HiddenDisplay.zip
- SHA256 beb55e284556cc6f8494bac8b4c9f3ec1184f6d11644d02eb12eb5fdb6b31605
Behavioral task
behavioral1
Sample
HiddenDisplay/HiddenDisplay.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
HiddenDisplay/HiddenDisplay.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target HiddenDisplay.zip
- Size 51.3MB
- Sample260821-1eptmsde23
- SHA256 beb55e284556cc6f8494bac8b4c9f3ec1184f6d11644d02eb12eb5fdb6b31605
- MD5 0847f2acd6b1d02cc8bd7d71bccec42c
- SHA1 d20fc4f542887ed1622e7829d71b20f90b627bea
- SHA512 4a3580a84935a912f85043d2b15de0679dc633513edc55dc4a80fa18b25aa55b478ed6996074bd88e5c81dcee2d38de7cd64ab984e52f793c3931d898a8b0444
- SSDEEP 786432:dnG/mpRsX01Et3A2VnotbJhw8shrOeJnSPG/x04/jCdj3KX0mojPmotM7Ry0XKYA:JoPt3whVskWP/FbCFDmf9QF
- TLSH T167C733A81339C7A6296BDB6A05004F1A732F1C7A1130D5FD6B7A6DAF847D266BFC3041
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/HiddenDisplay/HiddenDisplay.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HiddenDisplay/HiddenDisplay.exe
File Explorer
-
HiddenDisplay.zip.zip 51.3MB
-
HiddenDisplay/HiddenDisplay.exe.exe 50.5MB
-
main.pyc4KB
-
HiddenDisplay/MyGirlFriend.png.png 25KB
-
HiddenDisplay/blood/MatureData-WindowsClient.pak365B
-
HiddenDisplay/blood/MatureData-WindowsClient.sig532B
-
HiddenDisplay/blood/MatureData-WindowsClient.ucas1.2MB
-
HiddenDisplay/blood/MatureData-WindowsClient.utoc8KB
-
HiddenDisplay/icon.ico43KB
HiddenDisplay/HiddenDisplay.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 ee3576471fe4003d4b5bd934e6456248cfe78e5103b0b4634a36de2b92f933fd
- MD5 137641de17bbab2fe321dca7916da301
- SHA1 9e7f2761ce60d4981bcc8a6a91eb36b29c2cd7e3
- SHA512 618242eb4446beb838dda8c41e2247c2fdb57cbc5610842659165260c3e86d3b016715a460c67435c88fce2b89fef22e370b38243e75395889356dcf99a2cbcf
- SSDEEP 1572864:dt1HMzzJVr8eD51xQPSBLW9qb3S4jeRp:dLHMzbZKSBL0qbi4je
- TLSH T1DAC7338423688469F5E7873540418F5737AB387B53B4C2FF9AB46C9E6C631E0BF6A640
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
main.pyc
- SHA256 e1d1f795e39592851932e66e113e48ead384ba641022605589ed6fe1491f801b
- MD5 19d3e66c19db380bf4e180554b6ff7f8
- SHA1 c5673d0039b6e99a9989324320c3ea141b25df06
- SHA512 58a2fc38839008f7e55cb4f95b584eb218fdd5258c9a08e7979df31fa325db316afdcbe59039ffde932187bfcd815d37652f74a1fefa0372684e71f23871f7ba
- SSDEEP 48:HwuM9Hxih3jcyCczi8UWX0xy+FBbNM4ls6xPHfgf8OiFuyIcpHzsypfxvuOh:EvihofQi8UC0xHdDlZtHfYCuyHIyJ1h
- TLSH T1078161456B939777FC64F9B18489376B36A28270B200C36717FB91123D46091AE650DD
- MD5 SHA1 SHA512 SSDEEP TLSH
HiddenDisplay/MyGirlFriend.png
- SHA256 f6ded1f7fac2377cc8d5ee817b672a77214cda6a0ea8cb33e0a00bce35fd0371
- MD5 5b05f1bccef2649fba1f48a57b4c0c96
- SHA1 8a90a28d63dd2e54eea11f3e3c4108558d675c9e
- SHA512 c26d6ae4b7135d776b13e2a2a4ff9ca777f1f5e091ebf4541250337fb3c26f68464f6ce202020a0cd78ba87759c39597b0908f2ab0fcb32580a1ccb962027c5d
- SSDEEP 384:xS0PdRpCHour3U4lsA/YudeVv2Un4lVsexUKbr6GZlQt8ZBkabnKNB:oCRpuJYjIDSexUuvMwtbKD
- TLSH T1E8C2434184B6946DCDDC18301AEBAB7C36B8DF9AF8944B67621BB3512B8B343CD55C8C
- MD5 SHA1 SHA512 SSDEEP TLSH
HiddenDisplay/blood/MatureData-WindowsClient.pak
- SHA256 faee055b04bf0ebc13b6a1e0eb628965dc2612e990ce77b660384b38f08be61e
- MD5 93b6626cc0781849dc8341c85091db29
- SHA1 56d1a6bedcaf2376495f0146c061f6ce1d85f8f7
- SHA512 22dfebe931405a8349b438b45b1d911269a7159a2e654b4cc01ddd4ef30a0866d9be2d67c9703f37e914bb7c20f75fb3d1186970adee50498f5567d7240d07cf
- TLSH T108E022CE3A1B058CF88440710B9160FA38C1648E643029C34212892E10E332C1CC9802
- MD5 SHA1 SHA512 TLSH
HiddenDisplay/blood/MatureData-WindowsClient.sig
- SHA256 ec481b9f75c7e785f6aa92c710bfdb5da5557fb3b256df1a88c23700fca2c4ff
- MD5 c30d8a92bc62c1ed2d0f4aca32237114
- SHA1 5d43e95b07ec82968033ddb00fb1913304ef99b8
- SHA512 ae62110c638f564f906ee5e35a4b61c9445eeebed1aae1286a37d2eee943b173e8aa58240630f31a6c7dbaa2bc8f0fc6d21dad5a8ace23c6a60fb321f7a27381
- TLSH T1E2F075087C1F40070DC2067E00AA9A55EF735FFA8BB55E8141F45535411853DDA1CB09
- MD5 SHA1 SHA512 TLSH
HiddenDisplay/blood/MatureData-WindowsClient.ucas
- SHA256 6a05fe47b4afe0cfefdc50ada7d633eb019e647a0d5066bea5047b50d3612b2f
- MD5 c4e57a4f77a76d591cd0f2bfc5e8da04
- SHA1 2af5adb74f1992ccda132006502484565d4d98fc
- SHA512 6e5bdd51b72e5280d4bf716ec321d3592b356b1f98b3da44c5cb3c3e4979b8b3e2e86eec1e7b45374ac7c6e1a0bc098589ef13a10e754148d7b1c23ffad07686
- SSDEEP 24576:jJvPVjklJto61avy1T2xc6C3O2kkfB/uvq9XzuvmjpYlYQgMy6aGjBix0veNv:jxNj85J/fOYp9MVaYixMeR
- TLSH T1DC4523DBA7F3C24AD016893A612B6F00F314B950AE074B47D726733D6DD70E5CA2A98D
- MD5 SHA1 SHA512 SSDEEP TLSH
HiddenDisplay/blood/MatureData-WindowsClient.utoc
- SHA256 199d726cf1be8a77a16e7d4b2dd6b38ecfff31f3b775f1430e58b1acf86fe43b
- MD5 ae8612d61ff486245c0c6d90b1de42a6
- SHA1 b23ba3fd02ad1a237218fd75249ec6c28ba2d6f8
- SHA512 7ab89a4ebce4ec01d2d52f54ede4263fd662935decd8e0e106a967ee5cb4d69d957c42dcbc755945380f7d62b05e0e72d2b1e4cfbce0e54aadc88e50ffd09c3e
- SSDEEP 192:v1qsjm2Z1FoywACM19EVvbc7x9RvGVNOoa7z:wZ2ZAywA19EVvCOaoaX
- TLSH T12002E5517781C762D2B541315EA7CB5C03291FF4AE87E70B23F8B36D72B32A94D85528
- MD5 SHA1 SHA512 SSDEEP TLSH
HiddenDisplay/icon.ico
- SHA256 14df81ac5104a96cd4bb705ac153e3313be993446ff70fbed8ca2c89e6548469
- MD5 a24a4516ded7dcceb45a3915440bc0c1
- SHA1 0e309b67fcc23dbb6cca44a647e2dacad43fa40a
- SHA512 3d38b726e692865126b57615c8c31389f0ae88f38062728abbd03990d7c5754010063e0edd1eb3ca4ec939cc3c6ec1fecb36c02a855f49224685636c07ab65a9
- SSDEEP 768:/itVRkbDSV4SLnlSUbAdclt/ES+TN74L5IMYe2boGVP7tXUHr2wms9mOCEB:/iRk3c4SLnlbcQtbKN74mDoGFBUHr3k+
- TLSH T15013F149C8AF2F827CD97F131B1921CE639576B88C89EB7933AD854FB82520C44936B5
- MD5 SHA1 SHA512 SSDEEP TLSH