Winlocker-main.zip
- SHA256 737f7cd1ff80e85b39da8bf48d28d012e4336f1e264e4d4a06bdbcf43109fdfb
General
- Target Winlocker-main.zip
- Size 12.6MB
- Sample260825-t3btcssvfw
- SHA256 737f7cd1ff80e85b39da8bf48d28d012e4336f1e264e4d4a06bdbcf43109fdfb
- MD5 72a29a001c99396682cbb654eac7a8e7
- SHA1 7fdd9bca7ee89e36be5f2840c22acc979cbec5f3
- SHA512 8564e9d2da5607437f0747d1271b3b8bfac4fc75d325d3cf48906332b3a55682558f2fc44c7c559772c461587b1fd61dea9c7a9819c72638802117631d9f896d
- SSDEEP 196608:uH0/pvw2Gt3KM4ImwKTU/RPFZF4NDPKyUN1OTVM9OeUfskLI9XgwTgUDLx6mu2s:a0p5KZfiKyUN0mgkJgwZ9s
- TLSH T158D6334FBDE2BE45230A6467C8353DB1D662F87509C8943E3A8EEE179CE11C56A7CC09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Winlocker-main/CSGOHACK.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Winlocker-main/CSGOHACK.exe
File Explorer
-
Winlocker-main.zip.zip 12.6MB
-
Winlocker-main/CSGOHACK.exe.exe 12.7MB
-
main.pyc2KB
-
Winlocker-main/README.md179B
-
Winlocker-main/icon.ico5KB
-
Winlocker-main/main.pyw1KB
-
Winlocker-main/sound.mp359KB
Winlocker-main/CSGOHACK.exe
- IMPHASH e80743c07544c5ad641cc3377170baf7
- SHA256 d9b9850dc6bcf453df50c4df3476b403788cb3a564479ca5f3b9924e12aba2fa
- MD5 54fca4136e167f69cdb77e4d3143b023
- SHA1 a6ac29ab7b233835f173692fc3f4622f15aecf99
- SHA512 b377dfef5d3370c35740d8e37e61255b3bdeeb54b742ab58bfa3d65d0f8e7a2c94b81f0283acddca5cccb1d64ae63779bde0d36e986b7599a2a1bd7c3cbfefa2
- SSDEEP 196608:qqTEbGXVSGICteEroXfLaSzHNAmzlxZV3Gu5D4S267ygEGPt2CS3O+j8kgHfUITJ:rEQInEroXTD14S2D7qcut/UIhH
- TLSH T126D6334BFBF50CEAE21A8273D8649436C1B2703547C8A57F2BDD98268D9B2D57FB0601
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
44000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentStringsW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=7, id=259, version=27412,
count=189, id=261, version=27412,
count=4, id=253, version=28518,
count=38, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=9, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=11, id=257, version=27412,
count=135, id=1, productName=Unmarked objects,
count=20, id=260, productName=VS2019 v16.9.4 build 29914, version=29914,
count=1, id=258, productName=VS2019 v16.9.4 build 29914, version=29914,
main.pyc
- SHA256 06a589d13e13304a50b8c3bdd01fb48cca62d2a680c60054c07c01580282c9e5
- MD5 088e111f6ee19db677f48add04241b62
- SHA1 991e1654fe1733b0953d76173709bc1456846870
- SHA512 d10c46df5b69d39a081ca29d5997967b62fd2723545b1c6fa6e70132195b184d15fbd1a8bdcd8e51c01cf51d3b9faf19dfc0e8947c5b7039238f9ad2b8febebc
- TLSH T1F541FECC8A117F79FA45F3F5543B31A88626D960730F9643EA64712DCC464503EA3DAC
- MD5 SHA1 SHA512 TLSH
Winlocker-main/README.md
- SHA256 7f8d6abc9fe64f31d2785a0ee121f60dedbf4301f0dc64080a274381dbc3f619
- MD5 40fbf56dc905f2627df7b232f1e640ae
- SHA1 c300a90f65bccd32910a824f20ce42609c12e15b
- SHA512 12e985b6ba995e8a60186726247654c665d17ed4ba8b22664bceff44489ce904de64135eee3647f8798f8cf5fd71b98baffe890668e746878b73d1e4c5341b27
- TLSH T156C0C09B05E238B37F580C510D0338C41C260F3417E4C445903BE048D1CF1339172362
- MD5 SHA1 SHA512 TLSH
Winlocker-main/icon.ico
- SHA256 5809dfb5bab66431ec39eb634fc5bd7746df98647fbc82425cc884a5610eac03
- MD5 37444f60dd9ff8ad4c9794158b3eb27b
- SHA1 d32f8b4d4f62bc9a8ab9b7655fd7d7e07758e0dc
- SHA512 4cacc728fbf70a20640144e12bc84220456235432ef8257708d7ee64e48f90e421577076c08e055aae98bfd77f43b21328e64fd748a4482e81f6d101c809149c
- SSDEEP 96:KD7BxlTJQb7P3lfZr4wC5ZSP4Pxjyj2RNgQduNDmVypBennB0Y95TOY4YiE0sU9:GNJO4wC5EP4PxDNgJdBennBN5WVEtu
- TLSH T187C19F90BE4B64EFFD58742754945A5293EB8BA5F71A8C207936CC3DCE0378068E12F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Winlocker-main/main.pyw
- SHA256 b2bf6c86b39ed8abfae05648ceb7ed5c50cf4c7249c45a9c05a26dc9c098ccc3
- MD5 a562479bc8ac111a1ecc799a9df15307
- SHA1 3621b4840b3863b6807b36cd76be93ba2def7fe4
- SHA512 0cdc9f06c8b00c3af335d8ad03d66402e7ec1322993b85c1d69c9a90556870ce26c492f8b13cc015c7605e5a2a12203ed517782a01d19678602faa2a93c8d66e
- TLSH T1B231F27199394AD1F200FC3A1C771034FE1192746E71E8EDE42A23743F66E27986995D
- MD5 SHA1 SHA512 TLSH
Winlocker-main/sound.mp3
- SHA256 b4c71a91687021860f13751c1e8ae856d7d8eb330bd25fe5e405e040ef7fd2aa
- MD5 02bd8fcc7a53418bd66f9bfaf613cadf
- SHA1 2e73048eaca0257b9cf3c5835a3af71f967e5ddf
- SHA512 0197489c68f75347f749699df034d07d4c1a0dff2c782689c7cddcbc908057b02bdda1169b1610cc2cd1c0dda41b271c89fe76c01e26be0f45f7bb2580f62ddc
- SSDEEP 1536:MwCok2i6FAhGhZEAyPOesN7kemZ3pnjNU5xXwh2f1QW/j+w:wsChGzWzNBJNkfKW/j+w
- TLSH T1B853F2887102521BF67D15B9980A8961DF1C2E47171AFBC1A8CD337153FD2E92F1AD4A
- MD5 SHA1 SHA512 SSDEEP TLSH