_3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6.exe
Size 12.0MB
Sample260511-hvedqsct9y
SHA256 3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6
MD5 950c717d0c475516497adde1dbf29697
SHA1 b5b187d7bee8c6d85afe85bc062346ba3d20ee8b
SHA512 85d6800ebcb1258bfd9aa171237cee2c2ef14f98f223a5a8cb3e2acb5b96b147e5f0db351fd405b9c20b0cb56ece0368dc37f465331cb9d4e80370118b7af957
SSDEEP 393216:iuBl0lOvda1WxdUoXMCHWUjXhcuI3/PGTAI:iGWOvs8XMb8X2H/O7
TLSH
T1FED6330AB6C250EDC537D078BFE26AF4E474B9645A7E8C7D1A9CC37068939A0D86CC47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller pyarmor

Malware Config

Signatures

Detects Pyarmor 1 IoCs

pyarmor

resource	yara_rule
sample	pyarmor

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6.exe

File Explorer

_3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6.exe

.exe 12.0MB
installer.pyc

34KB

_3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6.exe

IMPHASH c5e49de42b1165b00bd79240b8cd617d
SHA256 3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6
MD5 950c717d0c475516497adde1dbf29697
SHA1 b5b187d7bee8c6d85afe85bc062346ba3d20ee8b
SHA512 85d6800ebcb1258bfd9aa171237cee2c2ef14f98f223a5a8cb3e2acb5b96b147e5f0db351fd405b9c20b0cb56ece0368dc37f465331cb9d4e80370118b7af957
SSDEEP 393216:iuBl0lOvda1WxdUoXMCHWUjXhcuI3/PGTAI:iGWOvs8XMb8X2H/O7
TLSH
T1FED6330AB6C250EDC537D078BFE26AF4E474B9645A7E8C7D1A9CC37068939A0D86CC47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Pyarmor

pyarmor
Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken

comctl32

LoadIconMetric

gdi32

CreateFontIndirectW DeleteObject SelectObject

kernel32

AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateProcessW CreateSymbolicLinkW DeleteCriticalSection DeleteFileW EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetCommandLineW GetCurrentProcess GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFinalPathNameByHandleW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx K32EnumProcessModules K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW LocalFree MulDiv MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RemoveDirectoryW SetConsoleCtrlHandler SetDllDirectoryW SetErrorMode SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __argc __iob_func __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fileno _fmode _get_osfhandle _getpid _initterm _snwprintf _stricmp _strnicmp _strdup _vsnwprintf _wcmdln _wcsdup _wcserror _wcsdup _wcsnicmp _wfopen _wfullpath _wputenv_s _wstat _wtempnam abort atexit calloc clearerr exit fclose feof ferror fflush fprintf fputc fputwc fread free fwprintf fwrite ftell isleadbyte iswctype fseek localeconv malloc mbstowcs memcmp memcpy memset realloc setbuf signal strchr strcmp strcpy strerror strlen strncat strncmp strncpy strtol strtoul vfprintf wcscat wcschr wcscmp wcslen wcsncmp

user32

CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EndDialog GetClientRect GetDC GetDialogBaseUnits GetMessageW GetWindowLongPtrW InvalidateRect MessageBoxA MessageBoxW MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassW ReleaseDC SendMessageW SetWindowLongPtrW ShowWindow ShutdownBlockReasonCreate SystemParametersInfoW TranslateMessage

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

188B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_3a1e2692373ab5d4db29bc083064dbb896722a9bb8a12363ccfd5742f8cbd5a6.exe

advapi32

comctl32

gdi32

kernel32

msvcrt

user32

generic

installer.pyc