Scythe[.]exe | Triage™

General

Target
Scythe.exe
Size 57.4MB
Sample260718-kd2ttag17v
SHA256 805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861
MD5 1df676ac3dac61122c35214de6ad0e75
SHA1 70188ae15ca9cec02189b9d7ee54d1bc524ba3ab
SHA512 b7a8213c702e9e5a5cb62e1090fabfac8df45cf83f2ca0fcdf9f68acc3ab309b3910a2fcf7b14e4a500cab96a852ac73ae3af2f4969ed0ceab3a21087db367f5
SSDEEP 1572864:yS1gy6fnJXGMK4XR6bkEgjfBmMKYOESCU/+k3z7L:y4gy+gYRwgjfBmMKySC++k3z7
TLSH
T11ED73311F59808C9F4710236F5B21932C52EF0CF83A9995F7860069342EFABD9FB56B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Scythe.exe

File Explorer

Scythe.exe

.exe 57.4MB
Scythe MultiTool 1.1.pyc

18KB

Scythe.exe

IMPHASH 2cdcfb3a828433ba76b5b41f45519bd9
SHA256 805d56b5bf26c9511f2cccb5396fc62953d9404d2fd98c6a5602f1c4e1447861
MD5 1df676ac3dac61122c35214de6ad0e75
SHA1 70188ae15ca9cec02189b9d7ee54d1bc524ba3ab
SHA512 b7a8213c702e9e5a5cb62e1090fabfac8df45cf83f2ca0fcdf9f68acc3ab309b3910a2fcf7b14e4a500cab96a852ac73ae3af2f4969ed0ceab3a21087db367f5
SSDEEP 1572864:yS1gy6fnJXGMK4XR6bkEgjfBmMKYOESCU/+k3z7L:y4gy+gYRwgjfBmMKySC++k3z7
TLSH
T11ED73311F59808C9F4710236F5B21932C52EF0CF83A9995F7860069342EFABD9FB56B9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

40196

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW FreeLibrary LoadLibraryExW CloseHandle GetCurrentProcess LoadLibraryA LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte SetEndOfFile GetProcAddress GetModuleFileNameW SetDllDirectoryW GetStartupInfoW GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RaiseException GetCommandLineA ReadFile CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindClose FindFirstFileExW FindNextFileW SetStdHandle SetConsoleCtrlHandler DeleteFileW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers GetFileAttributesExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Name

.text

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Scythe.exe

kernel32

advapi32

generic

Scythe MultiTool 1.1.pyc