1.zip
- SHA256 d58a3f7342e06fcacbbc05e4681301576ea6ad1bf5d5966eba8d98c2426b7c7f
Behavioral task
behavioral1
Sample
1.zip
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 1.zip
- Size 48.8MB
- Sample260628-e8ls7afs7l
- SHA256 d58a3f7342e06fcacbbc05e4681301576ea6ad1bf5d5966eba8d98c2426b7c7f
- MD5 f46d7aebf5bd38eb35e0c1e9a3ca7439
- SHA1 bfaeb45c119a42cc01c94de6f8b7ab822b647fa0
- SHA512 78b4798b29eb3f34923dbb34eb0fb84e3b41cf4be45b9836bf821650a4969702cadb150395a3755abd9a7e39292e34d65d099e6995a3073fb8bdd1365c521188
- SSDEEP 1572864:tchLuRCfSG6U/EfFtobp+DIJlj4YjD3jFBJRoLbS:pRC7AfUb8DvCFrGS
- TLSH T1C4B733D14852C7A1E0C2D61E673840F37063D8B474075BEF5739A1DB3A9A3B60C6DAEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/1/lua-deobfuscator.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1/lua-deobfuscator.exe
File Explorer
-
1.zip.zip 48.8MB
-
1/lua-deobfuscator.exe.exe 48.1MB
-
main.pyc1KB
-
1/obfuscated.lua.js 953KB
-
1/source.js 904KB
1/lua-deobfuscator.exe
- IMPHASH d5b1104f7bf955d6b89a47291d5b603b
- SHA256 dff20cc3420236030cf77336f730b97c330497b4fcf811c3e798c9166252f7dd
- MD5 b5e7d2e71b73e0e4e2d5681bef577a51
- SHA1 2af2cd23c3e4a86a60d4cd752c8530bdd9083924
- SHA512 522cb7ceb899a9c9f94086d99b8089355576d5574b465f5e34efe3e51bae26f2e8b36b8c8000143c1adec5942fbbf4b5a82ce2b8fe82e646d7fc3e5781f8ddee
- SSDEEP 1572864:fXJVrvo2pUg9NoX0RpfPO71IGCLJ3/pFZIm+:zv7ig9NXZSOpj
- TLSH T1F8B733E1506582A2F9D3D23E4672C572A4B1B870AA6343DF43A853573D572F20C3E7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapSize
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
RtlUnwindEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=140, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
main.pyc
- SHA256 981e831b1ed5c5a9bba3a7ff3a8d13aa0163b9264057e8f9158ccb0c1c4c57ad
- MD5 97e9f9c5bb19dae4e37d96ee5db3ddea
- SHA1 8c1522223d3b557bd6161926f6d764c28ab4f0a0
- SHA512 711453a696f6207a13c5b02dd889fa1332acd6850e48c66804ef64c96877788aad7e91fc5c9012c0b76cabf903edb0a66b32bfd4dd1e5328de62c2e277efd51c
- TLSH T1B731C89169904D80C9C3043CBA03B0B2937ADE36B479B3231144835F0F575A8AF7911F
- MD5 SHA1 SHA512 TLSH
1/obfuscated.lua
- SHA256 6d984e970ef8748367d071ec9d26e2f72ed296f56eb6d78b5d832ff2d7a8c511
- MD5 23863192e7104017f2717af3f8b36659
- SHA1 3e817a3c2f4ff6894d5833f8a94b7b2de60bdcb9
- SHA512 fbdfae205602fe5d88c9ef3cbf23be7788a596618209bc89df95e21ea95e12256ab71c73473cb34094ad7da95d4cba14d5d076f38f5fb3b9c786fe30e608855a
- SSDEEP 12288:h/WkcZpdPXw10WBIXe0wJt4uwfDb4kR94NyccXnrKd4e66FRwKMCSb3:hqpVOB+Cg4SkdOD/
- TLSH T13C25DF3071DF43A9114EA1C8CDB9BD0FE5EDC47F559C09657BDBA6AB28162CCA382C60
- MD5 SHA1 SHA512 SSDEEP TLSH
1/source
- SHA256 71729e4b4afaa2c2dddaadee6debcdeb11c4fc6c56858b331798803f99c65419
- MD5 7b1b743845ea500197e89b394ff8fc3e
- SHA1 69bfc7a8a2bc1801f744a201c2c1cb85919f969a
- SHA512 a7e3398e9b3346ffc28332defffa72ae7ee6c5d1eaed34ebce5ba81c6400595d517ff4b74cd564729044bd8fc5b9596f5b2876b4f72313a1b768efb478d6b2ea
- SSDEEP 12288:H/WkcZpdPXw10WBIXe0wJt4uwfDb4kR94NyccXnrKd4e66FRwKMCSoSh:HqpVOB+Cg4SkdODkE
- TLSH T10515E07431EF1329528E61D41EE57D1F63E2082F418D1EB9068BF6BA1E1B7CDA1DAD20
- MD5 SHA1 SHA512 SSDEEP TLSH