Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
Microsoft Visual C++ v6.0 DLL
Symbol obfuscation
Very high
1 malicious · 4 files
EXE2c38d87650929640b2f04d813e1e6224Lumma Stealer
Structure
BINOverlay_3c1df609.bin
BINResources
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_3c1df609.bin (11411 bytes) |
| Module Name | TessaTessaWilliam.lnkozbw |
| Full Name | TessaTessaWilliam.lnkozbw |
| EntryPoint | |
| Scope Name | TessaTessaWilliam.lnkozbw |
| Scope Type | ModuleDef |
| Kind | Console |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | TessaTessaWilliam |
| Assembly Version | 9.0.4.6 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 35 |
| Main Method | |
| Main IL Instruction Count | 4 |
| Main IL | |
LummaEncrypted@00015976 [dddddddd]
UNKNWOWNmalicious
LummaEncrypted@0001B4AB [9876543210]
UNKNWOWNmalicious
?huhuhuhu
LummaEncrypted@00064052 [0123456789abcdef]
UNKNWOWNmalicious
?huhuhuhu
LummaEncrypted@0006407A [00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
UNKNWOWNmalicious
huhuhuhuhuhuhuhuhuhuhu
LummaEncrypted@00065795 [000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
UNKNWOWNmalicious
huhuhuhuhuhuhuhuhuhuhu
LummaEncrypted@00065A38 [c8a131f8922d]
UNKNWOWNmalicious
Zhuhuhuhu
LummaEncrypted@00065F12 [b9abc76ce53b6fc3a03566f8f764f5ea]
UNKNWOWNmalicious
\???huhuhuhu
LummaEncrypted@0007BA28 [F7C6B63E2E47C088B97B4366DC5B68C37CA992C18646FD5BA3F8BDF29734427C]
UNKNWOWNmalicious
??v?N?huhuhuhuhuhuhuhuhuhuhu
LummaEncrypted@0007F4D0 [8dd1a5ab2dd4]
UNKNWOWNmalicious
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential