pysilon | source_prepared[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
source_prepared.exe

source_prepared.exe

IMPHASH 1dcd477cce07724ec6b817b3be71540e
SHA256 9db44df07b6907baf4fe1a19b7412b58e1dd5e42ccceb00ec8cb13d6208e8760
MD5 8b97436488c35b756b16a09f2bbde5fb
SHA1 53ce446b93f7f23919b543500e8e814ff34b7f12
SHA512 3b323656224b406e64afe9bf9cce0b23333a176ade229bede6712a4d3bd4dcc2441ecca5fa54ea732e87e9e5433ea33f19ae3aee94bb8d840950b0b6c0ea4aa6
SSDEEP 786432:G5vzUSApLRvjXoRldWzct81JEYMW82FS360lHnGCnkcx8y1JFETi2nRUesW/MyNZ:G9zApIa8WElHnGCnkxmcXNepXTUgIw8n
TLSH
T1559733986F848CCEE4856A35D0D75810D7E3F62607B2D0DFAEB958910A231C4FA7EF25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess QueryFullProcessImageNameW GetEnvironmentStringsW CreateSymbolicLinkW SetErrorMode GetCurrentProcessId OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile SetDllDirectoryW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

ConvertSidToStringSidW OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 df52b94bd0c7873d2752dae3fde82d1eb16a30048c958d58dec2c38141d5a0de
MD5 95d0e0ae16b22da939eb1e25cc3fd11f
SHA1 33ae8dad3060d9d9f3d296cfc2cf3b18bd04c429
SHA512 43a7406dc4ea7b4b6d13ca4de114ef7b51fa0fd205c0c9661a35ff728c7a550fc012b20ff3e287b746eb09a1e9be3a2bbed13ca9f77290558c8f914e2d46c17c
SSDEEP 192:bJqqTmuEWauge+M6DA8AYv++JDcNQshU8En5W4NXOYd/G7XW:v9avP588A+DDWRm5FOUG7XW
TLSH
T16272F727C885846EEF44A03994EA6918BF7D1FC8B12553733A0F1260FDDAB65FA9024D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 e2b75af2a23af4cbdf7236a3a6907345a16ea5d86361679fcf20778433578b92
MD5 3da3f1ee5e766bd72712d9e3d53a4553
SHA1 a6e5a4f90c398ee89ff044637db053dc70ced393
SHA512 22ef70e8264f88cd41bd963a74417bbd4d21cd942aea74914fd6b8bc5081a19cc54abb6f9bfd137c0836792e61a185516597ad6dc03f5b11e47267f5e9d3ad90
SSDEEP 192:srGe41QfUE0xZVbFAI6dokUpjYnuHN3gQ:iDBifedokqYnuHN3gQ
TLSH
T1CE12C846CA58C03BFE60F17898E5885C72E96EC6F154C3173A1F4830BED7B96DA6821D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 a1c8ecfa3208ced0053d51a10b925422bd07ee4ee9d6dd6059323132e637b954
MD5 880a17ae63343ff21276992c3e9632a8
SHA1 e69e5228af81e5c2c0b5010fabe144b67cccba02
SHA512 4c2eae53c810f96c2f16408d652f4ca6611a4d0adfce1cee4d3444a824db4adae869e93b3f4b373183600f02ea53823007b1513ea0a3bd870154fb9ba127da4f
SSDEEP 96:vDh/7Y8hVPUywfLDwfPsULKliOCpmrSTUpjdaJuo1kUZsX3g:vVRCywfwXsULPJmDpjwN1kIo3g
TLSH
T14791D996A18064A5EFB081F450E45854636A67D3B1549303324D93A66EEFF745FB230E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 3f0323dbbd17565e1cfecd621cf2e7439204252f5c2c78c6ec8f6b67e257c605
MD5 a602e1b10bd0835f98489b647f9b987a
SHA1 a1569d84be9ee25fbe463f92d7799fe9ad039011
SHA512 014c052f392fee1f37246a55c559bc0892b5a20e164394f640a9fe0388faf4c5e362559d89e0b459b87e3633f788b530b6d5ca918a92be96ab67a6f27cd6f3cf
SSDEEP 192:0tkwZ6bLQ3hT8+NE102sGMleDkUhMbvEh:dwZ6bLQ3RzHOMER
TLSH
T161F1A49AEC414862FE30F0B5C0B18444B77DAAC3B620C712211F51AD9CFBEFA895970D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 a05742be0ac67438b5df375b93fce33e1b818124b0153d3b7ba695d8c1f0a7db
MD5 6d615e32b17e52bea2217d1dcbb40ca1
SHA1 a7af491e88559c6e0c36a6f7c903ba4110e5a444
SHA512 2c434211819a66dddf651c9693e88033ccedf0391942fa86b0ef000daeb968534b7331c640147aaa901900469878e72613e2714c88efc44024525a72d7d98e5f
SSDEEP 3072:NHUawF05YGl3S2SVfUFoGoD7iD6GxrhQpvqda+oqZsilDY:N265hlrSNGo6r6Jqda+TsKY
TLSH
T18604E9E55496892AEF00A136CCDC84C0B38D7E95B311C732363F87B07AEA959E9E574C
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

source_prepared.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

source_prepared.pyc