670a8ccf0c6f9_LofiseNose.exe
First submission 2024-10-13 07:06:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 981.0 KB (1004544 bytes) |
| Compile time: | 2024-10-12 16:50:16 |
| MD5: | 400af20bb680795b1a047b588d8f1b26 |
| SHA1: | e2522424e4c0a34b83b0dd9769db8c5b01e289e9 |
| SHA256: | f4bc3f962d0b16cd40870324c2418b102680aca46ee4ab0b08ec19e3d4b86986 |
| Import Hash : | 285f07c66f98861b92460fa57c11d967 |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 35/77 VT report date: 2024-10-13 06:43:12 |
| Malware Type 1 | trojan |
| Threat Type 3 | jaik lummastealer pwsx |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://cache.ussc.org/player/670a8ccf0c6f9_LofiseNose.exe  |
cache.ussc.org |
2024-10-13 07:06:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x87979 | 555520 | fd10e776cbd664570fcbef95fdab967f4668fa69 | c7c4a37d148a8fe173a52f2f1af29a06 | |
| .rdata | 0x89000 | 0x10dbc | 69120 | cf63799da9c29642ef80beb6b421c5a1c0bbddd2 | d88d7c1acbd70cce211488f7c3ca9816 | |
| .data | 0x9a000 | 0x58bfc | 357888 | 75e1cdc7925add8dd665cf7615e80d8c478ea00d | c29d2184aedfcb7803e2b313da7bb597 | |
| .rsrc | 0xf3000 | 0x595 | 1536 | 67325892dd6c48f418d1a1ce99cf5976ef4148d5 | 365e5a183cc437b4e69a5f5af50b49a4 | |
| .reloc | 0xf4000 | 0x4a6c | 19456 | 556c80cf8e36164ba83a48e5abe35509a9ecac32 | a7eb2ed669f0f99fe00b5f577eacdc82 |
PE Resources 2
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xf30a0 | 888 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xf3418 | 381 |
Meta infos 9
| LegalCopyright: | \xa9 Microsoft Corporation. All rights reserved. |
| InternalName: | |
| FileVersion: | 10.0.19041.3636 (WinBuild.160101.0800) |
| CompanyName: | Microsoft Corporation |
| ProductVersion: | 10.0.19041.3636 |
| FileDescription: | Print Utility |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: | Print.Exe |
| ProductName: | Microsoft\xae Windows\xae Operating System |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 7
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| Hmscoree.dll |
| KERNEL32.dll |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| 7f3c2473d1e6.exe | 2024-10-13 06:20:02 | 21b00885507b17bb51792cbac9cd7d01 |
| 54f0fa329a53.exe | 2024-10-15 12:57:02 | 7de1a4a7d819cc98fccdea05f9326c1a |