unlicense[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
unlicense.7z
Size 72.6MB
Sample260730-sa76esbc44
SHA256 d57f150311701a72d01b1fedc2414ee0e3e33cc82e36b4e0a4110482a58a2352
MD5 aa2d944206972768b136c1709123b5f8
SHA1 edde59fb2db3fb3338e4ac686905fc3c91da3bd6
SHA512 5680bc3bac47e35d2f1b081508bf9881b650c1ec11c379da534d75012b2e63864a9566596c392d186389a3a7a055f576ffdf4e70a5043057bb7208578bfd781d
SSDEEP 1572864:gKeRDt+r/vwHquDXOfFkI0DCUvqAqjdGtUVD7WWc+TM3Xg0Bj2V3kVBhiQl1WGK:gKwR+rAH3ykISCUvqHGM7WtWMQ0BKVUw
TLSH
T149F733FBF5C0A25812FDD6E50B1B58B0950B2D27D0C4C45AC918EB365F5810BAAA7CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida pyinstaller

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/DDNet.exe	themida

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/unlicense.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DDNet.exe
unpack001/unlicense.exe

File Explorer

unlicense.7z

.7z 72.6MB
DDNet.exe

.exe 24.6MB
unlicense.exe

.exe 59.5MB
__main__.pyc

268B

unlicense.7z

SHA256 d57f150311701a72d01b1fedc2414ee0e3e33cc82e36b4e0a4110482a58a2352
MD5 aa2d944206972768b136c1709123b5f8
SHA1 edde59fb2db3fb3338e4ac686905fc3c91da3bd6
SHA512 5680bc3bac47e35d2f1b081508bf9881b650c1ec11c379da534d75012b2e63864a9566596c392d186389a3a7a055f576ffdf4e70a5043057bb7208578bfd781d
SSDEEP 1572864:gKeRDt+r/vwHquDXOfFkI0DCUvqAqjdGtUVD7WWc+TM3Xg0Bj2V3kVBhiQl1WGK:gKwR+rAH3ykISCUvqHGM7WtWMQ0BKVUw
TLSH
T149F733FBF5C0A25812FDD6E50B1B58B0950B2D27D0C4C45AC918EB365F5810BAAA7CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Password

DDNet.exe

SHA256 84d2c4c67979c3d0c139c2dc20fbb547988cb09467f7f74c416d89808d152a90
MD5 a9764b28b312d83912b442b14218f417
SHA1 209bdcab77a44e1e8c4ed87e21411ab4d787972f
SHA512 07fad8b6b66f61d183667417d9a58b0869227a1df3d9d890f035a7ca02b7316f439c982e2da95e989dca67fb2ec6fc5dad36b5053126f7436cd69bb461796260
SSDEEP 393216:Vw1PetzS5RtUprnCigEg5IMDO8f0Nxra:oWtzS5PUx0E8g9Ba
TLSH
T1264733739684AEBDD0B85BFA8216FC6583532D384E885785FCBF19676E8570E8F72001
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

57983064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

7.4MB

Virtual Size

18.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

2.4MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

41KB

Virtual Size

23.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

323KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

23KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

46KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=226, id=261, version=33145,

count=101, id=260, version=33145,

count=38, id=259, version=33145,

count=10, id=253, version=35403,

count=19, id=260, version=35403,

count=14, id=259, version=35403,

count=102, id=261, version=35403,

count=1, id=262, version=33145,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=28, id=257, version=33145,

count=2, id=257, version=35730,

count=5, id=257, version=27045,

count=447, id=1, productName=Unmarked objects,

count=1665, id=260, version=35220,

count=329, productName=Unmarked objects (old),

count=24, id=260, version=35730,

count=321, id=261, version=35730,

count=1, id=255, version=35730,

count=2, id=151,

count=1, id=258, version=35730,

unlicense.exe

IMPHASH d5b1104f7bf955d6b89a47291d5b603b
SHA256 a8ea10ed89029b9ba1018f1bfef722a1012dbcec1c432ceb3d26d0b9624c489c
MD5 55703cfdc4dd03fc189a5258dbd034f2
SHA1 75835cafe522110efe08f510d09a6e111ffaf083
SHA512 63eccc4d885758b1c400b4fc97d61b5346989c999444caa216ead75510ad17beca3ad44b77fc3b56a4713e51028ee8c2e4a7ccf1545cbb7c016c8f421e3abd52
SSDEEP 1572864:+Ezqwz7XDoKEL6YW3K5WGQCwGpaHQQAwBGBhj2GiIs3xZgpn5Kn:+Yqwz7XxELJW3K8GQZGc3AwBGBtTs3xB
TLSH
T145D7336B96D22199D8C6B170C503C52426227CB98F4752177BF2FEA33F13AD28C77A85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

54976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetCursorPos ShutdownBlockReasonCreate GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW MsgWaitForMultipleObjects ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetMonitorInfoW MonitorFromPoint GetSystemMetrics

kernel32

GetTimeZoneInformation GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetLastError FreeLibrary GetProcAddress LoadLibraryExW FormatMessageW GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW SetErrorMode CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW HeapSize FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte HeapReAlloc WriteConsoleW SetEndOfFile DeleteFileW RtlUnwindEx GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc GetCurrentDirectoryW VirtualProtect CompareStringW LCMapStringW

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

unlicense.7z

DDNet.exe

generic

unlicense.exe

user32

kernel32

advapi32

generic

__main__.pyc

main.pyc