SyntaxEasyCTF.rar
- SHA256 2714181f31dc887de9d020b5be8acda6ace910626c75789bb26f5a3a21f72bcf
Behavioral task
behavioral1
Sample
SyntaxEasyCTF.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SyntaxEasyCTF.exe
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
SyntaxEasyCTF.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target SyntaxEasyCTF.rar
- Size 6.8MB
- Sample260922-xqpq8sdd67
- SHA256 2714181f31dc887de9d020b5be8acda6ace910626c75789bb26f5a3a21f72bcf
- MD5 e0394823e3887cb2848d518b7e9b0fb6
- SHA1 121153943a251b5c399253a99204cb96fb63c922
- SHA512 6986641508fe37ad787fef884b45b8f70aabd6cebf1e3b89c29f2ff0f36bf00f414e3877d1b5bcf710b4466917d2cd5ce55a2fa6363f2d142f15c76e2df67283
- SSDEEP 98304:QxXQqYEtUNPvktiZsNwOtZBAgU5jir/p5WftlAjaa3rjh4fc6YHawcKRCYyjI9Xe:QdtUNktiZsNfmvlOWXAk+6PKk7jI9UYC
- TLSH T17566339DE3CC196602F4C71A0E6EDD380FD734AB117B7EBAC01581A6741FA95846EE83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/SyntaxEasyCTF.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SyntaxEasyCTF.exe
File Explorer
-
SyntaxEasyCTF.rar.rar 6.8MB
-
SyntaxEasyCTF.exe.exe 6.9MB
-
dda.pyc7KB
SyntaxEasyCTF.exe
- IMPHASH 351592d5ead6df0859b0cc0056827c95
- SHA256 93511db96ed1f5a8231fac4da5b1f8ed43ef24d8fdc5d2e2fafd10de2daa6bf4
- MD5 f28946b446ee820ca3a361d5e72ff93a
- SHA1 f1aaaa230ac2eace282f7eb412498c9be79227bc
- SHA512 d3b4fc81d59ef40b75822eb5eddc3f54b06af25e3b6d83e7f9e35bbf28ba83acdd64e00c55bf93a9e69e7f98375992e8a62b0591f296021306210e131d6ab7bb
- SSDEEP 196608:Mwc9bOurH3Q3qemdUSCtsoMi6o8M9qgqmz:Bc9bOu76mdUSCLzw2
- TLSH T1E1763318A3A805FEF9B7923DCB22C916E2213D515F62D9D707D08A833D336D16B3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
HeapSize
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindFirstFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33140,
count=141, id=1, productName=Unmarked objects,
count=27, id=260, version=35215,
count=1, id=258, version=35215,
dda.pyc
- SHA256 69471f0d68978b7460da36fbe42597e2bde74c5803b935dd9e918c23b8f11a14
- MD5 fc851d68770a38c3b8e38f956fe8842f
- SHA1 17f6aa0775d88e7346af72f519a7d0e345123880
- SHA512 716c93b586177a2cfe1c2a51c7747e1e3e3a4502895da54aa698114d1f316040c9969b3529b9b2d6431944abc7f033494235d0c6cd6e96bb8e21f31d2b22c45b
- SSDEEP 96:byaahibRyygmqhpLE7p3zfEN+4aSfv/zGxwJlV5wVfrmpvuSYkhxmQZO6aLYSeNG:byCydFyzMs4aSfv/zpfarSphScSaM
- TLSH T165F11E3294503365EF2C993840F1FC6C637DA9E1E6359313F0DE42E66EEA9618C21EC8
- MD5 SHA1 SHA512 SSDEEP TLSH