iOS_Indexing_Checker_Windows_NoPython.zip
- SHA256 25439ab0e8f95c286648b0fe51fff836a7293f7c1b04262d6ea41ebe57eef011
Overview
overview
8Static
static
3iOS_Indexi...on.zip
windows10-2004-x64
1iOS_Indexi...on.zip
windows11-ltsc_2024-x64
1IosIndexin...ss.exe
windows10-2004-x64
7IosIndexin...ss.exe
windows11-ltsc_2024-x64
7IosIndexin...ss.pyc
windows10-2004-x64
3IosIndexin...ss.pyc
windows11-ltsc_2024-x64
8README_One...on.txt
windows10-2004-x64
1README_One...on.txt
windows11-ltsc_2024-x64
1Start-iOS-...er.cmd
windows10-2004-x64
3Start-iOS-...er.cmd
windows11-ltsc_2024-x64
3Start-iOS-...er.ps1
windows10-2004-x64
3Start-iOS-...er.ps1
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
iOS_Indexing_Checker_Windows_NoPython.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
iOS_Indexing_Checker_Windows_NoPython.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
IosIndexingProgress.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
IosIndexingProgress.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
IosIndexingProgress.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
IosIndexingProgress.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
README_OneClick_Distribution.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
README_OneClick_Distribution.txt
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Start-iOS-Indexing-Checker.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Start-iOS-Indexing-Checker.cmd
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
Start-iOS-Indexing-Checker.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Start-iOS-Indexing-Checker.ps1
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target iOS_Indexing_Checker_Windows_NoPython.zip
- Size 26.8MB
- Sample260622-sd87wsdw8n
- SHA256 25439ab0e8f95c286648b0fe51fff836a7293f7c1b04262d6ea41ebe57eef011
- MD5 25258851ff745ad7bfb9a407ca8decf9
- SHA1 af0301999ce4fc9f902fbdfa88a6b0ddf76991cb
- SHA512 e8bae193b151911904a2350fd492d42022b73e06f0f40e1d895ed4a696041fb9c8f10c29a0f7f2d51ca10d13b2c0a6062cf92d6a23cfc9234d1b5aaf73b5e4c1
- SSDEEP 786432:lg+yaLoGLlNB2NWEYbtaRD2cuj4pIWDoqvFOqR:lfyCusbt+2cujgIWDxvFOqR
- TLSH T1EC573382721D5E0AEAE6D49AD0110B794F8827D7E4AD4156BF0BB7279C44E23C8F721F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/IosIndexingProgress.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IosIndexingProgress.exe
File Explorer
-
iOS_Indexing_Checker_Windows_NoPython.zip.zip 26.8MB
-
IosIndexingProgress.exe.exe 27.6MB
-
IosIndexingProgress.pyc8KB
-
README_OneClick_Distribution.txt1KB
-
Start-iOS-Indexing-Checker.cmd.cmd .bat 348B
-
Start-iOS-Indexing-Checker.ps1.ps1 16KB
IosIndexingProgress.exe
- IMPHASH d5b1104f7bf955d6b89a47291d5b603b
- SHA256 34f2c591eea6cfced272c48b0f5f7368a3d173870514e11ce6add51f56112c2d
- MD5 9e376a2f47ec44a85dbf00704aa9ccfe
- SHA1 9d272aa713c5363e3f4ece3bfed901f8e8fe84ec
- SHA512 1c2272b8d749690302e592bf4df8b87a0d2b6fafaff174dc09b28ec57b1d7dd40361abd068e96b193790bf02d4204496016995b82315f4d85d7ad4a0e30f5fee
- SSDEEP 786432:5Y7I7yZdgZA5tq8QCt/AEyVmdjNNaf78boe7wGJpY:5Y7nW0QOiEyVQjNNafooe7rJpY
- TLSH T1AB57237563201A7BF291FE7ED480F730A65E79027AB364C76B462632284ED9B5FE1700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapSize
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
RtlUnwindEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=140, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
IosIndexingProgress.pyc
- SHA256 6449a03fafc886c6713abd7de4d3c7e10dc3c1547355a66960b5673d4231b3d5
- MD5 aa3aaaee23b422aa3dd3074a6b97e1cb
- SHA1 927813c06e17c69fa3ed00d0b62da82bd83b7306
- SHA512 0b6ffc0681b499147a3dadef7e46151c6676d20bfcf9607c6a871bed10096af4bf55b57788e37a505f2a84c44c061f4587b4a5cc79ebaf3fed7922343710b9a0
- SSDEEP 192:QNmFsPMbDgTR2ottYnR5FQ2fRvXnMH6w8y6XGVb:myIqkdJtWR5TfhXnMLaYb
- TLSH T182125C443A088663FCABF0FD550483282D71162C6B9855E39A4F83EEEF85790683D3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
README_OneClick_Distribution.txt
- SHA256 596b2f14442bb1bf38195f6961ee60701d74fc7545d8f111e2a271d25a22b305
- MD5 9e24fa97404e28dd2e15703e935d9856
- SHA1 17ceb796e5391727d54b30a608722729910533a8
- SHA512 aa25d3f874d8c96e51a34f571d57ec7bf6424c3ed9d08a35389606d6404b2987afc883eb8489c3bb86d36613b7d6ca788769430d2f0a416b06f5af6ea59f9814
- TLSH T1E3215418431AA611EB381DC21B4CE9A57165B9A55F3DC8EFC58BC261ADCC999D033AE0
- MD5 SHA1 SHA512 TLSH
Start-iOS-Indexing-Checker.cmd
- SHA256 f922c179fbef251b66fb1f4f4a845065367dc62fa83d0dd9e334cce128e07ede
- MD5 cb5aec0b0a347df6524f33efd5c7a728
- SHA1 6e2bb1899567bf0c1f171f63d26225353a5b699c
- SHA512 592e7bc9802580b19e2f5e1081686fd6394deb045a3cdd9d3b000836785cddd4ab939502e317709b5a0cb2188af557236d1cc9b20d58f3a6faebf52ff42299fe
- TLSH T17AE0C02947850780367B0AC0504C2A6D647E4686EB14DEC022AB017F1C4C4CFD06F3C5
- MD5 SHA1 SHA512 TLSH
Start-iOS-Indexing-Checker.ps1
- SHA256 6bb62e1e60cf6654039a6631668bc3650b49c8526b4d6cd639f24c0fca7ea260
- MD5 1c8d6fe538f9f0564b00ddfd3691987d
- SHA1 7c78a5891f195225c47163cd62a82e8d6adeec71
- SHA512 28a2267b63626b261f202aea7f4d2b00880827f3c6fd7b127b7e62bdd685b77d2c651fbb77762321f261a1d62c32be438003f7aa8bad5087de738e2dbfdcc80a
- SSDEEP 192:dg7nlZChAycnjlLKqD1T5QTZiCOsHBl5iJcyimmpnwIGh4S4m7jFeaWE0Ib70tby:dg7nlpoiilixtzLVHSu
- TLSH T1C072A72E9DD046A21BC7257F1CDED0003295503B861C5E50B9FE4188BFC9A3E89F5BBA
- MD5 SHA1 SHA512 SSDEEP TLSH