General

  • Target

    passwords.zip

  • Size

    12.5MB

  • MD5

    5722cd0a65dedafe39b1922f36bf65b2

  • SHA1

    58094179630b70a6039726ae67919a76620eaa29

  • SHA256

    4286dcc363b7414595af7b379836ab0b54a33c1aca13c74e43522f6a473ad6c8

  • SHA512

    fac024bd5f58c32966835f5d4bedfff01fae5f4422eeda9bd0505c71f4edf89f491c0a76a0ada7043e2a5158378f24e540dbdbd58c06d6bce8eeacbff42f675a

  • SSDEEP

    393216:eI4zUBXVuedescebGUb3b86cNb06YOKL4ianpBh0Zw3hAlR6:eIUU3ued/Lfb3bthOK91Z4h8R6

Score
3/10

Malware Config

Signatures

  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 51 IoCs

    Checks for missing Authenticode signature.

Files

  • passwords.zip
    .zip

    Password: he

  • passwords/_internal/Cryptodome/Cipher/_ARC4.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_Salsa20.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_chacha20.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_pkcs1_decode.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    6df60195fdd7452f8a843a51882190b8


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_aes.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_aesni.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    bc234f2877830bc99ce39286541d6ef1


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_arc2.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_blowfish.pyd
    .dll windows:6 windows x64 arch:x64

    Password: he

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_cast.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_cbc.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_cfb.pyd
    .dll windows:6 windows x64 arch:x64

    b7b86a79048044d07db6b7de63b7c90e


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_ctr.pyd
    .dll windows:6 windows x64 arch:x64

    bc234f2877830bc99ce39286541d6ef1


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_des.pyd
    .dll windows:6 windows x64 arch:x64

    1ec87bbeffbe3bb450c29176d904b690


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_des3.pyd
    .dll windows:6 windows x64 arch:x64

    1ec87bbeffbe3bb450c29176d904b690


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_ecb.pyd
    .dll windows:6 windows x64 arch:x64

    760d82578721a074ac240db77368fcb0


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_eksblowfish.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_ocb.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Cipher/_raw_ofb.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_BLAKE2b.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_BLAKE2s.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_MD2.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_MD4.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_MD5.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_RIPEMD160.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_SHA1.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_SHA224.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_SHA256.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_SHA384.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_SHA512.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_ghash_clmul.pyd
    .dll windows:6 windows x64 arch:x64

    5ce92e7d1c0a7d3c28338120fb91aa68


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_ghash_portable.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_keccak.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Hash/_poly1305.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Math/_modexp.pyd
    .dll windows:6 windows x64 arch:x64

    76fdee7f152f5f03a0f34aa1cf7a8c79


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Protocol/_scrypt.pyd
    .dll windows:6 windows x64 arch:x64

    4ad07fe3afee3f621a47d59bc3c712f3


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/PublicKey/_ec_ws.pyd
    .dll windows:6 windows x64 arch:x64

    cdd6995c30329a77a5295ae502a42975


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/PublicKey/_ed25519.pyd
    .dll windows:6 windows x64 arch:x64

    f99664aebbac23e97e359e82f217470f


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/PublicKey/_ed448.pyd
    .dll windows:6 windows x64 arch:x64

    5722a5dc6fe65dcd39d26c76976ce230


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/PublicKey/_x25519.pyd
    .dll windows:6 windows x64 arch:x64

    bcca5f280737ee70d2e6d3cc1cfa5779


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Util/_cpuid_c.pyd
    .dll windows:6 windows x64 arch:x64

    760d82578721a074ac240db77368fcb0


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Cryptodome/Util/_strxor.pyd
    .dll windows:6 windows x64 arch:x64

    760d82578721a074ac240db77368fcb0


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/Pythonwin/mfc140u.dll
    .dll windows:6 windows x64 arch:x64

    7eedc677241d2accda18e4d0e39e2103


    Code Sign

    Headers

    Imports

    Sections

  • passwords/_internal/Pythonwin/win32ui.pyd
    .dll windows:6 windows x64 arch:x64

    6bb482096b7b0f6bebced9338e055ccd


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/VCRUNTIME140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/VCRUNTIME140_1.dll
    .dll windows:6 windows x64 arch:x64

    ae0bde6314fa2027b54ce04898f6ab69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_bz2.pyd
    .dll windows:6 windows x64 arch:x64

    ffa916dfdc50e863f51c0b6a5f824af6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_cffi_backend.cp39-win_amd64.pyd
    .dll windows:6 windows x64 arch:x64

    cac823b8d6875369af8d985d0998a119


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    acab193973eb512d7f050d2796711a6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_decimal.pyd
    .dll windows:6 windows x64 arch:x64

    53c2be0bb51ad122ee2c2f1d38f395e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    683c97b97649a9c2dc807b6f67c277a4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_lzma.pyd
    .dll windows:6 windows x64 arch:x64

    9737ade4e3ae3cc469d7407b46aaf0df


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_multiprocessing.pyd
    .dll windows:6 windows x64 arch:x64

    e5a0297f9773fa33773c0b4088dbbf91


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_queue.pyd
    .dll windows:6 windows x64 arch:x64

    14b0a3b332c78da6de03df6b128fe759


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    776b7c5bc1aea73a6f74ab11ef18f641


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_sqlite3.pyd
    .dll windows:6 windows x64 arch:x64

    a44aea3abf9659ac2e6d4ea9ce7a3efc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_ssl.pyd
    .dll windows:6 windows x64 arch:x64

    1fcf5043325b1343fa5a5d7a85838079


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/_uuid.pyd
    .dll windows:6 windows x64 arch:x64

    487ce342e0a9ae8bd7f0b115dd0ef2c4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/base_library.zip
    .zip
  • passwords/_internal/libcrypto-1_1.dll
    .dll windows:6 windows x64 arch:x64

    91e8dc4192e6f620254cd1fa32253e23


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/libffi-7.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/libssl-1_1.dll
    .dll windows:6 windows x64 arch:x64

    2f472d9395bd5de322dac91610524932


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/pip-20.2.3.dist-info/INSTALLER
  • passwords/_internal/pip-20.2.3.dist-info/LICENSE.txt
  • passwords/_internal/pip-20.2.3.dist-info/METADATA
  • passwords/_internal/pip-20.2.3.dist-info/RECORD
  • passwords/_internal/pip-20.2.3.dist-info/WHEEL
  • passwords/_internal/pip-20.2.3.dist-info/entry_points.txt
  • passwords/_internal/pip-20.2.3.dist-info/top_level.txt
  • passwords/_internal/pyexpat.pyd
    .dll windows:6 windows x64 arch:x64

    2ba9ffe0d37a6358b5626f9ea537e5d0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/python39.dll
    .dll windows:6 windows x64 arch:x64

    10a1420ae03520725c64d30cfcf52d9f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/pywin32_system32/pythoncom39.dll
    .dll windows:6 windows x64 arch:x64

    9684807c635d36da2720331ebeda88bf


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/pywin32_system32/pywintypes39.dll
    .dll windows:6 windows x64 arch:x64

    519b03ce289ae1d7efd01e45c4e65691


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/run_passwords.bat
    .bat .vbs
  • passwords/_internal/select.pyd
    .dll windows:6 windows x64 arch:x64

    72c31dcbd1c124b3eb380163acfe8f06


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/setuptools-49.2.1.dist-info/INSTALLER
  • passwords/_internal/setuptools-49.2.1.dist-info/LICENSE
  • passwords/_internal/setuptools-49.2.1.dist-info/METADATA
  • passwords/_internal/setuptools-49.2.1.dist-info/RECORD
  • passwords/_internal/setuptools-49.2.1.dist-info/WHEEL
  • passwords/_internal/setuptools-49.2.1.dist-info/dependency_links.txt
  • passwords/_internal/setuptools-49.2.1.dist-info/entry_points.txt
  • passwords/_internal/setuptools-49.2.1.dist-info/top_level.txt
  • passwords/_internal/setuptools-49.2.1.dist-info/zip-safe
  • passwords/_internal/sqlite3.dll
    .dll windows:6 windows x64 arch:x64

    2e54f6f5c641bbb521bb78e587832105


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    1020ee69c522eee9cc71cdcf6fac68fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/win32/_win32sysloader.pyd
    .dll windows:6 windows x64 arch:x64

    74e3af0ec76cf48c1542254bb8af8b2e


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/win32/win32api.pyd
    .dll windows:6 windows x64 arch:x64

    b0132279533d01b07d2edd39be366b2b


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/win32/win32crypt.pyd
    .dll windows:6 windows x64 arch:x64

    31115db8bfce32879725efc1024e0874


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/win32/win32trace.pyd
    .dll windows:6 windows x64 arch:x64

    e966429eda90b04ee7f9d52cdfed9748


    Headers

    Imports

    Exports

    Sections

  • passwords/_internal/win32com/shell/shell.pyd
    .dll windows:6 windows x64 arch:x64

    c411c1d16b2973d10ecdb058c9350839


    Headers

    Imports

    Exports

    Sections

  • passwords/passwords.exe
    .exe windows:5 windows x64 arch:x64

    bae3d3e8262d7ce7e9ee69cc1b630d3a


    Headers

    Imports

    Sections