Decompiler V.2.4.rar
- SHA256 10d68e96b17fe89e1672bb3df965728067c38107ea3c988dbf0210248fc4d1e6
Overview
overview
10Static
static
10Bugs.dll
windows11-21h2-x64
1Decompiler V.2.4.exe
windows11-21h2-x64
9LoaderScripts.py
windows11-21h2-x64
3Roblox HWD/Bugs.dll
windows11-21h2-x64
1Roblox HWD/Scripts.py
windows11-21h2-x64
3Scripts/Scripts.py
windows11-21h2-x64
3Scripts/ServerSide.py
windows11-21h2-x64
3decompile.dll
windows11-21h2-x64
1krnlapi.dll
windows11-21h2-x64
1saveinstance.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Bugs.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Decompiler V.2.4.exe
Resource
win11-20241007-en
windows11-21h2-x64
15 signatures
900 seconds
Behavioral task
behavioral3
Sample
LoaderScripts.py
Resource
win11-20241007-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
Roblox HWD/Bugs.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
Roblox HWD/Scripts.py
Resource
win11-20241007-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
Scripts/Scripts.py
Resource
win11-20241007-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
Scripts/ServerSide.py
Resource
win11-20241007-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
decompile.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
krnlapi.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
saveinstance.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
900 seconds
General
- Target Decompiler V.2.4.rar
- Size 73.8MB
- Sample250112-q2d1jsvkav
- SHA256 10d68e96b17fe89e1672bb3df965728067c38107ea3c988dbf0210248fc4d1e6
- MD5 86961889e1eb75e6f5ec6f96df826862
- SHA1 989727abc34182c44b5ba75e6b38fe11d7960896
- SHA512 ec42988d129a3d6775a75d7afe4b3c6b1430ccc375319ecd872e32d1299d6ba5dbeff0ebdb1f5e966d38d930f094f7de76bc55061a07fd12f3ad36de9b7db636
- SSDEEP 1572864:IotHuxPhVvnYn9mikbh3FtuxRZwe74rE0mBS+vxy0DWVjivURo9V7A6:IoF0rvnYn9HY2Se1B1vhWV8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule static1/unpack002/source_prepared.pyc pysilon - Pysilon family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Decompiler V.2.4.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Decompiler V.2.4.exe
File Explorer
-
Decompiler V.2.4.rar.rar 73.8MB
-
Bugs.dll12KB
-
Decompile Maps/16731919637.rbxl2.0MB
-
Decompiler V.2.4.exe.exe 75.4MB
-
discord_token_grabber.pyc8KB
-
get_cookies.pyc5KB
-
misc.pyc2KB
-
passwords_grabber.pyc4KB
-
source_prepared.pyc63KB
-
Lisence.md12KB
-
LoaderScripts.py2KB
-
Roblox HWD/Bugs.dll12KB
-
Roblox HWD/Scripts.py12KB
-
Scripts/Read me.txt74B
-
Scripts/Scripts.py2KB
-
Scripts/ServerSide.py2KB
-
decompile.dll15KB
-
krnlapi.dll12KB
-
saveinstance.dll1KB
Bugs.dll
- SHA256 1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- MD5 c559ad84688d4b3550b8efbaa58418a8
- SHA1 1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA512 1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP 48:G22222222222222222222222222222222222222222222222222222222222222n:2
- MD5 SHA1 SHA512 SSDEEP
Decompile Maps/16731919637.rbxl
- SHA256 962473a4f18195aec3e2c63d75473439337fc40cf68395fdcbdd933721d61c40
- MD5 a185375d913b0c49cfdddf53a506d3bd
- SHA1 2cbf2508cd5c50a1aa59475bc237c85712bda48e
- SHA512 7a3dfcccd64010cdcb563fd95714bac5aa814ec8ebc42679d638f22010273b11adfc4fc4c1af20c4ab0869375a728f5c1b83d2a21793af0ecf2f7d0c86488d3a
- SSDEEP 24576:p2D4lyDSq1TODnmwZfIDub7hTSppED9++0ifEi/WHu6+G7l/a7R4:80lyDV6nxeDub7ZqpEIF1O6H5a14
- MD5 SHA1 SHA512 SSDEEP
Decompiler V.2.4.exe
- IMPHASH 456e8615ad4320c9f54e50319a19df9c
- SHA256 55e26286c6d116b54651a895ecc736d8087ad9527547f61eec2d0ee3d95d9cb3
- MD5 7eaef81d5fa7765c87f64c9e8781957b
- SHA1 e1e390048941688e1bc92c8c4e9dc8401da3405b
- SHA512 fc698f58ff38c0d107c413e951429f111ad13221931c65580b2cbddcb883816640cf024e48e971bf34b150829a6432cd7e9be25b65a8cc89dfbb761da252c476
- SSDEEP 1572864:HvhQ6l8xSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaSWRvZv2BYK:Hvh1ixSkB05awIxTy5nMHVLteSYYBZ
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
49360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
IsProcessorFeaturePresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=145, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
discord_token_grabber.pyc
- SHA256 fa4ec025ef2d20b6ebd19803e7131f6b540a7ba14d6769bfd62c37fb875a134b
- MD5 849e6942b15c2008c7641432902645f5
- SHA1 60942191e1ab3c6d3edf697b57d09c1620c51710
- SHA512 0e6611f100ea22b2d5d5632cd099f87d57696b73bb9c9d10dde98477b2bb1ff927816b54ee005e07df49d6897f36ad3d858ac142ae082d25800f07597f67248a
- SSDEEP 192:ESB7osP1MJaugQXaafNqaclHJLOq3ZJFD/b8xjJzdJv:TP1iavQTqacyq35D0Fnv
- MD5 SHA1 SHA512 SSDEEP
get_cookies.pyc
- SHA256 f7e8a57b54489b5b3de66a1d21534ced3d2a2fb1ce8d03c69d4672e62aa00dca
- MD5 2754e3152f668e31fccca7b6f275716b
- SHA1 e9ed74d679a96372c4457e72bc6639a4d96a2378
- SHA512 a8331f1c179ed97e6f3821cd41953a5ef8a0b63b6d39022cd3f7980494eff8f00b4367301509014e83c410ed4a6db8e4441f8f3547b682aca250bc4fa29f0f47
- SSDEEP 96:STUBj1Mvk80VDdybA6HUicwKD7dxWeBJKZLpMglcTK94:wsSl0fQfUpwKfhijMgGW94
- MD5 SHA1 SHA512 SSDEEP
misc.pyc
- SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
- MD5 bcb404423ac51f798753e8d11e401071
- SHA1 9080018dae3aa157e3a97904c86af06d4a0a6873
- SHA512 25a2997cff19308956086ae4e464f5039e53149043f094f2a65dae4dfa78b6410650a3c4d1514511f23c6bf77228772fa7b8a3cf5119e4ed46edb65ac40ff800
- MD5 SHA1 SHA512
passwords_grabber.pyc
- SHA256 589d438226abfec8f71ab7724c68011303f82febb6786fd0c57571b0769764f3
- MD5 8b9cbd29c3dfec519a4313b1b7a0069b
- SHA1 5efb073593bc8908a7514dad78673c9d65344a6f
- SHA512 c0099bcf2d23dd405b2e02e1fd1b946195015eabb1cbd2ce4896f1ab7e5bbc1fbe6600fa529087b5dc295c13219fb6bc1a6ac97efa4c0fc74901f70278c09bfd
- SSDEEP 96:2APDnTWeYwDTgWxiX79GzTOjYUyWkUUNPIslLClDWJpR6Yn:TzCUDxiLATmeEUNP/lL3JpsYn
- MD5 SHA1 SHA512 SSDEEP
source_prepared.pyc
- SHA256 8e36eccc504e8edfdf58a048dea9a0523cd1b983d2545b554726ac64ec75008f
- MD5 f7bdf2bbaf169358417e69dad9069df3
- SHA1 e6b9a62d00294ae672f0142ea4af6e904e8bdb5a
- SHA512 b2efab544c6e52461b502219a01630215e3c46ca5e81af44bcd2316d43388c2e4648865b50acca03d94e4bd0ee0ee27631a08ae4e830217df3fd4cf9b5064dc0
- SSDEEP 768:UTrrNlgVgwl6BRPLUJju4TFch+eXZldsN4uJ3EcUFNS9PSd5zcooVUgqqNwb1LvW:UjTgVgBPIRTFxikqcUFqOIooVNwtS7R
- MD5 SHA1 SHA512 SSDEEP
-
Detect Pysilon
Lisence.md
- SHA256 1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- MD5 c559ad84688d4b3550b8efbaa58418a8
- SHA1 1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA512 1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP 48:G22222222222222222222222222222222222222222222222222222222222222n:2
- MD5 SHA1 SHA512 SSDEEP
LoaderScripts.py
- SHA256 cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
- MD5 8f65f38bca462f4841aeca7b9fae6078
- SHA1 c6cfd3b8788a934a2830bf9dc561bffac072efab
- SHA512 2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
- MD5 SHA1 SHA512
Roblox HWD/Bugs.dll
- SHA256 1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- MD5 c559ad84688d4b3550b8efbaa58418a8
- SHA1 1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA512 1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP 48:G22222222222222222222222222222222222222222222222222222222222222n:2
- MD5 SHA1 SHA512 SSDEEP
Roblox HWD/Scripts.py
- SHA256 1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- MD5 c559ad84688d4b3550b8efbaa58418a8
- SHA1 1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA512 1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP 48:G22222222222222222222222222222222222222222222222222222222222222n:2
- MD5 SHA1 SHA512 SSDEEP
Scripts/Read me.txt
- SHA256 23a249c66332e19288a056043d0c20ee6162e9f8b75f903519c36a8cad181b7f
- MD5 1eafb370745fb9795f326d278061b312
- SHA1 5ec661bde70f285929fd3b8d1a797b3185ce4e3a
- SHA512 def59d36b4848aad0ba0e972d5bc392fa23906f02cc4c6129e096d0b677a0fc1c56a2821c98b688102a0469c7f310bf24eea99c834357ad0497df58a35dd53c8
- MD5 SHA1 SHA512
Scripts/Scripts.py
- SHA256 cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
- MD5 8f65f38bca462f4841aeca7b9fae6078
- SHA1 c6cfd3b8788a934a2830bf9dc561bffac072efab
- SHA512 2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
- MD5 SHA1 SHA512
Scripts/ServerSide.py
- SHA256 cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
- MD5 8f65f38bca462f4841aeca7b9fae6078
- SHA1 c6cfd3b8788a934a2830bf9dc561bffac072efab
- SHA512 2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
- MD5 SHA1 SHA512
decompile.dll
- SHA256 df08a79955798f533b109f06b5018d0b8c840ab1b1b3f8bb9e7c6750e003a2bb
- MD5 a428d30cb8d650090164dc14c1b2e39e
- SHA1 40546e60121b492900074ceeff06c8ee2a84a644
- SHA512 828fe3979c67ef75cbe4f149f0d69b09ea8c22ba70734943d55c45f56bc335cfd76aa78c2cadbcedd94ee9cfcfceb2255e1ddbc50a4aef805433dee9e26fceac
- SSDEEP 96:LSTfSSqOquSSqUSSqUSSqUSSqUSSqUSSquSSqUSSqUSSqESSqGSSqUSSqG:sDthhhhhthh7NhJ
- MD5 SHA1 SHA512 SSDEEP
krnlapi.dll
- SHA256 1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- MD5 c559ad84688d4b3550b8efbaa58418a8
- SHA1 1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA512 1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP 48:G22222222222222222222222222222222222222222222222222222222222222n:2
- MD5 SHA1 SHA512 SSDEEP
saveinstance.dll
- SHA256 02a764b4d690bf47eef77371387e87acbd44d9c64360d3e89b8cf2aebeb2929c
- MD5 bcc46643e08397e3ef187ef67ffccbc9
- SHA1 9f0b5f566eb3365c11e41bf74f25d92c79338a55
- SHA512 2e6dd0976af49f61eeba6d14b969572fac81ee20289c288822c3dbdf7d5b2a96cfb4c3649fc088406f04f2665ac7ee108043cc5eae17ac6bce476f106057efd7
- MD5 SHA1 SHA512