Pirate Checker V2.rar
- SHA256 718c970766e62c529575c8968ac10c7f16710ce6a57d67cc2aa69c21cd3c9725
Behavioral task
behavioral1
Sample
Pirate Checker V2/Pirate Checker.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pirate Checker V2/Pirate Checker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Pirate Checker V2.rar
- Size 19.0MB
- Sample260806-wbas4agk21
- SHA256 718c970766e62c529575c8968ac10c7f16710ce6a57d67cc2aa69c21cd3c9725
- MD5 b150caff675513c11f635ec55a4100bc
- SHA1 83de3e3abab380b84ec107dbdce16b69d7b03637
- SHA512 3a18c43b1864bee6222173a95ccdc7b6b7e3536ad432c3089ed33081fac3e489dd81daa0594579b368d7d6e2589f92b4257ffe7cbd807b317cfbb6fd4310f472
- SSDEEP 393216:K6XhoYHg264EgfR+KdzdjcYzI5IT/FeW63X1cvrF5U+aBqXszvBTm1:K6XemMgfR+Kd5wYz+K/FeW63X12rs+OI
- TLSH T1601733510CB9AE232CDD1EF215C45825C9CE91E4D7A60BF18247B64B2B51E3DE3872EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Pirate Checker V2/Pirate Checker.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Pirate Checker V2/Pirate Checker.exe
File Explorer
-
Pirate Checker V2.rar.rar 19.0MB
-
Pirate Checker V2/Get Key.txt11B
-
Pirate Checker V2/Pirate Checker.exe.exe 19.7MB
-
Main.pyc84KB
-
Pirate Checker V2/blacklist.txt119B
-
Pirate Checker V2/keyword.txt20B
-
Pirate Checker V2/results/2026-08-01_22-17-32/[[email protected]].txt2KB
-
Pirate Checker V2/results/2026-08-01_22-17-32/bad.txt11KB
-
Pirate Checker V2/results/2026-08-01_22-17-32/valid.txt6KB
Pirate Checker V2/Get Key.txt
- SHA256 d9078ab3429dc8a546c493df4360c1342aa87691f086740c34d01f40858d588d
- MD5 67ec905eb622d217d1639e9ed2d2bae8
- SHA1 472052b42701adb4c8894b836ff2b0a42c1a6a53
- SHA512 597e4a93fb2ee58d1f76fe2ce262ad39199a2df5b959af61800c400d115d329e1288af5d6cff2559bb462dc94b4961dec2876ff268b9082743be5564f63d6ef8
- MD5 SHA1 SHA512
Pirate Checker V2/Pirate Checker.exe
- IMPHASH 351592d5ead6df0859b0cc0056827c95
- SHA256 9007647382e1a2e6ed7899eea2c75112b19c0df78fb08d4695ca75165c27300e
- MD5 985a2ac2f2e974af8771573cd5288ec1
- SHA1 ffb517f03b46a8e298fca9a5cf32254004c14b66
- SHA512 744c475a92447261e75f63e8c19760513f5217da6e9891fde5219099872affbc3d77b2c07a00c8117141c2fe589f9298406713d3f14d2295b96b07434c085edf
- SSDEEP 393216:pPPa1s51lVBJ2hwJFCtOW8o/atuwBuCnDvV+53SM8+JLwqcFRq4nDz:RPas/xJ2heCgW8uaoZCDvV/M8+tVcFRt
- TLSH T17027224A7B900D94E0B79DF994A4C7F25374AD820661CB4B02F1CD23F9EE1D39D66AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
HeapSize
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindFirstFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33140,
count=141, id=1, productName=Unmarked objects,
count=27, id=260, version=35213,
count=1, id=258, version=35213,
Main.pyc
- SHA256 5ee9906342188d99c3695e9ab1b44dbc5d268e2fa93e0c6348d6ae457962d738
- MD5 a0c3e281de3f8d8c5c388b717a0eae64
- SHA1 4605b25c1e41d3ed74387c839d87f65481cf3eb1
- SHA512 c92c6089cfd8143b5d70cbcf29dafc0e8d358c12b68b72286d93b6a533bcdea5ffb5c5cfb41d97edee295df1454c7d23094726386dede05194c515ea773af9b6
- SSDEEP 1536:NAIOZUcqU1bxKf/FvzUS8L/mXCThyEDI7zgoZRW:WNZUHKxKf9L8L/mXCQzjRW
- TLSH T1DB83E576A4608606FF50E07A50DDC400A76CBAE3B672C222B59D51352FCBB7DDC263A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Pirate Checker V2/blacklist.txt
- SHA256 dd8967b2917c8e5604f113c976132460603967b71e8211a3e19c8acccb757086
- MD5 040886ff6a7572a02b48679947bf7d35
- SHA1 f821795f0b04f357af9a72d4880bcc2dfbcf0b63
- SHA512 87b74899f9f8852877c1c380ae4879b95fa0a3ef9fa5654ec8a5563a0733cdba6add9a3246fcd07e5be6ca8c062bb1562c5eb6ce56ae49e58b6cb629fe99a636
- TLSH T136B0926B8D8A41D645B5CB9B25226823324AF23A6DA05581A967628F704A902A47870F
- MD5 SHA1 SHA512 TLSH
Pirate Checker V2/keyword.txt
- SHA256 069b492cd3366ec410c467d053cb45295b65d03d17ec51b1dbf576ad7de87030
- MD5 4ad112b61117590bbeabeac921c54335
- SHA1 4ab2d3e3bad5e21c3278667e908aa6004fea0657
- SHA512 e14eb674d7944097494e43d1b68350369a40c1d2ba208a227dbcd490628b2a13fb3a5aa7f6460066c69d5d2f4a5f8cfa6a40c64130957977d95a8f8db5714a4a
- MD5 SHA1 SHA512
Pirate Checker V2/results/2026-08-01_22-17-32/[[email protected]].txt
- SHA256 5f83e46279757675e628c677c565043229f3372564216aa0848a47d73e1a4d86
- MD5 1b2baef53b49084350f6507ad2519073
- SHA1 c9f7ad0958877195c2bd067d3a532422e418aeb4
- SHA512 6e91b24dd9ef47e06dc7241926b1314b88c1a4db2532a444e1d0001219da7d3f714f433ce71c07e7da9efd094d8a3f68c859e5be2408e5fc7b52d8666a1f743c
- TLSH T115519D1AAA4F34A5F7A3C39DB92D3B19592583880E7C123945C5931A712CF8E95C3C47
- MD5 SHA1 SHA512 TLSH
Pirate Checker V2/results/2026-08-01_22-17-32/bad.txt
- SHA256 807b14e4998c6af54314fa9dc53f33592d4a135128fa02190d1b88113b7aa16a
- MD5 64b638ca68cbc1bd38ba695d594913a1
- SHA1 e7d2a6d562a55e1e48ef089e8c629f08d63ac6a3
- SHA512 3c73bc5e989f58ec365d77de189f0735afd04bf5de2495b154a217caaf0c639e77efaa2f0ea122bb919b1d38644c6b1764631fe4552fb75c6fb31c23a107b4ea
- SSDEEP 192:x6IkJDZIf450Bs/0IhfoLY3o/pJzw8oAaVNULrcYErc7Qm:WDX5v8Iyc34JE6aVNULr9mc75
- TLSH T1DC32E835BF1C49A7A52C0F0A7826AA15FB383719842977D0B3BFD95BA7009D8F990C24
- MD5 SHA1 SHA512 SSDEEP TLSH
Pirate Checker V2/results/2026-08-01_22-17-32/valid.txt
- SHA256 054b34e585699a641e6772869ec718bdb14542a8a83954c1a74d040b3b4b8d39
- MD5 f192f70fca609e98364e126d3db47819
- SHA1 fed8263282fe92f00d74ab791751e89e58e3cb77
- SHA512 61952dce983e6241696002c7d69aefd23c3a2de36a542133f0d8848dca10abb5e6f7d51c016a4fc89f48ab6274dadc88878ebf278e6c6247f4b81b2b5ca316e4
- SSDEEP 96:ZYaW3UmulOIG+PYaQgiTHyFnL1g87z5qhrc2+rShyiwCLzvAb6Df3X3MK:ZYauHmXGoQxTHyFnL1o8S4CLsosK
- TLSH T1FDD1EA2EB6D0C8F0BDC9388770497A096911CD405B189FFB6E62D7E9A14CBD0B1C4F29
- MD5 SHA1 SHA512 SSDEEP TLSH