ReflectiveLoader
Static task
static1
Behavioral task
behavioral1
Sample
pupyx64d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
pupyx64d.exe
Resource
win10v2004-20230220-en
General
-
Target
pupyx64d.exe
-
Size
5.4MB
-
MD5
c82153895cd1e58bb6b37d5a9d047f85
-
SHA1
b43967de2ca8cc11978d17625ea05635790afafa
-
SHA256
bf96c52be03450930272c415ebb796a60c68d9154ff88f034a5f333a133108e5
-
SHA512
12375b619af9cf1e8f7236c7d7e328d73d53a36b85169fe10c89efa21b4861d3faa03fbbf294a2404794c356f94e942bbf89cbfd44c4821ba240ebbf524435b4
-
SSDEEP
98304:YdUYjyv6cniGePYd2KIiAn5+AQ5YPpyfOEtEbgLmzsxe0HK:YmfuKIiANpyfftWUmzsLK
Malware Config
Signatures
Files
-
pupyx64d.exe.exe windows x64
7a7c36af67e548b6fae4229ada7324b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
DestroyWindow
RegisterClassExA
MsgWaitForMultipleObjects
TranslateMessage
UnregisterClassA
CreateWindowExA
PeekMessageA
DefWindowProcA
DispatchMessageA
advapi32
CreateProcessAsUserA
kernel32
ReadFile
SetStdHandle
SetFilePointer
WriteConsoleW
SetEndOfFile
RtlAddFunctionTable
AttachConsole
FreeLibrary
VirtualFree
OpenProcess
Thread32First
Thread32Next
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LoadLibraryA
OpenThread
CreateToolhelp32Snapshot
CloseHandle
WriteProcessMemory
ResumeThread
GetCurrentThreadId
CreateThread
CreateRemoteThread
GetModuleHandleA
GetThreadContext
SetThreadContext
ReadProcessMemory
CreateProcessA
TerminateProcess
CreatePipe
FindResourceA
GetModuleHandleExA
FindResourceExW
FindResourceW
LoadResource
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
InitializeCriticalSection
FindResourceExA
WideCharToMultiByte
LoadLibraryW
SizeofResource
LeaveCriticalSection
GetModuleFileNameW
MultiByteToWideChar
EnterCriticalSection
LocalAlloc
GetModuleFileNameA
LoadLibraryExA
LocalFree
CreateFileA
GetNativeSystemInfo
lstrlenA
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
GetThreadLocale
CreateFileMappingA
VirtualProtect
GetCommandLineW
SetErrorMode
GetCurrentProcess
GetTempFileNameA
GetTempPathA
GetCommandLineA
GetStartupInfoA
Sleep
ExitProcess
HeapReAlloc
SetConsoleCtrlHandler
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
WriteFile
GetStdHandle
RtlUnwindEx
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteConsoleA
GetConsoleOutputCP
Exports
Exports
Sections
.text Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 281KB - Virtual size: 289KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xzdata Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ