123[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
123.rar
Size 13.5MB
Sample260924-peatyatblb
SHA256 d1cf22cc82a825d022129d94a31d9fc368612f434cba0747903d5a2315c8e8f3
MD5 51902d39a606bae45ae5db74186a21e9
SHA1 c91f7123831e951844e49f158fecac20926739f5
SHA512 2086e4e76c6084c2bd4031e900f72ae7aab5ee24be04c560ea6773ed1f979bc842b9d5c6d9bed5e0a1c0986aaf74d504624cbfd18d6aae51eeb40f5edd71b6eb
SSDEEP 393216:SkD1eURqw/qCHurSfP8WtimYZfWwZWR+jhC1iUxw:LDqw/qCHu0UWImY9JWAIiUS
TLSH
T1BEE6331A6B0CDED5E4B9ECD953C6605E2CDE369A0390F8E5E8E405888B1B0BC1F5D3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/123/cracked.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/123/cracked.exe
unpack001/123/loader.exe

File Explorer

123.rar

.rar 13.5MB
123/cracked.exe

.exe 11.6MB
cracked.pyc

115KB
123/loader.exe

.exe 4.2MB

123.rar

SHA256 d1cf22cc82a825d022129d94a31d9fc368612f434cba0747903d5a2315c8e8f3
MD5 51902d39a606bae45ae5db74186a21e9
SHA1 c91f7123831e951844e49f158fecac20926739f5
SHA512 2086e4e76c6084c2bd4031e900f72ae7aab5ee24be04c560ea6773ed1f979bc842b9d5c6d9bed5e0a1c0986aaf74d504624cbfd18d6aae51eeb40f5edd71b6eb
SSDEEP 393216:SkD1eURqw/qCHurSfP8WtimYZfWwZWR+jhC1iUxw:LDqw/qCHu0UWImY9JWAIiUS
TLSH
T1BEE6331A6B0CDED5E4B9ECD953C6605E2CDE369A0390F8E5E8E405888B1B0BC1F5D3E5
MD5 SHA1 SHA512 SSDEEP TLSH

123/cracked.exe

IMPHASH e3e80a143805ea18936c8f612e25d363
SHA256 4a5f462457deb97e5d67d060d6e25425646872c9660431c2128b11538bdc2bd1
MD5 07cd34569229e5b63e3265978660d779
SHA1 ad66e2c6f8de16b95612632ea944082a453503d1
SHA512 d808cf675d47075544bb7839036c485858bc1cefcaa0f90c0497c6a127e1f1e5de788a805ea8f7ff41df7906cc8116a86c0fd34a16b50bdf52f25ddb87ec4bef
SSDEEP 196608:PNhsqlGN4fnHGymN1WxwRRZj+PC7+O00L3dTz2K1+lYzL4uOOZ597K7DDs7n:kqHfmymN1SwRn+67+d0L3JzN1zL4uOOb
TLSH
T130C63351B3A480E1E5BA4638CA909614CBB07C660780D9DB35E1BF6B7F772D25C38BC6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

GetTokenInformation OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

424KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

123/loader.exe

IMPHASH 1ecdcc7765a0197bc6bbdfa2ee8e5614
SHA256 9e4ab16dfd5d6868467f4924296377ca67ebe8cd91e58f356aee5eaffab8f224
MD5 434b5524f9df6a89a09d6e686324e582
SHA1 f48322f7e38084fa0ff8e376bbaa8b484397ce91
SHA512 baf8d51508da297f1f1431fef5457303906b4de2dde1ff3590f28367796c91081eab4f037040c22fee99c67a756176b9e35f4b89157a09d040d25a8b3403b812
SSDEEP 98304:6//co/Y7mgTm05AwJHE6h9RxhQY2M7y1ePcaZVY:6XRg7PAmkuh375cSY
TLSH
T14326F00AF3924A9FD3A6A238C992D753D7767408472247FB3BC855189EC6AF04E3D781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

678944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CryptImportPublicKeyInfoEx2 CryptUnprotectData CryptProtectData

ws2_32

ntohs setsockopt getnameinfo ioctlsocket freeaddrinfo WSACleanup closesocket shutdown WSASocketW getaddrinfo WSAStartup getpeername getsockname send socket WSAPoll connect recv getsockopt WSAGetLastError

advapi32

RegCloseKey GetTokenInformation OpenProcessToken RegQueryValueExW RegOpenKeyExW

user32

SetClipboardData GetClipboardData PostQuitMessage GetActiveWindow MessageBoxW SetCursor ShowWindow EmptyClipboard GetRawInputDeviceInfoW RegisterClassW GetRawInputData RegisterRawInputDevices wsprintfW DefWindowProcW MonitorFromPoint GetWindowRect DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW GetMonitorInfoW DispatchMessageW PeekMessageW TranslateMessage GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture CloseClipboard GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard

shell32

SHGetFolderPathW ShellExecuteW

kernel32

GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapReAlloc GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx GetFileInformationByHandleEx ReadConsoleW MoveFileExW AreFileApisANSI ReadFile FindFirstFileW FindNextFileW GetEnvironmentVariableW FindClose CreateFileW MultiByteToWideChar CloseHandle GetProcAddress LocalFree GetFileSize ExitProcess GetModuleHandleW GetSystemFirmwareTable GetVolumeInformationW DeviceIoControl GlobalMemoryStatusEx WideCharToMultiByte GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter LoadLibraryW GetCurrentProcess WriteFile GetTempPathW GetEnvironmentVariableA UnmapViewOfFile Sleep GetTickCount64 GetLastError CreateFileA DeleteFileW CreateFileMappingA CreateProcessW CreateDirectoryA MapViewOfFile GetTickCount CreateFile2 SetStdHandle RtlUnwind HeapSize WriteConsoleW GetFileSizeEx SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx GetConsoleOutputCP FlushFileBuffers GetOEMCP GetACP IsValidCodePage SetEndOfFile EncodePointer FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW

gdi32

CreateRoundRectRgn

setupapi

CM_Get_Device_IDW SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoListExW SetupDiOpenDeviceInfoW SetupDiGetClassDevsW CM_Get_Parent SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiSetClassInstallParamsW

iphlpapi

GetAdaptersAddresses

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

874KB

Virtual Size

874KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vlizer

Size

927KB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

123.rar

123/cracked.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

cracked.pyc

123/loader.exe

d3d11

bcrypt

crypt32

ws2_32

advapi32

user32

shell32

kernel32

gdi32

setupapi

iphlpapi

imm32

d3dcompiler_47

generic