3db887b2bd67abeb23b9cd3ecf2ecf59e4ab1cb54607dcf1f140c3e3f8d1ac33
- SHA256 3db887b2bd67abeb23b9cd3ecf2ecf59e4ab1cb54607dcf1f140c3e3f8d1ac33
Behavioral task
behavioral1
Sample
HowToFishTrainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
HowToFishTrainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 3db887b2bd67abeb23b9cd3ecf2ecf59e4ab1cb54607dcf1f140c3e3f8d1ac33
- Size 9.1MB
- Sample260831-klbbtsfp9w
- SHA256 3db887b2bd67abeb23b9cd3ecf2ecf59e4ab1cb54607dcf1f140c3e3f8d1ac33
- MD5 d25e2e4a0ac08f9aafa5efe09ffb1e4a
- SHA1 952b92206eb89d3a3d0faf6112cac7aa4036beea
- SHA512 0ca24c0133e88f3b03e808e7d57eb3b6f70a7f945da5e4a3ed603aa189149ef15c0c92eb895ac10c727e6434c4621e77770c512b323e8a3757b97886f6e9cb03
- SSDEEP 196608:1ElRhcpB0LCeB4c1YRbv0OhzsVMP8iK3mrFntbHjbytq2V:2UBCiG4b8GeM0WJnJDbb2V
- TLSH T190A633F8D6964C5E481FED535D6C42728396F02C8898D01E1B648F4A87CF9AF7CDB289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/HowToFishTrainer.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HowToFishTrainer.exe
File Explorer
-
3db887b2bd67abeb23b9cd3ecf2ecf59e4ab1cb54607dcf1f140c3e3f8d1ac33.zip 9.1MB
-
HowToFishTrainer.exe.exe 9.3MB
-
run_trainer.pyc554B
-
使用说明.txt1KB
HowToFishTrainer.exe
- IMPHASH ed71b47f404234b025eb1f9c0778046c
- SHA256 d4def4e6531100da3216d754f80b732a7c9f94e1676edb931e492a31525bc44d
- MD5 2d03a03a91b1228273819e7ff2debb0a
- SHA1 9846330cd96f8a7be6c2ff9f95c94339261e4877
- SHA512 74c372c6f410edde5ac25003d1f225d75f12ef43c5fd55bc8c20d583e777595fda25eed1b1dbddd584565823a54b058e202c11cbdbcd38f5094e7e275c69f798
- SSDEEP 196608:g/pWZtbW897GTPHMe81SF2RPUewYttKZ2lmHLF2d+C:qE1SPsZg2KepK4lmrZC
- TLSH T196A63359979408AED867DD3F8869C272D3B2B83597A0C0CF0BE08B163F471E96C7A745
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
CloseHandle
GetCurrentProcess
QueryFullProcessImageNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
HeapSize
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
Process32NextW
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
run_trainer.pyc
- SHA256 4a80acbbea1daf1c9a2a5ea598c92bee8a88a796086b47d9c57b3dde4dfbb20d
- MD5 de3d7eb3be74948a29aed18a971e8e37
- SHA1 b236919fd581178ef569ef694c10c0304679dff0
- SHA512 58cdb083e60fb1e71a2871037f476706c5e453fe57803562f487be24be4f523dd3f6f8144e34ca38cb64771960f295dec17c1b3a98d05fde3b74ac611d33c749
- TLSH T1E9F023626B90DAD2E5DC233CE1AA50623260CC9C9803D1D37A04A02E8FDDF124C71A0D
- MD5 SHA1 SHA512 TLSH
使用说明.txt
- SHA256 6a80d59d1ca93de1ca82bd049bc97c209ee0c49bde009c2216462ff1d387661d
- MD5 2083f689ea8f0ddbb4fe930a5cc3a71c
- SHA1 9de6f92c747f95d9fb52b11930a14fc369190598
- SHA512 b2fbfafd7813cbf096ca7f82d0808ae51a34f249b445c4f1100be37f5ca552bfa4e33f6b7dda0775d5f9c4fd8a779a6646f9c1ec6d4e9e8df2cd5edbab85aad1
- TLSH T1022135CE19C82D9F366115DD334413F57921F927CDEDF6755681D8AC984C2280B5845D
- MD5 SHA1 SHA512 TLSH