build_5[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
build_5.exe
Size 13.1MB
Sample240907-k2f71swenh
SHA256 9e551b2304a6d8b72f38080a717d35900365dda5ce2aea2f2b14e90eba59cd7f
MD5 489841193bb17bed86528363199e802d
SHA1 b21527944d7f543b568aedbbe9833ffdb621b06a
SHA512 85c250271c44ccafd753495356a9a1bd8d940a8c3443c51e1d8d1fbe1d79ab39226e9e18402b088ec340b05f45e0caeb8a2f7c195479e3b5e9cdbd23260405df
SSDEEP 393216:cbPmYRQK7+zaDD3OhQfuSL3bMz0plnztTQCFMmKcZ:cbrRQtW6QmIAmln1QCFT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
build_5.exe

File Explorer

build_5.exe

.exe 13.1MB
downloader.pyc

.vbs 4KB

build_5.exe

IMPHASH e13316896f1bb7a3715fb5c49f0ff2e9
SHA256 9e551b2304a6d8b72f38080a717d35900365dda5ce2aea2f2b14e90eba59cd7f
MD5 489841193bb17bed86528363199e802d
SHA1 b21527944d7f543b568aedbbe9833ffdb621b06a
SHA512 85c250271c44ccafd753495356a9a1bd8d940a8c3443c51e1d8d1fbe1d79ab39226e9e18402b088ec340b05f45e0caeb8a2f7c195479e3b5e9cdbd23260405df
SSDEEP 393216:cbPmYRQK7+zaDD3OhQfuSL3bMz0plnztTQCFMmKcZ:cbrRQtW6QmIAmln1QCFT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CreateWindowExW PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongW GetWindowLongW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

IsValidCodePage GetStringTypeW GetFileAttributesExW HeapReAlloc FlushFileBuffers GetCurrentDirectoryW GetACP GetOEMCP GetModuleHandleW MulDiv GetLastError SetDllDirectoryW CreateFileW GetFinalPathNameByHandleW CloseHandle GetModuleFileNameW CreateSymbolicLinkW GetCPInfo GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW GetCurrentProcess LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize WriteConsoleW SetEndOfFile GetProcAddress GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId DecodePointer GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException GetCommandLineA GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW