General

  • Target

    SideloadlySetup64.exe

  • Size

    126.3MB

  • MD5

    5fb52754697b1c7f56be096f8581dc5c

  • SHA1

    80e07fb5ad530b0159ffedd6a72fa23e89f4630a

  • SHA256

    d33bf91b11f6b1322724aaf76a5f0564285b990833a7d2877917446a9c8b30ae

  • SHA512

    41a8576492f5705ec7265d0b2fe8070c74e500efd44406d978e61a0fbfaf9a352296e4d36da9ac10a7e6cb9bbdd94faffa8b6ec175abdaeb46ac10d782b1e111

  • SSDEEP

    3145728:mIPLYzrmcXEisq3X1QBSLIpdfyFW/fISPI26hpMIaGABaaEK7gI2O:nYzrVEisqmELIppyFW/fISPj6DMNGu7B

Score
3/10

Malware Config

Signatures

  • Unsigned PE 54 IoCs

    Checks for missing Authenticode signature.

Files

  • SideloadlySetup64.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1

    6e7f9a29f2c85394521a08b9f31f6275


    Headers

    Imports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    80469f6834e579db68a646d49780b9d5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_Salsa20.pyd
    .dll windows:6 windows x64 arch:x64

    Password: 1

    77839d32ade4faf5e5ad8a6e22cfb91d


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_aes.pyd
    .dll windows:6 windows x64 arch:x64

    Password: 1

    77839d32ade4faf5e5ad8a6e22cfb91d


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_aesni.pyd
    .dll windows:6 windows x64 arch:x64

    Password: 1

    fb40b205ec63a24947bdcc113e4c4b66


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_arc2.pyd
    .dll windows:6 windows x64 arch:x64

    Password: 1

    aee3ea20ba976dd964acab8cf3c06e14


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_blowfish.pyd
    .dll windows:6 windows x64 arch:x64

    Password: 1

    aee3ea20ba976dd964acab8cf3c06e14


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_cast.pyd
    .dll windows:6 windows x64 arch:x64

    77839d32ade4faf5e5ad8a6e22cfb91d


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_cbc.pyd
    .dll windows:6 windows x64 arch:x64

    aee3ea20ba976dd964acab8cf3c06e14


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_cfb.pyd
    .dll windows:6 windows x64 arch:x64

    0d4b127a0dab93d1537d025833d54975


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_ctr.pyd
    .dll windows:6 windows x64 arch:x64

    fb40b205ec63a24947bdcc113e4c4b66


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_des.pyd
    .dll windows:6 windows x64 arch:x64

    e6a517ef2f3009d6d7427e4cc7f5d508


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_des3.pyd
    .dll windows:6 windows x64 arch:x64

    e6a517ef2f3009d6d7427e4cc7f5d508


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_ecb.pyd
    .dll windows:6 windows x64 arch:x64

    e22dc6bf1ee86180ded9ba2ecaefe868


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_ocb.pyd
    .dll windows:6 windows x64 arch:x64

    6b1de1c410e525514205237ea28fb2ac


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Cipher/_raw_ofb.pyd
    .dll windows:6 windows x64 arch:x64

    aee3ea20ba976dd964acab8cf3c06e14


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Hash/_BLAKE2s.pyd
    .dll windows:6 windows x64 arch:x64

    aee3ea20ba976dd964acab8cf3c06e14


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Hash/_MD5.pyd
    .dll windows:6 windows x64 arch:x64

    6b1de1c410e525514205237ea28fb2ac


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Hash/_SHA1.pyd
    .dll windows:6 windows x64 arch:x64

    6b1de1c410e525514205237ea28fb2ac


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Hash/_SHA256.pyd
    .dll windows:6 windows x64 arch:x64

    6b1de1c410e525514205237ea28fb2ac


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Hash/_ghash_portable.pyd
    .dll windows:6 windows x64 arch:x64

    77839d32ade4faf5e5ad8a6e22cfb91d


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Protocol/_scrypt.pyd
    .dll windows:6 windows x64 arch:x64

    f1aedc98395cadb757fe02fd97d11328


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Util/_cpuid_c.pyd
    .dll windows:6 windows x64 arch:x64

    e22dc6bf1ee86180ded9ba2ecaefe868


    Headers

    Imports

    Exports

    Sections

  • Cryptodome/Util/_strxor.pyd
    .dll windows:6 windows x64 arch:x64

    e22dc6bf1ee86180ded9ba2ecaefe868


    Headers

    Imports

    Exports

    Sections

  • Cython/Compiler/FlowControl.pyd
    .dll windows:6 windows x64 arch:x64

    50f87f66e0a7e0df56853cd4c57d0c3e


    Headers

    Imports

    Exports

    Sections

  • Cython/Compiler/FusedNode.pyd
    .dll windows:6 windows x64 arch:x64

    b1c65cc45c77c14efe6d24ebd6644bca


    Headers

    Imports

    Exports

    Sections

  • Cython/Compiler/Scanning.pyd
    .dll windows:6 windows x64 arch:x64

    2af2c819f851db8a18cb1d5a4ea41dc2


    Headers

    Imports

    Exports

    Sections

  • Cython/Compiler/Visitor.pyd
    .dll windows:6 windows x64 arch:x64

    3cf70a9d84b46746ea8bf211881e4109


    Headers

    Imports

    Exports

    Sections

  • Cython/Tempita/_tempita.pyd
    .dll windows:6 windows x64 arch:x64

    7485b975827a06e6336857e884c26ac5


    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    6e7f9a29f2c85394521a08b9f31f6275


    Headers

    Imports

    Sections

  • _asyncio.pyd
    .dll windows:6 windows x64 arch:x64

    4ea76361ab2b8d437d6c09f5c7beadf5


    Headers

    Imports

    Exports

    Sections

  • _bz2.pyd
    .dll windows:6 windows x64 arch:x64

    8f845c70b75bc8654eb7645081528fe0


    Headers

    Imports

    Exports

    Sections

  • _cffi_backend.pyd
    .dll windows:6 windows x64 arch:x64

    cc119270d8c22226b9215e640fa7033a


    Headers

    Imports

    Exports

    Sections

  • _ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    21c1b4c696dc148a115808ef6597c8a2


    Headers

    Imports

    Exports

    Sections

  • _decimal.pyd
    .dll windows:6 windows x64 arch:x64

    c4bff9b408120377b89e6fcc06a709bb


    Headers

    Imports

    Exports

    Sections

  • _elementtree.pyd
    .dll windows:6 windows x64 arch:x64

    635e459169dcc88a8c4b88f942085253


    Headers

    Imports

    Exports

    Sections

  • _hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    745f844ef0e9eed502c60324816c9b56


    Headers

    Imports

    Exports

    Sections

  • _lzma.pyd
    .dll windows:6 windows x64 arch:x64

    08e5172e901e3bc5a199c8467752ea42


    Headers

    Imports

    Exports

    Sections

  • _msi.pyd
    .dll windows:6 windows x64 arch:x64

    55f079f9a4153107e9984014e07962c7


    Headers

    Imports

    Exports

    Sections

  • _multiprocessing.pyd
    .dll windows:6 windows x64 arch:x64

    819bb026d535d5bdb53fc3f361edcad2


    Headers

    Imports

    Exports

    Sections

  • _overlapped.pyd
    .dll windows:6 windows x64 arch:x64

    301c1cb608cb6c44dbb3b8091ac821a0


    Headers

    Imports

    Exports

    Sections

  • _queue.pyd
    .dll windows:6 windows x64 arch:x64

    ba9710738c5691ca592d4927b2412341


    Headers

    Imports

    Exports

    Sections

  • _socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    fc6b55c57541344a8390f75ac5b20df1


    Headers

    Imports

    Exports

    Sections

  • _sqlite3.pyd
    .dll windows:6 windows x64 arch:x64

    46f34018b3f26ef124f647874492c1ae


    Headers

    Imports

    Exports

    Sections

  • _ssl.pyd
    .dll windows:6 windows x64 arch:x64

    502afe528bdb7a2c24282a5f01ea8450


    Headers

    Imports

    Exports

    Sections

  • an/ASL.dll
    .dll windows:5 windows x64 arch:x64

    007082aa40e5f6a9d39df8a38d419bd3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/AVFoundationCF.dll
    .dll windows:6 windows x64 arch:x64

    1ad25cbaa829c053b304961bc3607016


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/ApplePushService.dll
    .dll windows:6 windows x64 arch:x64

    8fd79f9cc5ec2d78afdc8b0c1cb60197


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CFNetwork.dll
    .dll windows:5 windows x64 arch:x64

    c32a74b0949a03d186409ec124883628


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreADI.dll
    .dll windows:6 windows x64 arch:x64

    4f0a4a7cf559012d22711b698d6ec550


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreAudioToolbox.dll
    .dll windows:5 windows x64 arch:x64

    5f673397a98ea4cd1b7c0115e830f9a6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreFP.dll
    .dll windows:6 windows x64 arch:x64

    0106f1187475381f1e62e79fb7458e5a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreFoundation.dll
    .dll windows:5 windows x64 arch:x64

    8db1a0dcef8318eeecc6c9eedfb38a0c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreGraphics.dll
    .dll windows:5 windows x64 arch:x64

    8fda1810001ea08567617125d9870074


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreMedia.dll
    .dll windows:6 windows x64 arch:x64

    20e82d9a477c65f85aeac40a8ee5dfc9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreText.dll
    .dll windows:6 windows x64 arch:x64

    1de663a6a2500324ab8a596e3a47da62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/CoreVideo.dll
    .dll windows:6 windows x64 arch:x64

    1665bbc114ca159bf67270bb9cdfb6cb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/Foundation.dll
    .dll windows:5 windows x64 arch:x64

    18c4627791c7099d46fa021535c3ef7e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/JavaScriptCore.dll
    .dll windows:6 windows x64 arch:x64

    990e9e73cf0edd9e76938101d74ae290


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/MediaAccessibility.dll
    .dll windows:5 windows x64 arch:x64

    a3cfcd42abde8b027daedae49b2da861


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/QuartzCore.dll
    .dll windows:6 windows x64 arch:x64

    08057cc97f5345433e15fe8b5c23fc61


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/SQLite3.dll
    .dll windows:6 windows x64 arch:x64

    746f96f1095c7c8c7196210f6da0101e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/WTF.dll
    .dll windows:6 windows x64 arch:x64

    9c06694367de4efec462f2b506ad939d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/WebKit.dll
    .dll windows:6 windows x64 arch:x64

    43496af1af37a9acf26219c3bf5cfd59


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/gnsdk_dsp.dll
    .dll windows:6 windows x64 arch:x64

    0efb8ac2104585573239749c3136598f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/gnsdk_manager.dll
    .dll windows:6 windows x64 arch:x64

    4f38f60fbaf19d087f454f1e1133f901


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/gnsdk_musicid.dll
    .dll windows:6 windows x64 arch:x64

    0b4c48e9fc34c933c046c9f7ea9e61b7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/gnsdk_submit.dll
    .dll windows:6 windows x64 arch:x64

    78d8cc4a0904620571373a0bec2ead45


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/gwrks64.dll
    .dll windows:6 windows x64 arch:x64

    603df0b115f373f360cf0a7bf7c90356


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/iTunesCore.dll
    .dll windows:6 windows x64 arch:x64

    81aaa73321aa8ee0885ab1b7dcaf3099


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/icudt55.dllx
    .dll windows:5 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • an/libcache.dll
    .dll windows:5 windows x64 arch:x64

    85d2f0741eee98ce97a5d22f018f9461


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/libdispatch.dll
    .dll windows:5 windows x64 arch:x64

    4b06910c0432035d9175d7c7bf3d7735


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/libicuin.dll
    .dll windows:5 windows x64 arch:x64

    1eecb24c348d8344a58802bc18b8b729


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/libicuuc.dll
    .dll windows:5 windows x64 arch:x64

    db489fc772380a0875938f5fad13a029


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/libtidy.dll
    .dll windows:5 windows x64 arch:x64

    8e6353bb62e2801c0b4e84b4da6a2012


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/libxml2.dll
    .dll windows:6 windows x64 arch:x64

    aa4c0171395454cbafd510e519adb6c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/libxslt.dll
    .dll windows:5 windows x64 arch:x64

    c50a56c8c30af9a8b565cf24f221fd1c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/objc.dll
    .dll windows:5 windows x64 arch:x64

    57b5b1461153d725ccef4dcc9267d4ea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/pthreadVC2.dll
    .dll windows:5 windows x64 arch:x64

    48423df05e28fe60525b101f97648e72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • an/zlib1.dll
    .dll windows:5 windows x64 arch:x64

    fb632dae45d440edaee6d5e4652dc187


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • certifi/cacert.pem
  • cryptography/hazmat/bindings/_openssl.pyd
    .dll windows:6 windows x64 arch:x64

    141caa701380d90481e3a7ce828c8feb


    Headers

    Imports

    Exports

    Sections

  • lib2to3/Grammar3.8.6.final.0.pickle
  • lib2to3/PatternGrammar3.8.6.final.0.pickle
  • libcrypto-1_1.dll
    .dll windows:6 windows x64 arch:x64

    91e8dc4192e6f620254cd1fa32253e23


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libffi-7.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libssl-1_1.dll
    .dll windows:6 windows x64 arch:x64

    2f472d9395bd5de322dac91610524932


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • pyexpat.pyd
    .dll windows:6 windows x64 arch:x64

    520f09b5acd2ec3980f380734fb854af


    Headers

    Imports

    Exports

    Sections

  • python3.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • python38.dll
    .dll windows:6 windows x64 arch:x64

    ce781edbac7a9ac90102e7a30012e259


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • python38.zip
    .zip
  • select.pyd
    .dll windows:6 windows x64 arch:x64

    8c968d0d6c409d355ea2f285004d6c73


    Headers

    Imports

    Exports

    Sections

  • sideloadly.dll
    .dll windows:4 windows x64 arch:x64

    daee2a47c0faefba87fdcc0042b88844


    Headers

    Imports

    Exports

    Sections

  • sideloadly.exe
    .exe windows:4 windows x64 arch:x64

    1348957746fbcba35a489538d6c1529a


    Headers

    Imports

    Exports

    Sections

  • sideloadlydaemon.exe
    .exe windows:4 windows x64 arch:x64

    de27ed326fabeb9ec3c6b8c069944e16


    Headers

    Imports

    Exports

    Sections

  • sqlite3.dll
    .dll windows:6 windows x64 arch:x64

    2e54f6f5c641bbb521bb78e587832105


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ucrtbase.dll
    .dll windows:10 windows x64 arch:x64

    5ae9a136fafa10321f3d48251bf4f6a1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    a1a40c0182b21e846adbbbe40bbef361


    Headers

    Imports

    Exports

    Sections

  • vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections