ko89MJS[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ko89MJS.zip
Size

10.2MB
MD5

1c6d4cd9f61dfaf8574f39e02ed099ed
SHA1

aba1aab0e44222ca019a5c104cf50518470d1b41
SHA256

bf2d600fcbb9878b11059bf1bf137bd22152acd9b83aeb48dba097958b8938df
SHA512

7a2b2fa2faa0cdc2bddd02cc37f0c4cfb8a14980ae4699a6ab4e0f00f552fadec75234adfa0d3c55dc1b5d7c05a8bfe40bbd2af8fe826f72f070cf0917b57315
SSDEEP

196608:R07sugX5e3QDsw0inULvw5j2LcUCVYDw1cWlutAhreLEAy:R0Jgpahw0inewowWeutAh5Ay

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/1.5/fixer.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1.5/fixer.exe
unpack001/1.5/pyarmor_runtime_004360/pyarmor_runtime.pyd

Files

ko89MJS.zip
.zip
1.5/accounts.txt
1.5/config.json
1.5/cracked_info.txt
1.5/data.txt
1.5/fixer.exe
.exe windows:5 windows x64 arch:x64

bae3d3e8262d7ce7e9ee69cc1b630d3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetWindowThreadProcessId
ShowWindow

kernel32

GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
SetDllDirectoryW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
HeapSize
GetLastError
WriteConsoleW
SetEndOfFile
GetStartupInfoW
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fixer.pyc
1.5/keyauth.py
1.5/main.py
1.5/proxys.txt
1.5/pyarmor_runtime_004360/__init__.py
1.5/pyarmor_runtime_004360/pyarmor_runtime.pyd
.dll windows:4 windows x64 arch:x64

03a4c14cb05d7d215fc171ec07af0d09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

python312

PyBuffer_FillInfo
PyBuffer_Release
PyBytes_AsString
PyBytes_AsStringAndSize
PyBytes_FromStringAndSize
PyBytes_Type
PyCFunction_GetSelf
PyCFunction_Type
PyCMethod_New
PyCell_Get
PyCell_New
PyCell_Set
PyCode_GetCode
PyCode_Type
PyComplex_FromCComplex
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDict_Copy
PyDict_DelItem
PyDict_GetItem
PyDict_GetItemString
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Type
PyDict_Update
PyErr_CheckSignals
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Restore
PyErr_SetFromWindowsErr
PyErr_SetObject
PyErr_SetString
PyEval_EvalCode
PyEval_GetBuiltins
PyEval_GetFrame
PyEval_GetGlobals
PyExc_AttributeError
PyExc_EOFError
PyExc_ImportError
PyExc_NotImplementedError
PyExc_RuntimeError
PyExc_StopIteration
PyExc_SystemError
PyExc_SystemExit
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_ValueError
PyException_SetCause
PyException_SetContext
PyException_SetTraceback
PyFloat_FromDouble
PyFloat_Pack8
PyFloat_Type
PyFloat_Unpack8
PyFrame_GetCode
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetCode
PyFunction_NewWithQualName
PyImport_ExecCodeModuleObject
PyImport_GetModule
PyImport_GetModuleDict
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleLevelObject
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_GetItem
PyList_New
PyList_Sort
PyList_Type
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsVoidPtr
PyLong_FromLong
PyLong_FromVoidPtr
PyLong_Type
PyMarshal_WriteObjectToString
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemoryView_FromBuffer
PyMethod_Function
PyMethod_Type
PyModule_Create2
PyModule_GetDict
PyModule_GetFilenameObject
PyModule_GetName
PyModule_Type
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMatrixMultiply
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Invert
PyNumber_Lshift
PyNumber_MatrixMultiply
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_TrueDivide
PyNumber_Xor
PyOS_double_to_string
PyOS_string_to_double
PyObject_ASCII
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CheckBuffer
PyObject_DelItem
PyObject_Format
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetBuffer
PyObject_GetItem
PyObject_GetIter
PyObject_IsSubclass
PyObject_IsTrue
PyObject_Repr
PyObject_RichCompare
PyObject_SetAttr
PyObject_SetItem
PyObject_Str
PyObject_VectorcallDict
PySequence_Check
PySequence_Contains
PySequence_List
PySequence_Tuple
PySet_Add
PySet_New
PySet_Type
PySlice_New
PySys_GetObject
PyThreadState_Get
PyTraceBack_Here
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_SetItem
PyTuple_Size
PyTuple_Type
PyType_IsSubtype
PyUnicode_AsEncodedString
PyUnicode_AsUTF8
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyUnicode_FromFormat
PyUnicode_FromKindAndData
PyUnicode_FromString
PyUnicode_InternInPlace
PyUnicode_New
PyUnicode_Type
Py_BuildValue
Py_DecRef
Py_IncRef
Py_InspectFlag
_PyArg_ParseTuple_SizeT
_PyBytes_Resize
_PyCode_Validate
_PyDict_GetItemWithError
_PyErr_Clear
_PyErr_ExceptionMatches
_PyErr_Format
_PyErr_GetTopmostException
_PyErr_SetObject
_PyErr_SetString
_PyList_Extend
_PyLong_AsInt
_PyLong_FromByteArray
_PyLong_New
_PyModuleSpec_IsInitializing
_PyObject_CallFunction_SizeT
_PyObject_CallMethod
_PyObject_CallMethod_SizeT
_PyObject_FastCall
_PyObject_LookupAttr
_PyObject_LookupSpecialId
_PyObject_MakeTpCall
_PyObject_NewVar
_PyRuntime
_PySet_NextEntry
_PyThreadState_GetCurrent
_PyUnicode_JoinArray
_Py_BuildValue_SizeT
_Py_CheckFunctionResult
_Py_Dealloc
_Py_EllipsisObject
_Py_FalseStruct
_Py_NoneStruct
_Py_TrueStruct
_Py_ctype_table
_Py_hashtable_compare_direct
_Py_hashtable_destroy
_Py_hashtable_hash_ptr
_Py_hashtable_new_full
_Py_hashtable_set

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

iphlpapi

GetAdaptersAddresses
GetNetworkParams

kernel32

CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FlushViewOfFile
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock

msvcrt

__iob_func
_amsg_exit
_errno
_get_osfhandle
_initterm
_lock
_mktime64
_snprintf
_stat64
_time64
_unlock
_vsnprintf
abort
calloc
clock
exit
fprintf
fputc
fread
free
fwrite
getc
getenv
isprint
isxdigit
malloc
memcmp
memcpy
memmove
memset
rand
realloc
signal
sprintf
srand
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strstr
toupper
vfprintf

user32

wsprintfA

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
htons
inet_ntoa
ioctlsocket
ntohl
recv
recvfrom
select
send
sendto
setsockopt
socket

Exports

Exports

PyInit_pyarmor_runtime

Sections

.text
Size: 508KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
1.5/solver/Packaged.capsolver-automatic.zip
1.5/solver/_locales/en/messages.json
1.5/solver/_locales/es/messages.json
1.5/solver/_locales/ru/messages.json
1.5/solver/_locales/zh/messages.json
1.5/solver/accounts.txt
1.5/solver/assets/config.json
1.5/solver/assets/content.css
1.5/solver/assets/images/logo.png
.png
1.5/solver/assets/images/logo_solved.png
.png
1.5/solver/assets/inject/injected.js
.js
1.5/solver/background.js
.js
1.5/solver/config.json
1.5/solver/core-content-script.js
.js
1.5/solver/data.txt
1.5/solver/dom.js
.js
1.5/solver/funcaptcha-recognition.js
.js
1.5/solver/hcaptcha-recognition.js
.js
1.5/solver/icons/icon-128x128.png
.png
1.5/solver/icons/icon-16x16.png
.png
1.5/solver/icons/icon-48x48.png
.png
1.5/solver/image-to-text.js
.js
1.5/solver/manifest.json
1.5/solver/my-content-script.js
.js
1.5/solver/recaptcha-recognition.js
.js
1.5/solver/www/assets/ErrorNotFound.5f6c1ded.js
.js
1.5/solver/www/assets/KFOkCnqEu92Fr1MmgVxIIzQ.34e9582c.woff
1.5/solver/www/assets/KFOlCnqEu92Fr1MmEU9fBBc-.9ce7f3ac.woff
1.5/solver/www/assets/KFOlCnqEu92Fr1MmSU5fBBc-.bf14c7d7.woff
1.5/solver/www/assets/KFOlCnqEu92Fr1MmWUlfBBc-.e0fd57c0.woff
1.5/solver/www/assets/KFOlCnqEu92Fr1MmYUtfBBc-.f6537e32.woff
1.5/solver/www/assets/KFOmCnqEu92Fr1Mu4mxM.f2abf7fb.woff
1.5/solver/www/assets/Poppins-Black.9f39397b.woff2
1.5/solver/www/assets/Poppins-BlackItalic.fc73cdef.woff2
1.5/solver/www/assets/Poppins-Bold.d83ab9cc.woff2
1.5/solver/www/assets/Poppins-BoldItalic.f401d78d.woff2
1.5/solver/www/assets/Poppins-ExtraBold.b98326c2.woff2
1.5/solver/www/assets/Poppins-ExtraBoldItalic.4ed4ee3c.woff2
1.5/solver/www/assets/Poppins-ExtraLight.f5b6d5dd.woff2
1.5/solver/www/assets/Poppins-ExtraLightItalic.70eb32b6.woff2
1.5/solver/www/assets/Poppins-Italic.e4f71a95.woff2
1.5/solver/www/assets/Poppins-Light.fb1ca566.woff2
1.5/solver/www/assets/Poppins-LightItalic.bda4ebaf.woff2
1.5/solver/www/assets/Poppins-Medium.9b9b4a38.woff2
1.5/solver/www/assets/Poppins-MediumItalic.7d831f05.woff2
1.5/solver/www/assets/Poppins-Regular.efb99a75.woff2
1.5/solver/www/assets/Poppins-SemiBold.f5bbc891.woff2
1.5/solver/www/assets/Poppins-SemiBoldItalic.631bd3f6.woff2
1.5/solver/www/assets/Poppins-Thin.7c230e71.woff2
1.5/solver/www/assets/Poppins-ThinItalic.a1a633c9.woff2
1.5/solver/www/assets/Union.e4f5e32d.svg
1.5/solver/www/assets/arrow.1ab57550.svg
1.5/solver/www/assets/balance.ec909fe5.svg
1.5/solver/www/assets/cloudflare.a164bb78.svg
1.5/solver/www/assets/copy.b3d46815.svg
1.5/solver/www/assets/dataDome.047813e4.svg
1.5/solver/www/assets/en-US.553867d3.svg
1.5/solver/www/assets/es.6fe80291.svg
1.5/solver/www/assets/flUhRq6tzZclQEJ-Vdg-IuiaDsNa.fd84f88b.woff
1.5/solver/www/assets/flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.83be7b2f.woff2
1.5/solver/www/assets/funCaptcha.4f6d4ba4.svg
1.5/solver/www/assets/geetest.5dfc422c.svg
1.5/solver/www/assets/hCaptcha.0406a4eb.svg
1.5/solver/www/assets/index.077525ff.js
.js
1.5/solver/www/assets/index.3f70634b.css
1.5/solver/www/assets/key.201fc3f4.svg
1.5/solver/www/assets/lock.8b188c3a.svg
1.5/solver/www/assets/logo-text.10d5eeb5.png
.png
1.5/solver/www/assets/logo-text.e47c19eb.svg
1.5/solver/www/assets/logo.eb4b912e.png
.png
1.5/solver/www/assets/question.6085c9ed.svg
1.5/solver/www/assets/reCaptcha.63436d93.svg
1.5/solver/www/assets/ru.6c62f886.svg
1.5/solver/www/assets/settings.8bf367a7.svg
1.5/solver/www/assets/success.42815aad.svg
1.5/solver/www/assets/textToImage.8dbe0bf9.svg
1.5/solver/www/assets/tips.e99d9ebe.svg
1.5/solver/www/assets/zh-CN.c1f22841.svg
1.5/solver/www/favicon.ico
1.5/solver/www/index.html
.html
1.5/solver/www/logo.png
.png
1.5/to install.txt

Sharing

General

Malware Config

Signatures

Files

bae3d3e8262d7ce7e9ee69cc1b630d3a

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 3KB - Virtual size: 12KB

.pdata Size: 9KB - Virtual size: 8KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 60KB - Virtual size: 59KB

.reloc Size: 2KB - Virtual size: 1KB

03a4c14cb05d7d215fc171ec07af0d09

Headers

File Characteristics

Imports

python312

advapi32

iphlpapi

kernel32

msvcrt

user32

ws2_32

Exports

Exports

Sections

.text Size: 508KB - Virtual size: 508KB

.data Size: 18KB - Virtual size: 17KB

.rdata Size: 48KB - Virtual size: 48KB

.pdata Size: 9KB - Virtual size: 8KB

.xdata Size: 10KB - Virtual size: 9KB

.bss Size: - Virtual size: 25KB

.edata Size: 512B - Virtual size: 93B

.idata Size: 13KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 672B

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 3KB - Virtual size: 12KB

.pdata
Size: 9KB - Virtual size: 8KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 60KB - Virtual size: 59KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 508KB - Virtual size: 508KB

.data
Size: 18KB - Virtual size: 17KB

.rdata
Size: 48KB - Virtual size: 48KB

.pdata
Size: 9KB - Virtual size: 8KB

.xdata
Size: 10KB - Virtual size: 9KB

.bss
Size: - Virtual size: 25KB

.edata
Size: 512B - Virtual size: 93B

.idata
Size: 13KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 672B