Behavioral task
behavioral1
Sample
LightCut-Video-Editor.bin.zip
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
LightCut-Video-Editor.bin.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
LightCut-Video-Editor.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
LightCut-Video-Editor.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
mPSCzi.pyc
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
mPSCzi.pyc
Resource
win10v2004-20240709-en
General
-
Target
LightCut-Video-Editor.bin.zip
-
Size
308KB
-
MD5
0583ecf684a23fbd1a0b7447392caae6
-
SHA1
30af26ecc9829ae82b2a5a08c8a71587939e1520
-
SHA256
d08e62a1562f00640e529f66248f8c321a1a8f41917e5abe19f10512ce1b276a
-
SHA512
b80a5b7a3399dab885f1a372f041bbee470022ea0daf0e78c9882427cb412e18367975533fcf88099f0fd2323dc9b43e0a0e4053a06a94941c1522f029052788
-
SSDEEP
6144:tWHpy+tGzQ+u6nehrHaTXtgaGCm4O4NNuE/uF5GswAGaKV4z+/kA11pNJ/s1:wHpyrM+uiMr6T9VW4ywuDGtA6VV/kA1i
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/LightCut-Video-Editor.bin pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LightCut-Video-Editor.bin
Files
-
LightCut-Video-Editor.bin.zip.zip
Password: infected
-
LightCut-Video-Editor.bin.exe windows:4 windows x64 arch:x64
Password: infected
7330f475a1ba894c33dabb63cbd6403c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
OpenProcessToken
comctl32
LoadIconMetric
gdi32
CreateFontIndirectW
DeleteObject
SelectObject
kernel32
CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
CreateSymbolicLinkW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetFinalPathNameByHandleW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetTempPathW
InitializeCriticalSection
K32EnumProcessModules
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryExW
LocalFree
MulDiv
MultiByteToWideChar
RemoveDirectoryW
SetConsoleCtrlHandler
SetDllDirectoryW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler
api-ms-win-crt-convert-l1-1-0
mbstowcs
strtoul
wcstombs
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
_wputenv_s
api-ms-win-crt-filesystem-l1-1-0
_wfullpath
_wstat64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
memcmp
memcpy
strchr
wcschr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
__p__wcmdln
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_exit
_getpid
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
_wcserror
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vswprintf
_fileno
_get_osfhandle
_wfopen
_wtempnam
clearerr
fclose
feof
ferror
fflush
fread
fseek
ftell
fwrite
setbuf
api-ms-win-crt-string-l1-1-0
_strdup
_stricmp
_wcsdup
_wcsdup
_wcsnicmp
iswctype
memset
strcmp
strcpy
strlen
strncat
strncmp
wcscat
wcscmp
wcslen
wcsncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
user32
CreateWindowExW
DestroyIcon
DialogBoxIndirectParamW
DrawTextW
EndDialog
GetClientRect
GetDC
GetDialogBaseUnits
GetMessageW
GetWindowLongPtrW
InvalidateRect
MessageBoxA
MessageBoxW
MoveWindow
PostMessageW
ReleaseDC
SendMessageW
SetWindowLongPtrW
SystemParametersInfoW
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 21KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
mPSCzi.pyc