b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81

Sharing

Copy URL Twitter E-mail

General

Target
b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81
Size 5.4MB
Sample240609-hybf9agb38
SHA256 b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81
MD5 29fad3dc8d526dfa3289166f87c53adb
SHA1 7c197878d5f76e853a53f1e2dd38e2f4b7543a5c
SHA512 ab2d41f6f9578ec4f86d4a78061aabe593ad4a4cc9a0a90fc3aa84eb194619bb923e23614c0cf8b33646bd43344c5ed065c4dcb9451b7d55ff3d0b90e989c547
SSDEEP 98304:dZU8gB+g3G76T64PbR75hTTbW0mK2ZvfBjtiu/JCPiOHeVPOOwexy2sovyR7:08gsVGTfR6m2Zpn/JCqn5E2sov
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81

File Explorer

b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81

.exe 5.4MB
test.pyc

3KB

b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81

IMPHASH a2c1f4d5eeaf95bdec6a6d4cd9f09091
SHA256 b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81
MD5 29fad3dc8d526dfa3289166f87c53adb
SHA1 7c197878d5f76e853a53f1e2dd38e2f4b7543a5c
SHA512 ab2d41f6f9578ec4f86d4a78061aabe593ad4a4cc9a0a90fc3aa84eb194619bb923e23614c0cf8b33646bd43344c5ed065c4dcb9451b7d55ff3d0b90e989c547
SSDEEP 98304:dZU8gB+g3G76T64PbR75hTTbW0mK2ZvfBjtiu/JCPiOHeVPOOwexy2sovyR7:08gsVGTfR6m2Zpn/JCqn5E2sov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CreateProcessW DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW FormatMessageA GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetShortPathNameW GetStartupInfoW GetSystemTimeAsFileTime GetTempPathW GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetDllDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

__argc __dllonexit __iob_func __lconv_init __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _fileno _findclose _findfirst64 _findnext64 _fmode _fullpath _get_osfhandle _getpid _initterm _lock _mkdir _onexit _rmdir _setmode _stat64 _strdup _tempnam _unlock _vsnprintf _wcmdln _wfopen abort calloc clearerr exit fclose feof ferror fflush fprintf fread free fseek ftell fwrite getenv malloc mbstowcs memcpy memset remove setbuf setlocale signal sprintf strcat strchr strcmp strcpy strlen strncat strncmp strncpy strrchr strtok vfprintf wcslen

user32

MessageBoxA

ws2_32

ntohl

Name

.text

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b2c422f242eae9bc5c6909f91b6438258fe90b6959ed1c8730836c2df6be3d81

kernel32

msvcrt

user32

ws2_32

generic

test.pyc