pykspa | tmp917omq1x

Sharing

Copy URL Twitter E-mail

General

Target
tmp917omq1x
Size 320KB
Sample260522-rxea7ad14n
SHA256 05d561a94a00a6f02b1ad9f1dc89490b4c0e9620d1f1b0e42688608a9baf3ed2
MD5 0c2465fe4215f592b45991c1f797245d
SHA1 f616e16e7acefdc05de25c221786a6e2db10056c
SHA512 40de59924f5e63157b73d370044e063d4d11fce96d2a50b428c224c2b522e5a9c9bfa2e0c9682d0052f79f684333b7ef05002cc55cf2fdaf57e3b53fbf9dbdc0
SSDEEP 6144:KTw1o1IV3puaibGKFHi0mofhaH05kipz016580bHFP86JQPDHDdx/QtqR:kTgvmzFHi0mo5aH0qMzd5807FPPJQPDV
TLSH
T14E64B03AB780C8F2C48580317699AE136EF56C301625FA57DB60DE0A2EF51E5D72A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm pykspa

Malware Config

Signatures

Family: Pykspa
Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
worm pykspa

Detect Pykspa worm 1 IoCs

worm

resource	yara_rule
sample	family_pykspa

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp917omq1x

File Explorer

tmp917omq1x

.exe 320KB

tmp917omq1x

IMPHASH a1161b9f4081312e64af594f73664c29
SHA256 05d561a94a00a6f02b1ad9f1dc89490b4c0e9620d1f1b0e42688608a9baf3ed2
MD5 0c2465fe4215f592b45991c1f797245d
SHA1 f616e16e7acefdc05de25c221786a6e2db10056c
SHA512 40de59924f5e63157b73d370044e063d4d11fce96d2a50b428c224c2b522e5a9c9bfa2e0c9682d0052f79f684333b7ef05002cc55cf2fdaf57e3b53fbf9dbdc0
SSDEEP 6144:KTw1o1IV3puaibGKFHi0mofhaH05kipz016580bHFP86JQPDHDdx/QtqR:kTgvmzFHi0mo5aH0qMzd5807FPPJQPDV
TLSH
T14E64B03AB780C8F2C48580317699AE136EF56C301625FA57DB60DE0A2EF51E5D72A34F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect Pykspa worm

worm
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

142227

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiA CreateThread GetLogicalDriveStringsA GetDriveTypeA GetWindowsDirectoryA MoveFileA FreeLibrary EnumResourceNamesA LoadLibraryA GetProcAddress GetModuleHandleA GetSystemInfo GetVersionExA SetThreadPriority GetCurrentThread FreeResource UpdateResourceA SizeofResource LockResource LoadResource FindResourceA EnumResourceLanguagesA EndUpdateResourceA BeginUpdateResourceA CreateMutexA GetLastError WaitForSingleObject GetVolumeInformationA GetComputerNameA GetCurrentProcess OpenMutexA SetPriorityClass GetTempPathA GetModuleFileNameA GetSystemDirectoryA SetErrorMode InitializeCriticalSection HeapAlloc GetProcessHeap HeapFree WideCharToMultiByte MultiByteToWideChar ExitThread GetTimeFormatA GetDateFormatA GetFileSize SetFileAttributesA GlobalUnlock GlobalLock GlobalAlloc ExitProcess SetFileTime SystemTimeToFileTime GetSystemTime CreateDirectoryA CreateProcessA GetCurrentProcessId SetEnvironmentVariableA CompareStringW CompareStringA HeapSize GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter SetStdHandle HeapReAlloc GetLocaleInfoA GetExitCodeProcess GetStringTypeW GetStringTypeA VirtualFree HeapCreate HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle VirtualAlloc VirtualProtect GetCPInfo FlushFileBuffers GetOEMCP GetACP LCMapStringW LCMapStringA VirtualQuery InterlockedExchange RtlUnwind TerminateProcess GetCommandLineA GetStartupInfoA SetFilePointer WriteFile CreateFileA ReadFile CloseHandle Sleep FindFirstFileA lstrcpyA lstrcatA lstrcmpA GetTimeZoneInformation EnterCriticalSection LeaveCriticalSection DeleteFileA lstrcpynA GetTickCount GetFileAttributesA lstrlenA CopyFileA FindNextFileA FindClose

user32

TranslateMessage GetMessageA UpdateWindow RegisterClassA DispatchMessageA wsprintfA GetWindowRect GetDesktopWindow ShowWindow EnableWindow GetClassNameA DestroyWindow UnregisterClassA PostMessageA GetWindowThreadProcessId GetWindowTextA IsWindowVisible EnumWindows IsWindowEnabled LookupIconIdFromDirectoryEx GetCursorPos SetCursorPos GetSystemMetrics ReleaseDC GetWindowDC SetClipboardData EmptyClipboard SendInput SendMessageTimeoutA RegisterWindowMessageA SetWindowPos PostQuitMessage GetClientRect GetWindowInfo GetWindow GetWindowPlacement MessageBoxA EnumChildWindows SetWindowTextA SetForegroundWindow SetFocus

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetDIBits DeleteObject

advapi32

SetSecurityDescriptorGroup ChangeServiceConfigA GetUserNameA SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid GetTokenInformation SetFileSecurityA SetSecurityDescriptorSacl

shell32

ShellExecuteA SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc

ws2_32

inet_addr WSACreateEvent WSAEventSelect WSAWaitForMultipleEvents WSAEnumNetworkEvents WSACloseEvent sendto WSAGetLastError gethostbyaddr accept getpeername shutdown inet_ntoa select __WSAFDIsSet recv send closesocket htons

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA