Soda[.]v1[.]4[.]exe

General

Target
Soda.v1.4.exe
Size 8.6MB
Sample260808-l6vrmsytc1
SHA256 e06623cc4bc2227bd3aeeced3758776051feee79102ad9f8cf79f1575f6d2e7e
MD5 3eba7aed5636cffd9b8b8a3780870db3
SHA1 e843680db1eccde091cd8ed10c4e65f91472ca5e
SHA512 20a0aa5dec7b1ff9c9ac169690e316bd4edf8bc3402f19301c79960999c1cc75a0b6845642d90fb7b09bcbef2bbec076c84da387630ebd7a627a34e649c3ff49
SSDEEP 196608:Rd25AeEgAkBNcfdQmRJ8dA6lMfCy1ArqkVpKCX+PrF4ZUeghyTpRED6:G5tElvfdQuslMfrAZYCuPJOUegSQ
TLSH
T13B9633A032C40DFAE966953AC8159D2DF2E1BC136B60C19B83D8AB9B0F572C17D77718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Soda.v1.4.exe

File Explorer

Soda.v1.4.exe

.exe 8.6MB
main.pyc

33KB

Soda.v1.4.exe

IMPHASH ba2fe82dbe3fc8bdddc26ef88c3ef15a
SHA256 e06623cc4bc2227bd3aeeced3758776051feee79102ad9f8cf79f1575f6d2e7e
MD5 3eba7aed5636cffd9b8b8a3780870db3
SHA1 e843680db1eccde091cd8ed10c4e65f91472ca5e
SHA512 20a0aa5dec7b1ff9c9ac169690e316bd4edf8bc3402f19301c79960999c1cc75a0b6845642d90fb7b09bcbef2bbec076c84da387630ebd7a627a34e649c3ff49
SSDEEP 196608:Rd25AeEgAkBNcfdQmRJ8dA6lMfCy1ArqkVpKCX+PrF4ZUeghyTpRED6:G5tElvfdQuslMfrAZYCuPJOUegSQ
TLSH
T13B9633A032C40DFAE966953AC8159D2DF2E1BC136B60C19B83D8AB9B0F572C17D77718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

46288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetWindowThreadProcessId ShowWindow

kernel32

GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle WaitForSingleObject FormatMessageW GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW LocalFree SetConsoleCtrlHandler GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte HeapReAlloc GetLastError WriteConsoleW SetEndOfFile Sleep EnterCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Sharing