Brutoforce Seed.zip
- SHA256 41d3d5f3b3588a85cc2dee55179814358fd1f618aec8f914d45f94d5ab44a00c
Behavioral task
behavioral1
Sample
Brutoforce Seed.zip
Resource
win7-20240704-en
windows7-x64
0 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Brutoforce Seed.zip
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
1200 seconds
General
- Target Brutoforce Seed.zip
- Size 9.9MB
- Sample240722-nl8twavfqe
- SHA256 41d3d5f3b3588a85cc2dee55179814358fd1f618aec8f914d45f94d5ab44a00c
- MD5 6803881d7cb112d76b96e5f4c05fed6d
- SHA1 8bb9eb5f60c3cf454841d3d0228c02e7241be739
- SHA512 ca14a068e5c44a1515eff2ce7571cd1dc14f455893f249e428a001b62a6540767cc92d2356225a830b7803359299afbecd61bd3769e5f0fa919a06c2e4e2a023
- SSDEEP 196608:8MxAnxwAs8jkTh2KUfDD0z2F69f4TVdsROay/OBelkm5M7N99/:8MinxtZjkwKyP1gfkRay/OeSN3
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Deciever.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Deciever.exe
File Explorer
-
Brutoforce Seed.zip.zip 9.9MB
-
Deciever.exe.exe 10.0MB
-
deciever.pyc6KB
-
Newtonsoft.Json.dll.dll 685KB
-
Newtonsoft.Json.xml.xml 693KB
Deciever.exe
- IMPHASH c772e3ad1769cd59d2c6cd8e3b2dbd0c
- SHA256 a6284f5bbbf3a4ed0d6d75fd0ae09a251b5d8ef2a156da46d967c0a07179571e
- MD5 cf98e0864265f756679d2defb242c55d
- SHA1 98005d16d0d1f6f7451a990996622bb965b51bc3
- SHA512 62eb4925aff45183cd169c49573b3351194f1d47e30f238b37b4b7d53eaec059020430d6bb59ca8dcd66a0e116fcddbb5e2b27196f9192039412ce20bd3ae5c6
- SSDEEP 196608:abFaFU1/wbITLwOjUqACsXDjDyfbdJolpPgToa10/t+FOnJZMq5kB6l7:o8FU1obI/aCEDMJ83a101+sRq6
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29615
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shell32
SHGetFolderPathW
kernel32
SetLastError
HeapSize
CreateFileW
SetFileAttributesW
WriteFile
CloseHandle
Sleep
CreateProcessW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetProcessHeap
RaiseException
RtlUnwind
GetLastError
WriteConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
Name
.text
Size
113KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9.8MB
Virtual Size
9.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=169, id=261, version=30795,
count=21, id=260, version=30795,
count=21, id=259, version=33731,
count=18, id=260, version=33731,
count=5, id=257, version=30795,
count=101, id=1, productName=Unmarked objects,
count=77, id=261, version=33731,
count=1, id=261, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
deciever.pyc
- SHA256 f8a40f40b8f2ec9391c6c25c8a18adb33d8b8abd178d7f52f64109a90c38ac01
- MD5 8bc39f9a5a8cc514f7a11517fdee2c75
- SHA1 1388d95cd4e44cfe55b3fc31b66c1425ebd9df3e
- SHA512 32c540d8936c262bf4f7ce5f7a08d934bbf520fafdb60fc181e30b07e0c2825ada8d5bed7c412c5dc076d004e457bfc90ab44c7fba97a9ece90156ac72664d35
- SSDEEP 192:ckTdUWcQxxQ0sj24K1r1yYOBj7RSevGd1wa30:dTeWNQ0715yYO3SevC1wf
- MD5 SHA1 SHA512 SSDEEP
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- MD5 SHA1 SHA512 SSDEEP
Digest
2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Mar 17, 2021
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
698886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
675KB
Virtual Size
675KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.xml
- SHA256 2d46b37b086d6848af5f021d2d7a40581ce78aadd8ee39d309aee4771a0eeccf
- MD5 f414b3f68fe7c4f094b8fe8382f858c9
- SHA1 66ee1b3266fcedde433b392156ab4a24262b2f34
- SHA512 19b2feb40c2e9d4d20d9a21f88f6ecea773060c056b8cbbd21a6eec41486dc5fc101e6c31129b0d53466d04709bcd4ed777058ddfb02532242b43e253a7b24bd
- SSDEEP 6144:XqqUmk/RikeaG0rH3jGHdl0/InHHpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DUq
- MD5 SHA1 SHA512 SSDEEP