27b7baf17490431f5be24e0fb9b439fa80dd0b4bb3086457869b29e5a764b3ff

Sharing

Copy URL

Twitter E-mail

General

Target

27b7baf17490431f5be24e0fb9b439fa80dd0b4bb3086457869b29e5a764b3ff
Size

7.7MB
MD5

e6b1e5ac83f6fea7efb13c34d91811e0
SHA1

04e59dbacd698574fafd5d5e16f57c9ce11196e9
SHA256

27b7baf17490431f5be24e0fb9b439fa80dd0b4bb3086457869b29e5a764b3ff
SHA512

230cc5c9ae5b34bd8133da2052fd885eac3d5c7ab156779b111297864d5fa8b4be772223324ca5b3302ba7a4750fa55d17920339b829c5ee9b1c0f3ad2cd5441
SSDEEP

196608:0FwRs5R0yJ4WCasjBFt1ge3rR+fjdLzJ:QRZOWx6t1ge8

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs
pyinstaller

Processes:

resource yara_rule

sample pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
27b7baf17490431f5be24e0fb9b439fa80dd0b4bb3086457869b29e5a764b3ff

Files

27b7baf17490431f5be24e0fb9b439fa80dd0b4bb3086457869b29e5a764b3ff
.exe windows:6 windows x86 arch:x86

80fa9dd013bb874b9558b39c9cc07f50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongW
GetWindowLongW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW

kernel32

GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
HeapSize
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetDriveTypeW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
DecodePointer
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
executable.pyc

Sharing

General

Malware Config

Signatures

Files

80fa9dd013bb874b9558b39c9cc07f50

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

Sections

.text Size: 156KB - Virtual size: 156KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 3KB - Virtual size: 18KB

.rsrc Size: 60KB - Virtual size: 59KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 156KB - Virtual size: 156KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 3KB - Virtual size: 18KB

.rsrc
Size: 60KB - Virtual size: 59KB

.reloc
Size: 8KB - Virtual size: 7KB