General

  • Target

    Executor.dist.zip

  • Size

    42.9MB

  • MD5

    c4f0204072149fa6fbd2631346950ec9

  • SHA1

    d52cbe284d69bfe996f8d6ecdce9b5573bf4d5ae

  • SHA256

    899c4c272d10729f88f952d76a059c391ccd59c5fe7969ae035a5d45df08bd2e

  • SHA512

    2f77144f972036b2c46baf03d0f17d40e47d74ec7494d55e7c2c7d1a19fa01bead3815b14f8ffc8c3814c3c4755b2d1c94273a2265730f7b5029a6b6b8b099bb

  • SSDEEP

    786432:0TSOXC7A9Lk0Fix4R7/5RmEaLDvZZwLBDvzV0cFftTQnG6x8Ni5571:02mCCLk0RRBRADZOvuqtTQnG6wi5h1

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 47 IoCs

    Checks for missing Authenticode signature.

Files

  • Executor.dist.zip
    .zip
  • Executor.dist/Crypto/Cipher/_Salsa20.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_aes.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_aesni.pyd
    .dll windows:6 windows x64 arch:x64

    bc234f2877830bc99ce39286541d6ef1


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_arc2.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_cbc.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_cfb.pyd
    .dll windows:6 windows x64 arch:x64

    b7b86a79048044d07db6b7de63b7c90e


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_ctr.pyd
    .dll windows:6 windows x64 arch:x64

    bc234f2877830bc99ce39286541d6ef1


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_des.pyd
    .dll windows:6 windows x64 arch:x64

    1ec87bbeffbe3bb450c29176d904b690


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_des3.pyd
    .dll windows:6 windows x64 arch:x64

    1ec87bbeffbe3bb450c29176d904b690


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_ecb.pyd
    .dll windows:6 windows x64 arch:x64

    760d82578721a074ac240db77368fcb0


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_eksblowfish.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_ocb.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Cipher/_raw_ofb.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_BLAKE2s.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_MD5.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_SHA1.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_SHA224.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_SHA256.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_SHA384.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_SHA512.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_ghash_clmul.pyd
    .dll windows:6 windows x64 arch:x64

    5ce92e7d1c0a7d3c28338120fb91aa68


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_ghash_portable.pyd
    .dll windows:6 windows x64 arch:x64

    200e5a8a397640442ee9fed8ad5a7ecb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Hash/_keccak.pyd
    .dll windows:6 windows x64 arch:x64

    2d71f25096805592caf0d27ca08982e5


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Math/_modexp.pyd
    .dll windows:6 windows x64 arch:x64

    76fdee7f152f5f03a0f34aa1cf7a8c79


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Protocol/_scrypt.pyd
    .dll windows:6 windows x64 arch:x64

    4ad07fe3afee3f621a47d59bc3c712f3


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Util/_cpuid_c.pyd
    .dll windows:6 windows x64 arch:x64

    760d82578721a074ac240db77368fcb0


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/Crypto/Util/_strxor.pyd
    .dll windows:6 windows x64 arch:x64

    760d82578721a074ac240db77368fcb0


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/QtCore.pyd
    .dll windows:6 windows x64 arch:x64

    8eb0c91389896b632fe63e3e7782a57e


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/QtGui.pyd
    .dll windows:6 windows x64 arch:x64

    2c7e2dbbd6e8838b2de87ed0c9443dbb


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/QtWidgets.pyd
    .dll windows:6 windows x64 arch:x64

    b5f0f9b187a0f4be562527dfdbbaa651


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/iconengines/qsvgicon.dll
    .dll windows:6 windows x64 arch:x64

    cb7bcafac90ccee76bfa5d1af9cbb951


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qgif.dll
    .dll windows:6 windows x64 arch:x64

    83ab23a3497602da865da8cb952268f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qicns.dll
    .dll windows:6 windows x64 arch:x64

    68eb3d9bbb362d72fd269c31936761fe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qico.dll
    .dll windows:6 windows x64 arch:x64

    35e88ae047c52cbe14244b0b041c3d03


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qjpeg.dll
    .dll windows:6 windows x64 arch:x64

    bb20e83974c98263f528b6a929a02bdf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qsvg.dll
    .dll windows:6 windows x64 arch:x64

    2cf21fe757a0a84f5b8a5594668ca036


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qtga.dll
    .dll windows:6 windows x64 arch:x64

    870b9d72e7052f0dd8d119bd2bf4aa05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qtiff.dll
    .dll windows:6 windows x64 arch:x64

    9fe4e69f865bd693d0a0abfdb4d03dc3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qwbmp.dll
    .dll windows:6 windows x64 arch:x64

    305f5f129c922b027d0dae792141dfe6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/imageformats/qwebp.dll
    .dll windows:6 windows x64 arch:x64

    75ef711dbfdc9de487f7cfea43217256


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/mediaservice/dsengine.dll
    .dll windows:6 windows x64 arch:x64

    889d8030c65f580ddd002fbfacbe74a4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/mediaservice/qtmedia_audioengine.dll
    .dll windows:6 windows x64 arch:x64

    e7cf9d1c85056f7d41bfc28554075538


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/mediaservice/wmfengine.dll
    .dll windows:6 windows x64 arch:x64

    52a5b8315ff73abbd15ef15794f718e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/platforms/qminimal.dll
    .dll windows:6 windows x64 arch:x64

    39e38171acc6c093221924a7d99f83ff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/platforms/qoffscreen.dll
    .dll windows:6 windows x64 arch:x64

    18e31d7343627c27ddaa6810fdb0e219


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/platforms/qwebgl.dll
    .dll windows:6 windows x64 arch:x64

    385c325af4a42a21095a1f79bf9b0227


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/platforms/qwindows.dll
    .dll windows:6 windows x64 arch:x64

    b8287a581b45f1f245f12be7c017f17f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/platformthemes/qxdgdesktopportal.dll
    .dll windows:6 windows x64 arch:x64

    8caf40786ed7a37d5d30395a043e4d75


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/printsupport/windowsprintersupport.dll
    .dll windows:6 windows x64 arch:x64

    376306594a1824669e49904ce763dfe6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/qt-plugins/styles/qwindowsvistastyle.dll
    .dll windows:6 windows x64 arch:x64

    3d3040efa646d84bc8bc2fb2d65abf99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/PyQt5/sip.pyd
    .dll windows:6 windows x64 arch:x64

    0b7d5e9d7715be871812774ddc678819


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_asyncio.pyd
    .dll windows:6 windows x64 arch:x64

    04f465ecd8eff83e2c18078c8c25456e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_bz2.pyd
    .dll windows:6 windows x64 arch:x64

    d0a62ab71a2b2ca69c6aba1f0a37fcdd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_cffi_backend.pyd
    .dll windows:6 windows x64 arch:x64

    1f8568e4a2373d2e7c1bf07e57b0e0f4


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    de64e4a0e2dbc68a0b413ce8099db5c3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_decimal.pyd
    .dll windows:6 windows x64 arch:x64

    73c2b50451f272a440f47564c3cbd631


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    b3b294bbb4a8941fd67b11ccbe0be65b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_lzma.pyd
    .dll windows:6 windows x64 arch:x64

    c39c7a021b2adfc11bb34f105f70355e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_multiprocessing.pyd
    .dll windows:6 windows x64 arch:x64

    ad5e2bc3f4742dadfaf9e74afc91a9f0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_overlapped.pyd
    .dll windows:6 windows x64 arch:x64

    48664681fdde7330197ca0b81cd0888e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_queue.pyd
    .dll windows:6 windows x64 arch:x64

    d39104d594ed5774205f94197c63bfbc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    332065e5d19d708832b034da27e5571a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_ssl.pyd
    .dll windows:6 windows x64 arch:x64

    f5dfcd62c36effcb7c07509271acfce1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/_uuid.pyd
    .dll windows:6 windows x64 arch:x64

    368b62645c11988f8173cf8bdd0fea25


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/bin/luau-compile.exe
    .exe windows:6 windows x64 arch:x64

    05f6a186cceb1a96a5b8a2c31b26b664


    Headers

    Imports

    Sections

  • Executor.dist/bin/luau-compiler.dll
    .dll windows:6 windows x64 arch:x64

    bbf198b4dc599908c6526c1cdb3564e2


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/certifi/cacert.pem
  • Executor.dist/charset_normalizer/md.pyd
    .dll windows:6 windows x64 arch:x64

    f8c0f377107b03e523f21dcf227dcf24


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/charset_normalizer/md__mypyc.pyd
    .dll windows:6 windows x64 arch:x64

    feb2f48749cb30e4f1a2a48b5a94a37c


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/concrt140.dll
    .dll windows:6 windows x64 arch:x64

    7f070c3864ce20e1b9879a9e3126cd30


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/cryptography/hazmat/bindings/_rust.pyd
    .dll windows:6 windows x64 arch:x64

    03d152f325b53c944333cfd20954b09c


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/input/init_script.txt
  • Executor.dist/libcrypto-1_1.dll
    .dll windows:6 windows x64 arch:x64

    11f2ed72076bbf7871eb95fd5b4e84b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/libeay32.dll
    .dll windows:6 windows x64 arch:x64

    a25b6a1fbab81f01d560a8ffbb0bae78


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/libffi-8.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/libssl-1_1.dll
    .dll windows:6 windows x64 arch:x64

    3adf02a15243fccc51beb2b37fbf071d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/markupsafe/_speedups.pyd
    .dll windows:6 windows x64 arch:x64

    0784085916c71ada4a57297042e38332


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/msvcp140_1.dll
    .dll windows:6 windows x64 arch:x64

    a1d1434dddb062f5f5d6615852def52b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/pyexpat.pyd
    .dll windows:6 windows x64 arch:x64

    c1efb4aba5d0a4e13411d9eacdb4e8d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/python3.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Executor.dist/python311.dll
    .dll windows:6 windows x64 arch:x64

    7bcba99f43dec2147effa329c42a4378


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/pythoncom311.dll
    .dll windows:6 windows x64 arch:x64

    1b264cd576a6b6117b47db03980bc455


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/pywintypes311.dll
    .dll windows:6 windows x64 arch:x64

    5b71a076f0c32bb52117188a36e3fec6


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5core.dll
    .dll windows:6 windows x64 arch:x64

    6d44a16d5801e1cdb9b3ba4cb45314b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5dbus.dll
    .dll windows:6 windows x64 arch:x64

    9b237e93afcc7ace33031c9cf4b68c7d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5gui.dll
    .dll windows:6 windows x64 arch:x64

    ddcb78f3a4297344c620aa83af64ddfd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5multimedia.dll
    .dll windows:6 windows x64 arch:x64

    7600665a844daa64d88eb4f04005092e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5network.dll
    .dll windows:6 windows x64 arch:x64

    c0e2c58de25ce77b283ad911460cea11


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5printsupport.dll
    .dll windows:6 windows x64 arch:x64

    ad1c8bbd41a8772e591598332fe1342c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5qml.dll
    .dll windows:6 windows x64 arch:x64

    17c45f48289bee293cec012345a8096d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5qmlmodels.dll
    .dll windows:6 windows x64 arch:x64

    53c7f625a0c46de552b4b53839bc1d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5quick.dll
    .dll windows:6 windows x64 arch:x64

    d6c8cb31820bb3c11dcd63f44dd924fb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5svg.dll
    .dll windows:6 windows x64 arch:x64

    6c684f5759e91250e01af7b49c78ca3f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5websockets.dll
    .dll windows:6 windows x64 arch:x64

    8293f00521f39ee8d36d02be4a182e21


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/qt5widgets.dll
    .dll windows:6 windows x64 arch:x64

    8ac796c200bcdb47fab6297f47883022


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/regex/_regex.pyd
    .dll windows:6 windows x64 arch:x64

    7d65cff68399b6c8132ea2f4c5430bf0


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/select.pyd
    .dll windows:6 windows x64 arch:x64

    fc4f7d736924aa67a1bd7b7b80894df9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/ssleay32.dll
    .dll windows:6 windows x64 arch:x64

    6db00d700097d01601bd093705a52cc9


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    bb6f6d951dbdd290ecf382ca57459172


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    7f07fd94e5bb907093556781cc464017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    bf380ca954cbf10d1a4cef9ec18e46fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor.dist/win32security.pyd
    .dll windows:6 windows x64 arch:x64

    0b789b8150f71358fde6ba70a30a6696


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/x07.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • Executor.dist/zstandard/_cffi.pyd
    .dll windows:6 windows x64 arch:x64

    b4c7d8b732a49f0803d88b34751d2661


    Headers

    Imports

    Exports

    Sections

  • Executor.dist/zstandard/backend_c.pyd
    .dll windows:6 windows x64 arch:x64

    967688a20660ed091a8fc54f4ff72575


    Headers

    Imports

    Exports

    Sections