection WriteConsoleW DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx GetStdHandle VirtualFree HeapFree GetCommandLineA GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW RtlUnwind GetFileType IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FreeLibraryAndExitThread ExitThread FlsSetValue FlsGetValue SetLastError InterlockedFlushSList RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer FindFirstFileExW GetLocaleInfoEx SleepConditionVariableSRW OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection GetStringTypeW GetCurrentThreadId FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable

user32

ShowWindow SetWindowPos

advapi32

CreateServiceW QueryServiceStatus StartServiceW RegCloseKey RegSetValueExW RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoInitializeEx CoGetObject

oleaut32

SysFreeString SysAllocString SysStringLen VariantClear

shlwapi

StrStrIW

ws2_32

inet_addr send socket connect recv htons closesocket

ntdll

RtlPcToFileHeader

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpSetOption

GetErrorMessageModule SetErrorMessageModule lzma_alone_decoder lzma_alone_encoder lzma_auto_decoder lzma_bcj_arm64_decode lzma_bcj_arm64_encode lzma_bcj_riscv_decode lzma_bcj_riscv_encode lzma_bcj_x86_decode lzma_bcj_x86_encode lzma_block_buffer_bound lzma_block_buffer_decode lzma_block_buffer_encode lzma_block_compressed_size lzma_block_decoder lzma_block_encoder lzma_block_header_decode lzma_block_header_encode lzma_block_header_size lzma_block_total_size lzma_block_uncomp_encode lzma_block_unpadded_size lzma_check_is_supported lzma_check_size lzma_code lzma_cputhreads lzma_crc32 lzma_crc64 lzma_easy_buffer_encode lzma_easy_decoder_memusage lzma_easy_encoder lzma_easy_encoder_memusage lzma_end lzma_file_info_decoder lzma_filter_decoder_is_supported lzma_filter_encoder_is_supported lzma_filter_flags_decode lzma_filter_flags_encode lzma_filter_flags_size lzma_filters_copy lzma_filters_free lzma_filters_update lzma_get_check lzma_get_progress lzma_index_append lzma_index_block_count lzma_index_buffer_decode lzma_index_buffer_encode lzma_index_cat lzma_index_checks lzma_index_decoder lzma_index_dup lzma_index_encoder lzma_index_end lzma_index_file_size lzma_index_hash_append lzma_index_hash_decode lzma_index_hash_end lzma_index_hash_init lzma_index_hash_size lzma_index_init lzma_index_iter_init lzma_index_iter_locate lzma_index_iter_next lzma_index_iter_rewind lzma_index_memusage lzma_index_memused lzma_index_size lzma_index_stream_count lzma_index_stream_flags lzma_index_stream_padding lzma_index_stream_size lzma_index_total_size lzma_index_uncompressed_size lzma_lzip_decoder lzma_lzma_preset lzma_memlimit_get lzma_memlimit_set lzma_memusage lzma_mf_is_supported lzma_microlzma_decoder lzma_microlzma_encoder lzma_mode_is_supported lzma_mt_block_size lzma_physmem lzma_properties_decode lzma_properties_encode lzma_properties_size lzma_raw_buffer_decode lzma_raw_buffer_encode lzma_raw_decoder lzma_raw_decoder_memusage lzma_raw_encoder lzma_raw_encoder_memusage lzma_str_from_filters lzma_str_list_filters lzma_str_to_filters lzma_stream_buffer_bound lzma_stream_buffer_decode lzma_stream_buffer_encode lzma_stream_decoder lzma_stream_decoder_mt lzma_stream_encoder lzma_stream_encoder_mt lzma_stream_encoder_mt_memusage lzma_stream_flags_compare lzma_stream_footer_decode lzma_stream_footer_encode lzma_stream_header_decode lzma_stream_header_encode lzma_version_number lzma_version_string lzma_vli_decode lzma_vli_encode lzma_vli_size

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

940KB

Virtual Size

939KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

516KB

Virtual Size

515KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

liblzma-5.dll.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

ntdll

winhttp

generic