pysilon | source_prepared[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
source_prepared.exe

source_prepared.exe

IMPHASH e3e80a143805ea18936c8f612e25d363
SHA256 ebd27f70604cbc517272baaeace17ac3e03dcd6fd20eda23d1d1dfc6c195fdbe
MD5 32249a2598dad53cd7c3faaf6ba7f22c
SHA1 d80958d88ec4ee4174395fb451a7093c08f70eeb
SHA512 96a01e7780b837697b9f20d1ee1f8d85ed994fe683ece8def77bb2bde17e393aa0c731e36a6ae367b06defba3404ea2f949fec0d27a277f9251df190078e72bb
SSDEEP 1572864:LoMooXlXYWw9uyOkiqOv8im2ARJE7qlhpBBMjiYweyJulZUdgS7c/fYnRY1Dto3:LdRNY8yOknOv8i3KhLpnM8puu7c/AS7y
TLSH
T1C418334C5B4A6494D5CC307AFDFDD21481D0D98D1F20D9DB9A782B71AE722ADAC3AF20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

59248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

GetTokenInformation OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 efe56d7133c5038e8fb2ea01f3a1cbcd745cd3f5efc20c267542fc59c7d4d84d
MD5 c08f715b94e12e57557c32eb6b1f0547
SHA1 2a052bd66c3dba3a3a4c3386a8644c01a55ad9cf
SHA512 37da927cc76d92528b82df016ec9b42c2ffb435544a709e37402d7b459b9ae29c1e358b35915eb7e1ffe1c27333758e03923608c4c3f2cee1f5cb4915924bad2
SSDEEP 384:QGC7RYmnXavkLPJrltcshntQ5saa2holHVA:QGCuvkL9ltcsttQ5saaCgHVA
TLSH
T17B72F9529A57C03EFD98B1BC68463B0EFBB406947456A34369E79051BE4F220FE910DE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 7b5871235f90c2ed87f35dbdb708053209336464bf6bf30b7398dce3c71e50d5
MD5 a61f43549f8138d0c257afc4b12a2d76
SHA1 41d93ab67e005876daa3c1632edf57412c94338e
SHA512 e81b1d395eae7dac6b22c467695058cf07de7831597ad5c74c8eb8074c1c23471293336552fadb1bcc6ff87dc857eb095d2038233fa70434e8eb3d1f31e01532
SSDEEP 192:lyaBBeiNR9QfUF2x3NC79F21aG67+DAhN:lAiT2XtFcjKDAhN
TLSH
T1BC12E648EF9BD03FFCA4F1B408019B0DF6A59681B140834376BF8864AF1BA91AD944DE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 6034026028e173114f03301122d6497925e7ddb89c128e971d65b6e99b53e868
MD5 a5b9483805587427ee7e91ef95a40a46
SHA1 1d036e53f5c50d3b7843e4e9027e65a4839499f3
SHA512 99a82c78839651987f042c85e4bd36eca62bb373f1a56f1686440135a932bd984bab17b0d3181aabb9ed7ace9b6698f3e123897dfefc02ddf08c424dd9113851
SSDEEP 96:XSMlhovyznDweHPF8+VB7sHIZGQSWfvmyyZ1k9zhub:ioovyz8evq+VBXZGQlvmV1k5hub
TLSH
T1B091E8D274D6DCBAFCA0E1F800502F9E73B091A1B244C307314AA6656E6F6B04E612DF
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 d4ea5790d0c1f256dc344ab793009c14f72244452b2cf11dbbd2d9ae5897ea8a
MD5 c3d9d1adbdc2a5078b77baff34487a61
SHA1 548b81fa1d0e0e261be020b5b594dfa95bfdde17
SHA512 4c05eb1beda17186067a5c65146580dc0092378804e2fc4e73d534ac3b3139b9158fec4b439d1b1ff2773331b0396f5b16acdddbad15e84c17c0e228d374626a
SSDEEP 192:A115qWLlhuUIxDPK2cMHJb+XUhitovgEuz:65qWLlMFyVMHAE/4
TLSH
T16AF1D8857F83C877F824F0F65821271EB76991A2B704C707257B905C5D2BAB58C248CF
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 3ffb2e25005e94cb0433f863d9c587faef59b709a667d061c400815f3a0a1b01
MD5 61448eee43f130efda498b1cea838f32
SHA1 155adce3f2128ea796cb55dbda1e6cc61e13fc17
SHA512 c7ec0ffb027751a768081320ebed8f002f8a9d5b2baa7961d97ee965b80e15809b8693cb7cd4f0c2fbdf04ba9c81fc40a13b884f19783a06ff0cb54c552c95de
SSDEEP 3072:nFfwH2C0aOO/2A1w17roxPZTerUScdQQV+yXIvdXzbSsTxw:nJC0aOO/2AiroSj8Syzse
TLSH
T1E80407C037A7E93BF19AA5759965334F7B8480F27222C7076AF79024FD56520ACD20EE
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer

source_prepared.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

source_prepared.pyc