Lovely.zip
- SHA256 7b82e1bc75178550fe4ab279ce3a921912d4d8abf862bac8ef2c07fe589a339c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FirewallAPI.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
FirewallAPI.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
Behavioral task
behavioral3
Sample
Lovely.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral4
Sample
Lovely.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target Lovely.zip
- Size 12.5MB
- Sample261113-pg7lpabv31
- SHA256 7b82e1bc75178550fe4ab279ce3a921912d4d8abf862bac8ef2c07fe589a339c
- MD5 d3f984f65f6682f10cadbcf15dfaadb5
- SHA1 7202e4535007cdeace4a55c9b3d45d8654c74d2f
- SHA512 5f0b98d2cda9d0f7096b51abddb469962c0568cd239efd03ef8525683cef44243bf3115557496c8e8030c82854dffb0b18a9093d2447bf12fc54ae98998ea45f
- SSDEEP 196608:kNzQb8EfhX3yeC5fl3uBMUOULxo2hs1NHXYAB8l3Pr0pwy/K7Pu0KSm/jq375jUX:OOF4FpMUmzG97YjabOuOojq3NJsoU
- TLSH T1B6D6338DCEB0B7F96070F4F944A27075F15B715619AB3A383126A66E1C5C0CC8993EBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FirewallAPI.dll
File Explorer
-
Lovely.zip.zip 12.5MB
-
FirewallAPI.dll.dll 13.0MB
-
Lovely.exe.exe 87KB
FirewallAPI.dll
- IMPHASH e1c2e13a5322dfeb9f3df0b16bc5f2c7
- SHA256 4618b08c25eb187b77eb923bcb9860a8f0d61faae8ad19aded77cd744522822e
- MD5 9179704233f1d289dc760b4bcae29c7f
- SHA1 3f6ff62372d2db75044cfd10be903d12dc29a718
- SHA512 39899e0620049c40dae379c513dd3b9a1420a51be823c55e1a67b3acfa702538ec0b19b85b00ab4baaae4683179d6d0b69c0e84fb0ea186c5a6212511de53eac
- SSDEEP 196608:JHxcp9ym3nltDUJV2Hxcp9ym3EHxcp9ym3zHxcp9ym32Hxcp9ym3KHxcp9ym3aHk:bGplpBGpiGpdGpEGpYGpoGp
- TLSH T1B5D622136AF89E67E0B1DB74FF775460A7367D015A22B1EE1214790E2F31A8089A3737
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\fsegura\source\repos\every\x64\Release\every.pdb
kernel32
FindResourceW
LoadResource
LockResource
SizeofResource
GetTempPathW
HeapFree
WriteFile
CreateProcessW
LocalFree
DisableThreadLibraryCalls
WriteConsoleW
CloseHandle
GetCurrentProcess
lstrcpyW
GetProcessHeap
CreateFileW
HeapAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
advapi32
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
ConvertStringSidToSidW
NetworkIsolationEnumAppContainers
NetworkIsolationFreeAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationSetAppContainerConfig
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12.9MB
Virtual Size
12.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=36815,
count=15, id=260, version=36815,
count=35, id=261, version=36815,
count=5, id=257, version=33145,
count=100, id=1, productName=Unmarked objects,
count=2, id=265, version=37029,
count=1, id=256, version=37029,
count=1, id=255, version=37029,
count=1, id=151,
count=1, id=258, version=37029,
Lovely.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f8ed4cb272e52b7ef2b1c2672dbc6ace9f3ef752a38ce535265cfab891c9cbff
- MD5 13072c3b2a5a405b32a60d8cf1631bbc
- SHA1 6996ab027fe913cccb9f8e26ad0e9491d4a609b1
- SHA512 337311e0b2c0a22b749930f7212b5040d27c2b997404dc8cecfbbf89c86f2f5d5077d6157090078a8421acaa23850b24f963ba1b984b0600e9b80505bdb125c5
- SSDEEP 768:HzEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7ANg3CqnZ+6qmmlG0KdFumjDdFWf1:F1H5MiP1zrSh7WwZ3xmlGddFjjDdFWf1
- TLSH T1359339403BE84276FAFA8F749572E0104A79BDAA99B0D6CD2CD5A49F19F3B408321717
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
15:e7:df:e8:ec:a1:15:23:eb:c2:b4:b7:8c:b0:33:32:1d:6f:51:89:ce:ea:04:e5:a5:87:21:08:e2:58:51:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
Chains
Apr 14, 2020
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
87:31:26:0c:2a:b6:c3:19:a0:cf:19:aa:7c:e8:cb:d3:0b:aa:78:4b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
Chains
Apr 14, 2020
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
Serial Number
63:49:07:64:c0:61:2b:98:43:7b:f3:de:08:3b:29:d1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 15, 2020 - Jan 15, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
ab:dd:67:65:f2:5a:ef:50:00:00:00:00:55:91:e9:0c
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 5, 2018 - Jan 5, 2030
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 22, 2015 - Jun 22, 2029
Minor OS version
0
Major OS version
4
Entry point
61970
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Jenkins\Fiddler_Windows\workspace\Fiddler2\BundledExtensions\EnableLoopback\obj\Release Signed\EnableLoopback.pdb
mscoree
_CorExeMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ