update1.zip
- SHA256 d2ece067dae0c6921b68ade8a9779b92da96f940437b8e192f9ed89a175fcd62
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pysdthonw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target update1.zip
- Size 1.7MB
- Sample260808-w1brpafa55
- SHA256 d2ece067dae0c6921b68ade8a9779b92da96f940437b8e192f9ed89a175fcd62
- MD5 0ee33f76b0a2f488b546a19d0cf918f2
- SHA1 46499d2aa76f6cf6087d84d6bc0dd8abbb4a10df
- SHA512 6669706553bad3b65bde97742aba9b3a9c5bb0f3ed1843982bdf6f9baea707ea1c9d8aa08367d3d765e8d319feef26469208ce8c1c60203947891c5e9e7e28b8
- SSDEEP 49152:e0bzvKcRYebVwQ/+0IXhUJ0oD01udiHDNoTJgf:jbrKcVbVQFXhg3DIukhoWf
- TLSH T180853389BDED61135D26FEA2E0F319E8322385C72CEAFB4070BD8C15D7654E960A7316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/pysdthonw.exe
File Explorer
-
update1.zip.zip 1.7MB
-
pysdthonw.exe.exe 3.5MB
pysdthonw.exe
- IMPHASH 29f51ceab0c281a1e4091d3f519edbdc
- SHA256 a0e0ba8ca27b68979819e03cb64097b9f608001cffc36d64b828e0d65078ca07
- MD5 0232d8fce6044f6e13b5acd0c964565e
- SHA1 f77f025f78f1e6e647b7ebab31555ec249ed1b35
- SHA512 8e2e5a33245649ca514eeeb894938e6a3f5e5d9fbed4de82297eeec142dadc6d6c44a03e7f3bd3e89e3cf2afb7299804c5af574065efeb47b5947aa078d74e9d
- SSDEEP 24576:TDoDG3S3iQ5348lK7skdIKBQT4Ox2dRjxD8ZQt/DTOvWN0HZrxAEZ5SDCKBylpvn:TDoD13iQ548l6B9OxjGTO+gepDBr4rBh
- TLSH T153065D5F66F056EFEA46617C08F5332DEF6F056003205CD3DE8759BA842AADB8DB044A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9c:2d:28:02:f0:ea:3f:72:f7:77:7d:e5:15:c8:05:e7:8e:8a:c0:17
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US
Chains
Aug 6, 2026
CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US
PE Signature issue
Digest
9c:2d:28:02:f0:ea:3f:72:f7:77:7d:e5:15:c8:05:e7:8e:8a:c0:17
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Netgear Inc.,O=Netgear Inc.,L=San Jose,ST=California,C=US
Chains
Aug 6, 2026
CN=Netgear Inc.,O=Netgear Inc.,L=San Jose,ST=California,C=US
Subject
CN=Netgear Inc.,O=Netgear Inc.,L=San Jose,ST=California,C=US
Serial Number
4c:17:4a:40
Issuer
CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftKernelCodeSigning
Revocation Status
Not revoked
Timespan
Jun 5, 2013 - Jun 6, 2014
Subject
CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US
Serial Number
4c:0e:8c:3a
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 11, 2011 - Nov 12, 2021
Subject
CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US
Serial Number
69:50:43:d6:8f:15:55:0f:d5:db:37:0f:a8:81:7b:04
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 21, 2011 - Sep 20, 2013
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
6
Entry point
2855658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Poltarbi.pdb
kernel32
GetConsoleOutputCP
WaitForSingleObject
RtlCaptureContext
WriteConsoleW
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleHandleA
GetFullPathNameW
FindFirstFileExW
FindClose
CreateFileW
GetStdHandle
GetFileInformationByHandle
ReleaseMutex
CreateDirectoryW
ExitProcess
GetModuleFileNameW
GetTempPathW
DeleteFileW
GetFinalPathNameByHandleW
CopyFileExW
MoveFileExW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
LoadLibraryA
SetFileInformationByHandle
SetLastError
WaitForSingleObjectEx
GetCurrentThreadId
SetFilePointerEx
HeapAlloc
GetLastError
GetFileInformationByHandleEx
AddVectoredExceptionHandler
CreateMutexA
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
WriteFile
GetModuleHandleExW
FindNextFileW
SetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
HeapSize
FlushFileBuffers
DecodePointer
FreeConsole
GetCurrentProcessId
GetSystemTimePreciseAsFileTime
FlushInstructionCache
WriteProcessMemory
GetCurrentProcess
CloseHandle
VirtualQuery
HeapReAlloc
HeapFree
GetProcessHeap
GetCurrentThread
SetThreadStackGuarantee
GetProcAddress
LCMapStringW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCommandLineW
GetCommandLineA
QueryPerformanceCounter
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetCurrentDirectoryW
GetEnvironmentVariableW
CompareStringW
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
ntdll
NtWriteFile
RtlNtStatusToDosError
NtReadFile
Name
.text
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
471KB
Virtual Size
481KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
205KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=141, id=261, version=33145,
count=19, id=260, version=33145,
count=21, id=259, version=35207,
count=17, id=260, version=35207,
count=39, id=261, version=35207,
count=3, id=257, version=33145,
count=124, id=1, productName=Unmarked objects,
count=10, productName=Unmarked objects (old),
count=1, id=255, version=35228,
count=1, id=258, version=35228,