Pyslock[.]exe | Triage

Sharing

General

Target

Pyslock.exe
Size

21.6MB
MD5

a0ffac14736ead083c36a978369b87ba
SHA1

8da2f697b7b65ebdf21b94c1d1f0185d1d48f3e5
SHA256

7dd25fd3fbb87266948a407b91285c4b07bb46f9bf26f3c1a7d2a5ed4ce9cd3b
SHA512

29c5cc95e51f7ef17b0df944207d6fa3e8d94f9e84bb0b6026d8a7f131e6c7287b78aac18e50f521fd064b2832a64cecc54bce83507d4cd6bd4b718347f78aeb
SSDEEP

393216:k6f15y6xVG+dvbs5u+5vFA3MLwCbe6q5WpsealMvjm3AjjyXHm2dj+sasBC:1FGmsQ+50MLbbe0seeB3AjjF2BksBC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pyslock.exe

Files

Pyslock.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ