pysilon | x[.]exe | Triage™

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
x.exe

x.exe

IMPHASH e3e80a143805ea18936c8f612e25d363
SHA256 5b643a2efd9f81c8eb05183f92f6ed5d06010cfd0afbf945a1e9dab12b2a3ec0
MD5 ea03ce6d527fcbc5e521854b047ba617
SHA1 3af106304833fd1d4ba278e4f90f7881a0362ca5
SHA512 8ef8c2c8358e16b76d09470970235efcfcbf4e110b45dbcc4d05504c2c165d741836299c525345c1a80ad57c4d27144e14ce292e525f1e38850aef737d9b46ee
SSDEEP 1572864:goHkdLpJanlHxWLYOkiqOv8im2AsyE7WQlKi2iY4MHHLeqPNLtD/ENZ3vg:goUJqrYYOknOv8i3lCQMi1MHVLtTENR
TLSH
T138183349636460C4DCE534B539EAE22945E8E54207708BDFE66413B45FE32F9EE38B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

59248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

GetTokenInformation OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 09df0143ff23cf86caf3671cd1043536e320daed295a8b4fe2e2bc8067a5692a
MD5 6d76bef6c5fb561d59d0308e63d358f2
SHA1 65819f0c4dc70b1a1b823f879579e950e029e3a1
SHA512 380952466fc94c96a7445b24ced0d52de4886a0de835cef2add16ebd1bc5a798307555e0a913b670d717240180570724ea8f0d2c5a8ae21b53f6f62ef5dbf0ce
SSDEEP 192:EpB7osP1MJaugwXaafNqaclHJLOq3ZJFD/b8xjJzdJv:iP1iavwTqacyq35D0Fnv
TLSH
T17A1209E6C489485DFFD8F2BE94877F0C9F35A088808D1793AA0B9552FC8D4847EA15DE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 4cadd678b9c81f0c2419c9991313a3831bebfa45c16bc9cae6a36ff491e4dfea
MD5 38bd52ad107a7b4d65ee2a5ac9e4c04e
SHA1 96d3c53e14dfe9b683a962acaae5acc70d2f8832
SHA512 d6ad3f12af087e43a0b6b0ef749691073865a162dd40b1fefcdcd782e3d4e7f852a7edb90e5d5cf3b78c172466fb67c3f4d5863afd2f0a20ce9fb57108df71ca
SSDEEP 96:SEhUBj1Mvk80VDdybA6HUicwKD7dxWeBJKZLpMglcTK94:lsSl0fQfUpwKfhijMgGW94
TLSH
T14BB10A9999CA693AFED8F2FB4455461C9DD6F387C1C68323770B94685D8A0C4BC3D11C
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 53e072330c37b72982f732eebcab194a6d4fbc2fadd301bfe9e6cd65ae2e67a5
MD5 74b6e99e5e0850b325c74cb8739da834
SHA1 da21f93c746372cc654020e7a131211f25421f37
SHA512 2e047aef6bbb7fd4618cf45c9bf15444ae657d2b2ea28cbda51a8c07a1c8332378bccc120c9fe2005649efc6f2dac783129c7738870795e15056727a986bf63c
TLSH
T10151A7D964886CF4FD79F6FC504A0AA422E07327634C50236648B3A72DDABD45EB2469
MD5 SHA1 SHA512 TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 e34a38e59db85de839eab35d18f53db712b94d43cb782b51ae3b54cf0703a4b0
MD5 9e6f93e7fc3374d2de7c8ccb70f9f489
SHA1 cba17d4adce7e63f9494ec9a46efb40382423b32
SHA512 c713858dc197afc41f82e9ff801ef68e721e0c7e7fc18424d9d7f8b646ffaf4193ee8353f47ca5ebb42a5ed4b61dd5adce419c977b6d26084f0461886ea37ba8
SSDEEP 96:2APDnTWeYwuTgWxiX79GzTOjYUyWkUUNPIslLClDWJpR6Yn:TzCUuxiLATmeEUNP/lL3JpsYn
TLSH
T15D91F9E36901BCA6FE29F7FC56394A1C5D58F352534B88430A04F28E8D597DEAC1848D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 8b8c7310fe81fbab6adbfff7807e7b44987cebcd39b3bd3e227189a0da69fab5
MD5 e117e6fb227019d0826b91c22a4cc9e3
SHA1 97a9f43931498dbcfbe2cdb3f6f658be156e11db
SHA512 d98a93dffdfca39db0ca1fcf1bda1e3bd91fd3f7eda4ad32689b47562f847a3ea412e8f62d49c1fed21c033eac30beb57b7879e66ec7ca1fd9573f36adc1a523
SSDEEP 1536:20wgVgwEs8Bj1uYCFjUpFZCdBLoNFmmnf:Mg29hBkFwpFgLoR
TLSH
T15963F872703D25DAFA63B7B678A10748148273E483917B71980DD2B5FD89FF60BA4389
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer

x.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

source_prepared.pyc