Litecord.zip
- SHA256 d909c7b64c83eadf5ab91ab8cc8f1586216d6060311afc076032e58f38d00f0a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Litecord.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Litecord.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Litecord.zip
- Size 10.0MB
- Sample261110-vtmpyabz9t
- SHA256 d909c7b64c83eadf5ab91ab8cc8f1586216d6060311afc076032e58f38d00f0a
- MD5 89709735ba9cfe60a594192a5dd9314c
- SHA1 4e550d4d48886d9abcc28489f2f2f199f843a812
- SHA512 a61d158a8db0f6e2f0b149b15ed79f1b932565f0e433e3c5e6c01061c73e2beccf4a0e6fcaa669740ff68dbcc1f5b1d74eac82656d0b7b4b0e7a960f866e60f5
- SSDEEP 196608:AGVrNatz4WkiQ43gz746fBvbOjuLcDWFLIfynI:fiOAZgz746gGc6IqI
- TLSH T11AB63300B400374853BDD7B3EEEE6CBF976C798618A13118273A378565839E69B9BD43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Litecord.exe
File Explorer
-
Litecord.zip.zip 10.0MB
-
Litecord.exe.exe 24.4MB
Litecord.exe
- IMPHASH fdb1974ce0c916b8d435ddabfc0e1ac5
- SHA256 366c4421088c50621c00b984cd455de6aba57843b0447f3fa3908ea96f59f0fe
- MD5 a8e6a63c718c6254fcbddb76b6fe0c37
- SHA1 9479896e125b3068a18eed0605361c347b27ea0d
- SHA512 afa3d578e71782136ac9cf243a110a4cc5bd2a5e3f721eb6164504624770faef69253c2dc17095f2266580f5523aee9704629b861ece03e87cdb07d47a29de6a
- SSDEEP 196608:oivmWm9bU2LimhALOawgWLgkCzgTMTgG7iptHwFM+J:MK2hEwgto0gbptH6Mi
- TLSH T1D3477C83F69795EDD42AC070935AA233FA71785A07353AEB57D08A303F65BD06A3DB04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18544708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Litecord.pdb
bcryptprimitives
ProcessPrng
kernel32
AcquireSRWLockExclusive
CreateEventA
SetFilePointerEx
FlushFileBuffers
WakeAllConditionVariable
SetEvent
SwitchToThread
GetModuleHandleW
CloseHandle
CreateEventW
CreateThread
SleepConditionVariableSRW
WaitForMultipleObjectsEx
QueryPerformanceFrequency
WaitForSingleObject
GetCurrentThreadId
SetThreadPriority
GetCurrentProcessId
GetStartupInfoW
GetProcAddress
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
FlsGetValue
CreateMutexW
LoadLibraryW
GetThreadId
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
CreateIoCompletionPort
CancelIoEx
MultiByteToWideChar
CompareStringW
GetCurrentThread
SetFileCompletionNotificationModes
LCMapStringW
QueryPerformanceCounter
GlobalFree
GetCPInfo
GetUserDefaultUILanguage
GetOEMCP
GlobalSize
TerminateProcess
IsProcessorFeaturePresent
FindClose
WideCharToMultiByte
GlobalUnlock
GlobalLock
GetModuleHandleA
Sleep
CreateFileW
GlobalAlloc
CompareStringOrdinal
SleepEx
ReadFileEx
WriteFileEx
SetLastError
GetFullPathNameW
HeapReAlloc
GetCurrentProcess
DuplicateHandle
CopyFileExW
SetThreadErrorMode
SetHandleInformation
HeapSize
SetFileTime
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateProcessW
CreateDirectoryW
SetThreadStackGuarantee
lstrlenW
MoveFileExW
FindFirstFileExW
ExitProcess
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetFinalPathNameByHandleW
DeleteFileW
FormatMessageW
CreateWaitableTimerExW
SetWaitableTimer
GetFileAttributesW
FlsFree
FlsAlloc
GetModuleHandleExW
IsThreadAFiber
FlsSetValue
VirtualProtect
GetTempPathW
EncodePointer
FindNextFileW
HeapAlloc
HeapFree
LoadLibraryExA
GetProcessHeap
GetLastError
LoadLibraryExW
GetStringTypeW
GetTimeZoneInformationForYear
ReleaseSRWLockExclusive
CreateSemaphoreA
ReleaseSemaphore
ResetEvent
GetACP
FreeLibrary
GetFileSizeEx
IsValidCodePage
GetQueuedCompletionStatusEx
GetModuleFileNameW
GetCommandLineA
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
RaiseException
SetEnvironmentVariableW
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
GetSystemTimePreciseAsFileTime
SetStdHandle
RtlPcToFileHeader
GetSystemInfo
GetStdHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
GetEnvironmentVariableW
GetCommandLineW
GetCurrentDirectoryW
AddVectoredExceptionHandler
GetWindowsDirectoryW
GetSystemDirectoryW
user32
ShowWindow
GetKeyState
SetForegroundWindow
SetCursorPos
ReleaseCapture
LoadCursorW
IsProcessDPIAware
GetSystemMenu
EnableMenuItem
GetForegroundWindow
RegisterClipboardFormatW
SetWindowDisplayAffinity
SetWindowTextW
MapVirtualKeyW
SetWindowLongW
GetWindowLongW
GetClipboardData
SetClipboardData
EmptyClipboard
DestroyIcon
SetCursor
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextLengthW
EnumWindows
EnumDisplaySettingsW
DestroyCursor
TrackMouseEvent
ToUnicodeEx
MonitorFromWindow
GetDpiForWindow
SendInput
ClientToScreen
InvalidateRgn
SetWindowPos
GetMonitorInfoW
MonitorFromPoint
EnumDisplayMonitors
RedrawWindow
CreateIconFromResourceEx
SendMessageW
GetSystemMetrics
GetActiveWindow
IsIconic
IsWindowVisible
GetClientRect
SystemParametersInfoA
PostThreadMessageW
ReleaseDC
DestroyWindow
GetWindowLongPtrW
RegisterRawInputDevices
SetWindowLongPtrW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
GetMenu
FlashWindowEx
PostQuitMessage
GetMessageW
RegisterClassW
MonitorFromRect
ScreenToClient
AdjustWindowRectEx
GetClipCursor
ClipCursor
RegisterWindowMessageW
CreateIcon
ChangeDisplaySettingsExW
CreateIconIndirect
GetWindowPlacement
SetWindowPlacement
GetDC
ValidateRect
GetRawInputData
GetKeyboardState
SetLayeredWindowAttributes
IsWindow
SystemParametersInfoW
MessageBoxW
MapVirtualKeyExW
RegisterWindowMessageA
GetKeyNameTextW
DestroyMenu
TrackPopupMenu
GetCursorPos
SetMenuDefaultItem
AppendMenuW
CreatePopupMenu
SetCapture
GetWindowRect
SendMessageTimeoutW
AllowSetForegroundWindow
FindWindowW
GetAsyncKeyState
GetKeyboardLayout
CloseClipboard
IsClipboardFormatAvailable
GetClassNameW
OpenClipboard
MsgWaitForMultipleObjectsEx
CreateWindowExW
RegisterClassExW
DefWindowProcW
ShowCursor
GetClassInfoExW
CloseTouchInputHandle
RegisterTouchWindow
GetTouchInputInfo
advapi32
RegGetValueW
RegDeleteTreeW
RegDeleteKeyW
RevertToSelf
ImpersonateAnonymousToken
RegDeleteKeyValueW
RegSetKeyValueW
RegQueryValueExW
SystemFunction036
gdi32
SetBitmapBits
CreateCompatibleBitmap
CreateBitmap
DeleteObject
GetDeviceCaps
CreateRectRgn
ChoosePixelFormat
SetPixelFormat
DescribePixelFormat
SwapBuffers
ole32
RegisterDragDrop
StringFromIID
OleInitialize
PropVariantClear
CoSetProxyBlanket
CoInitializeSecurity
RevokeDragDrop
CoDecrementMTAUsage
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysAllocStringLen
SysStringLen
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SetErrorInfo
GetErrorInfo
combase
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoTaskMemFree
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
mmdevapi
ActivateAudioInterfaceAsync
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
ws2_32
freeaddrinfo
WSAStartup
getpeername
recvfrom
getaddrinfo
socket
WSASendMsg
getsockname
WSAIoctl
WSASocketW
WSASend
recv
connect
sendto
getsockopt
WSAGetLastError
shutdown
closesocket
bind
setsockopt
ioctlsocket
send
iphlpapi
NotifyUnicastIpAddressChange
GetAdaptersAddresses
NotifyRouteChange2
CancelMibChangeNotify2
GetIfEntry2
SendARP
mfreadwrite
MFCreateSourceReaderFromMediaSource
shell32
DragFinish
Shell_NotifyIconW
SHGetKnownFolderPath
ExtractIconExW
DragQueryFileW
SHCreateItemFromParsingName
mfplat
MFCreateAttributes
MFShutdown
MFCreateMediaType
MFStartup
mf
MFEnumDeviceSources
dwmapi
DwmGetWindowAttribute
DwmSetWindowAttribute
DwmEnableBlurBehindWindow
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
coremessaging
CreateDispatcherQueueController
d3d11
D3D11CreateDevice
CreateDirect3D11DeviceFromDXGIDevice
ntdll
NtCancelIoFileEx
NtDeviceIoControlFile
RtlNtStatusToDosError
NtReadFile
NtCreateNamedPipeFile
NtWriteFile
NtCreateFile
NtOpenFile
bcrypt
BCryptGenRandom
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertAddEncodedCertificateToStore
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertCloseStore
CertSetCertificateContextProperty
opengl32
wglMakeCurrent
wglGetProcAddress
wglGetCurrentContext
wglCreateContext
wglShareLists
wglGetCurrentDC
wglDeleteContext
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmAssociateContextEx
uxtheme
SetWindowTheme
Name
.text
Size
18.1MB
Virtual Size
18.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rodata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
71KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
242KB
Virtual Size
242KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=169, id=261, version=33145,
count=55, id=260, version=33145,
count=33, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=46, id=261, version=35207,
count=11, id=257, version=33145,
count=4, id=259, version=35229,
count=405, id=1, productName=Unmarked objects,
count=152, id=260, version=35229,
count=86, id=261, version=35229,
count=1072, productName=Unmarked objects (old),
count=1, id=255, version=35229,
count=1, id=258, version=35229,