Behavioral task
behavioral1
Sample
protect_distribution(1).exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
protect_distribution(1).exe
Resource
win10v2004-20240802-en
General
-
Target
protect_distribution(1).exe
-
Size
6.9MB
-
MD5
cd6074780cfaf4208d8c7b0a65bad011
-
SHA1
8b40ba92e46409f31186cb865f602d866fe04bd4
-
SHA256
b553cd19fefd923981b8a14685630f844f9c3ced2fc392b0fad76d216f7334da
-
SHA512
a5e02a6b52886ecda98199f27395122e5ddec03ef48954b77c9d4fd50b38f865c5474fcda1412cb5e1c287179f0c05acbbea2013d068157bdeb25fb3109f5a24
-
SSDEEP
196608:Ji8YzGYYmk26SF2IeoJDAIZAxjV16l93At:5ywSk1k2R6vu
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule sample pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource protect_distribution(1).exe
Files
-
protect_distribution(1).exe.exe windows:6 windows x64 arch:x64
d21e351310836af6b870c53243cea736
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
gdi32
CreateFontIndirectW
advapi32
ConvertSidToStringSidW
kernel32
FlsGetValue
comctl32
ord380
user32
SendMessageW
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 909KB - Virtual size: 909KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ