pykspa | tmptode6jqa

Sharing

Copy URL Twitter E-mail

General

Target
tmptode6jqa
Size 680KB
Sample260602-cw4gcsby4y
SHA256 e43a8e7208acf4b3c0d288e9c2dd7c63fd729e1d0dd9203b1231081e9bbf8c15
MD5 35068d6591caac74655e6a0135af8d00
SHA1 c3234c95e8148a03ea8eb854820f5d5e285e15f3
SHA512 56244b1e18dfbad8be8f9e37b2fb50f8b52291561cec5c81cbf34095f8b9e1539d9902da536a4aa30dab9ed1abe87b7c33f0f604ce255bcc6ad678767b468cda
SSDEEP 6144:X3ue8ySm8hQAAIfFrRXuEE+0l97mKwKRqHVGP86JQPDHDdx/Qtqa:l/zkFF+EExZmKbRuVMPJQPDHvd
TLSH
T1A2E4BF3AB7C0C8F2C495803176959F136EF5AC300264EA5BDB64CE492EF52E4D72A74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm pykspa

Malware Config

Signatures

Family: Pykspa
Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
worm pykspa

Detect Pykspa worm 1 IoCs

worm

resource	yara_rule
sample	family_pykspa

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmptode6jqa

File Explorer

tmptode6jqa

.exe 680KB

tmptode6jqa

IMPHASH d67c205451cfa889d29c6c8718886c08
SHA256 e43a8e7208acf4b3c0d288e9c2dd7c63fd729e1d0dd9203b1231081e9bbf8c15
MD5 35068d6591caac74655e6a0135af8d00
SHA1 c3234c95e8148a03ea8eb854820f5d5e285e15f3
SHA512 56244b1e18dfbad8be8f9e37b2fb50f8b52291561cec5c81cbf34095f8b9e1539d9902da536a4aa30dab9ed1abe87b7c33f0f604ce255bcc6ad678767b468cda
SSDEEP 6144:X3ue8ySm8hQAAIfFrRXuEE+0l97mKwKRqHVGP86JQPDHDdx/Qtqa:l/zkFF+EExZmKbRuVMPJQPDHvd
TLSH
T1A2E4BF3AB7C0C8F2C495803176959F136EF5AC300264EA5BDB64CE492EF52E4D72A74B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect Pykspa worm

worm
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

141635

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateThread GetLogicalDriveStringsA GetDriveTypeA GetWindowsDirectoryA MoveFileA FreeLibrary EnumResourceNamesA LoadLibraryA GetProcAddress GetModuleHandleA GetSystemInfo GetVersionExA SetThreadPriority GetCurrentThread FreeResource UpdateResourceA SizeofResource LockResource LoadResource FindResourceA EnumResourceLanguagesA EndUpdateResourceA BeginUpdateResourceA CreateMutexA GetLastError WaitForSingleObject GetVolumeInformationA GetComputerNameA GetCurrentProcess OpenMutexA SetPriorityClass GetTempPathA GetModuleFileNameA GetSystemDirectoryA SetErrorMode InitializeCriticalSection HeapAlloc GetProcessHeap HeapFree WideCharToMultiByte MultiByteToWideChar ExitThread GetTimeFormatA GetDateFormatA GetFileSize SetFileAttributesA GlobalUnlock GlobalLock GlobalAlloc lstrcmpiA SetFileTime SystemTimeToFileTime GetSystemTime CreateDirectoryA CreateProcessA GetCurrentProcessId SetEnvironmentVariableA CompareStringW CompareStringA HeapSize GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter SetStdHandle HeapReAlloc GetLocaleInfoA GetExitCodeProcess GetStringTypeW GetStringTypeA VirtualFree HeapCreate HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle VirtualAlloc VirtualProtect GetCPInfo FlushFileBuffers GetOEMCP GetACP LCMapStringW LCMapStringA VirtualQuery InterlockedExchange RtlUnwind TerminateProcess GetCommandLineA GetStartupInfoA SetFilePointer WriteFile CreateFileA ReadFile CloseHandle Sleep FindFirstFileA lstrcpyA lstrcatA ExitProcess lstrcmpA EnterCriticalSection LeaveCriticalSection DeleteFileA lstrcpynA GetTickCount GetFileAttributesA lstrlenA CopyFileA FindNextFileA FindClose

user32

TranslateMessage GetMessageA UpdateWindow RegisterClassA DispatchMessageA wsprintfA GetWindowRect GetDesktopWindow ShowWindow EnableWindow GetClassNameA DestroyWindow UnregisterClassA PostMessageA GetWindowThreadProcessId GetWindowTextA IsWindowVisible EnumWindows IsWindowEnabled LookupIconIdFromDirectoryEx GetCursorPos SetCursorPos GetSystemMetrics ReleaseDC GetWindowDC SetClipboardData EmptyClipboard SendInput SendMessageTimeoutA RegisterWindowMessageA SetWindowPos PostQuitMessage GetClientRect GetWindowInfo GetWindow GetWindowPlacement MessageBoxA EnumChildWindows SetWindowTextA SetForegroundWindow SetFocus

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetDIBits DeleteObject

advapi32

SetSecurityDescriptorGroup ChangeServiceConfigA GetUserNameA SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid GetTokenInformation SetFileSecurityA SetSecurityDescriptorSacl

shell32

ShellExecuteA SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc

ws2_32

inet_addr WSACreateEvent WSAEventSelect WSAWaitForMultipleEvents WSAEnumNetworkEvents WSACloseEvent sendto WSAGetLastError gethostbyaddr accept getpeername shutdown inet_ntoa select __WSAFDIsSet recv send closesocket htons

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA