cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c

Sharing

Copy URL Twitter E-mail

General

Target
cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c
Size 27.6MB
Sample240905-pyjwyssake
SHA256 cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c
MD5 58c3089e979bc1c7acaf08723e9792ad
SHA1 c1458aff50297f0257b8a3bde71c9c93da647725
SHA512 2a646ae632608aa2fd66860f0fdb99a867d1feb3dcdf37df7214d1c2e31eb5d2ab32477de8dccdbafbc5fa9368c8a2b461e973a2fbc22f7fcb8769c1a27b82ed
SSDEEP 786432:NVIU4riHYYNy6nFeIQRGR97mMtwnsNGn2D8DtGeYkOXrt:NKU8iHA6nVQRGX7mMtwsAU2IXt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe

File Explorer

cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c

.zip 27.6MB
06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe

.exe 27.8MB
main.pyc

780B

cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c

SHA256 cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c
MD5 58c3089e979bc1c7acaf08723e9792ad
SHA1 c1458aff50297f0257b8a3bde71c9c93da647725
SHA512 2a646ae632608aa2fd66860f0fdb99a867d1feb3dcdf37df7214d1c2e31eb5d2ab32477de8dccdbafbc5fa9368c8a2b461e973a2fbc22f7fcb8769c1a27b82ed
SSDEEP 786432:NVIU4riHYYNy6nFeIQRGR97mMtwnsNGn2D8DtGeYkOXrt:NKU8iHA6nVQRGX7mMtwsAU2IXt
MD5 SHA1 SHA512 SSDEEP

Password

infected

06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe

IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
SHA256 06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314
MD5 7ea99740a913fd01ab5b6d630a65f501
SHA1 fe11a17c1a403d6df28508d576c76ece07cce88b
SHA512 29f0f688d920bccc887f70710c3b6b01dd004dbef0c294bc57a46d7c460dc979ddb08a8d3c21df26510cbe3c380dc17dcc43e4fa86dc9d56dd4ff17de2280953
SSDEEP 393216:CUrTbCVFENlgdkQbaVxN2dAdpN7D9aJtW9dcGMBD2KSedViDKKeLQOshouIkPFt4:CUvRgdjtAd99dfGV6qLxwouZtRL
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW LCMapStringW CompareStringW FlsFree GetOEMCP GetCPInfo GetModuleHandleW MulDiv FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsSetValue FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Sharing

General

Malware Config

Signatures

File Explorer

cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c

06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

main.pyc