using python exe[.]exe

General

Target
using python exe.exe
Size 24.8MB
Sample250122-bmsstszrdt
SHA256 dcc64a3e8791dc7d343a656a67f0f9ff600ef5998f3730094a284b447cc43709
MD5 08d61dc71afefa0c6984312cd4018825
SHA1 06ce6af134316e62ac88c04965b1e62c02de86df
SHA512 a4e64943cf93b793981857ae26d6c537e35fd28714e6b2e205637500d2d9c55d55e0ebe33595b26626c26c12695f75cfaa0c36a53065725213ada0cecc2f70fd
SSDEEP 786432:gJ1HSHwSmCP+V73y3RncnQb+029KeTOPwkcfbklcmQ:gJ1HSHwSm6+VGBcq8KeTOpO/mQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

using python exe.exe

.exe 24.8MB

using python exe.exe

IMPHASH 6d5e13c0269946a5a10390c178d8e9a5
SHA256 dcc64a3e8791dc7d343a656a67f0f9ff600ef5998f3730094a284b447cc43709
MD5 08d61dc71afefa0c6984312cd4018825
SHA1 06ce6af134316e62ac88c04965b1e62c02de86df
SHA512 a4e64943cf93b793981857ae26d6c537e35fd28714e6b2e205637500d2d9c55d55e0ebe33595b26626c26c12695f75cfaa0c36a53065725213ada0cecc2f70fd
SSDEEP 786432:gJ1HSHwSmCP+V73y3RncnQb+029KeTOPwkcfbklcmQ:gJ1HSHwSm6+VGBcq8KeTOpO/mQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

c5:8f:4a:36:f5:ba:c8:22:2b:19:10:4f:97:0f:1c:d0:ce:8e:23:15:0c:b9:97:85:64:c6:ae:06:9f:64:4c:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=913100005559922937,CN=Shanghai Liuran Trading Co.\, Ltd.,O=Shanghai Liuran Trading Co.\, Ltd.,L=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 1, 0001

Subject

SERIALNUMBER=913100005559922937,CN=Shanghai Liuran Trading Co.\, Ltd.,O=Shanghai Liuran Trading Co.\, Ltd.,L=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

4c:01:cd:ad:03:eb:09:07:91:54:e2:30:6e:a6:4b:fb

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2024 - Aug 18, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

2308240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CloseHandle GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW Sleep LoadLibraryExW FreeLibrary CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess WideCharToMultiByte GetSystemDirectoryW GetCurrentProcessId DecodePointer CreateNamedPipeW GetExitCodeThread lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW CompareStringW FindNextFileW GetFileSize GetFileAttributesW GetShortPathNameW GetFinalPathNameByHandleW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW CreateSemaphoreW ReleaseSemaphore GlobalMemoryStatus GetModuleHandleA GetProcessAffinityMask CreateThread CreateFileW WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW OutputDebugStringW GetLocalTime FlushFileBuffers LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW FormatMessageW ConnectNamedPipe GetEnvironmentStringsW InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process OpenProcess GetProcessId TerminateProcess ReadProcessMemory SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID lstrcpyW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW GetLocaleInfoEx FindFirstFileExW MoveFileExW WakeAllConditionVariable EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode SetFilePointerEx GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapQueryInformation

imagehlp

SymFunctionTableAccess StackWalk SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions SymGetModuleBase

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

750KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

using python exe.exe

PE Signature issue

kernel32

imagehlp

generic