pysilon | source_prepared[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
source_prepared.exe

source_prepared.exe

IMPHASH cf72283be50852e418ce6bbb6b645835
SHA256 3287d982918eb91a5342796981ff18e8cd4d55d5236dd11d8ea9c32a41f98a9d
MD5 701c437ad3b3d64d65117bfde0d6a410
SHA1 63f600f88f68d4962717a0aba01bf43d176442ca
SHA512 da6ddb9a94a2bc1a5330f9c37ab1fcc67c38a47002fa203cac51c65a6b95828231a33204504ced0321293ba36a4bebb28d951cf22107b8fae437032db931ec91
SSDEEP 786432:YoS/oSIsuzcW8f5pIlJXee7BRqxWwDWkQ9QB:YoMo/QWS5pIlJue7CgaWkQ9Q
TLSH
T1D56733D47B8948D9F1A62436A0C7842382B3B4A20772D5DFE7B85C368A631D0ADF7F51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW GetModuleFileNameW GetEnvironmentStringsW CreateSymbolicLinkW SetErrorMode CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile SetDllDirectoryW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 df52b94bd0c7873d2752dae3fde82d1eb16a30048c958d58dec2c38141d5a0de
MD5 95d0e0ae16b22da939eb1e25cc3fd11f
SHA1 33ae8dad3060d9d9f3d296cfc2cf3b18bd04c429
SHA512 43a7406dc4ea7b4b6d13ca4de114ef7b51fa0fd205c0c9661a35ff728c7a550fc012b20ff3e287b746eb09a1e9be3a2bbed13ca9f77290558c8f914e2d46c17c
SSDEEP 192:bJqqTmuEWauge+M6DA8AYv++JDcNQshU8En5W4NXOYd/G7XW:v9avP588A+DDWRm5FOUG7XW
TLSH
T16272F727C885846EEF44A03994EA6918BF7D1FC8B12553733A0F1260FDDAB65FA9024D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 e2b75af2a23af4cbdf7236a3a6907345a16ea5d86361679fcf20778433578b92
MD5 3da3f1ee5e766bd72712d9e3d53a4553
SHA1 a6e5a4f90c398ee89ff044637db053dc70ced393
SHA512 22ef70e8264f88cd41bd963a74417bbd4d21cd942aea74914fd6b8bc5081a19cc54abb6f9bfd137c0836792e61a185516597ad6dc03f5b11e47267f5e9d3ad90
SSDEEP 192:srGe41QfUE0xZVbFAI6dokUpjYnuHN3gQ:iDBifedokqYnuHN3gQ
TLSH
T1CE12C846CA58C03BFE60F17898E5885C72E96EC6F154C3173A1F4830BED7B96DA6821D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 a1c8ecfa3208ced0053d51a10b925422bd07ee4ee9d6dd6059323132e637b954
MD5 880a17ae63343ff21276992c3e9632a8
SHA1 e69e5228af81e5c2c0b5010fabe144b67cccba02
SHA512 4c2eae53c810f96c2f16408d652f4ca6611a4d0adfce1cee4d3444a824db4adae869e93b3f4b373183600f02ea53823007b1513ea0a3bd870154fb9ba127da4f
SSDEEP 96:vDh/7Y8hVPUywfLDwfPsULKliOCpmrSTUpjdaJuo1kUZsX3g:vVRCywfwXsULPJmDpjwN1kIo3g
TLSH
T14791D996A18064A5EFB081F450E45854636A67D3B1549303324D93A66EEFF745FB230E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 3f0323dbbd17565e1cfecd621cf2e7439204252f5c2c78c6ec8f6b67e257c605
MD5 a602e1b10bd0835f98489b647f9b987a
SHA1 a1569d84be9ee25fbe463f92d7799fe9ad039011
SHA512 014c052f392fee1f37246a55c559bc0892b5a20e164394f640a9fe0388faf4c5e362559d89e0b459b87e3633f788b530b6d5ca918a92be96ab67a6f27cd6f3cf
SSDEEP 192:0tkwZ6bLQ3hT8+NE102sGMleDkUhMbvEh:dwZ6bLQ3RzHOMER
TLSH
T161F1A49AEC414862FE30F0B5C0B18444B77DAAC3B620C712211F51AD9CFBEFA895970D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 0ecd0c654179de74ac1b0da43632feb128196937a742e4afc2cdecd14d5ca3ef
MD5 050c3c5b4bb971505219be74b4c33991
SHA1 6026556839e9487bebc4187f10c846186963b94a
SHA512 c0234614491df61f57c7b486a6d673ead63431693a37b9c52e1a8c6a6a6d45683d06e04f4e99bae121fcd84d361857e45806157a8f8d0c2713c322310c7768af
SSDEEP 3072:IUawFRqRnGd/UqyGoS7iDsjJ/2KxRysilTj9:9fEnCgGosj5duswj9
TLSH
T109F3E9D75496992AEF00A136CCDC88C0F38D7E8DB315C732291F8BB47AEA959D99530C
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer

source_prepared.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

source_prepared.pyc