218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa

Sharing

Copy URL Twitter E-mail

General

Target
218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa
Size 9.4MB
Sample240612-ntlpbatbke
SHA256 218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa
MD5 90c42205ffc96e7f69d42e93b0bcb677
SHA1 ef790ce123bed53db2fb2836e83ec8c6f5c8aeb6
SHA512 548c2d47a32c5d0aa5a8deb1be2a51bd697704bce25bd5dff9d3748fd363f0e903524f96075e2a06cda189bf3ebbf32f5d0881cdc56f5cb23ba75ed4df009be7
SSDEEP 196608:XL7IXY+H6QTLMMiUs5n7W99q7riZINE5MLXthfMcR5u7JhepRsBVximgEyVFAcm4:XQXY+XJClW7KrSINEI0468
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa

File Explorer

218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa

.exe 9.4MB
getCookie.pyc

11KB

218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa

IMPHASH 4c81aee3f868392a17d59aef2286d683
SHA256 218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa
MD5 90c42205ffc96e7f69d42e93b0bcb677
SHA1 ef790ce123bed53db2fb2836e83ec8c6f5c8aeb6
SHA512 548c2d47a32c5d0aa5a8deb1be2a51bd697704bce25bd5dff9d3748fd363f0e903524f96075e2a06cda189bf3ebbf32f5d0881cdc56f5cb23ba75ed4df009be7
SSDEEP 196608:XL7IXY+H6QTLMMiUs5n7W99q7riZINE5MLXthfMcR5u7JhepRsBVximgEyVFAcm4:XQXY+XJClW7KrSINEI0468
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CreateWindowExW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongW GetWindowLongW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetOEMCP GetACP IsValidCodePage GetFileAttributesExW FlushFileBuffers GetCurrentDirectoryW GetCPInfo GetEnvironmentStringsW GetModuleHandleW MulDiv GetLastError SetDllDirectoryW GetModuleFileNameW GetProcAddress GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW CloseHandle GetCurrentProcess LoadLibraryA LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetStringTypeW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetEnvironmentVariableW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent DecodePointer RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RaiseException GetCommandLineA ReadFile CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindClose FindFirstFileExW FindNextFileW SetStdHandle SetConsoleCtrlHandler DeleteFileW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Sharing

General

Malware Config

Signatures

File Explorer

218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa

user32

comctl32

kernel32

advapi32

gdi32

generic

getCookie.pyc