mrmansdownloader.zip
- SHA256 1b2ce0c0f8f72f14c954f55ad30cfc0f315e9326b21469a5bbf11b5121ef3b02
Behavioral task
behavioral1
Sample
mr mans downloader.exe
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target mrmansdownloader.zip
- Size 11.8MB
- Sample261002-ff8mxswcrd
- SHA256 1b2ce0c0f8f72f14c954f55ad30cfc0f315e9326b21469a5bbf11b5121ef3b02
- MD5 631ab2e33efdd88ec12781a117c4bb31
- SHA1 bc7377220b4fb1431c91a2da4fa80cc74a3128ed
- SHA512 6c8dac40ff8b761b11e1a2c6c24c31974eb39ba8a3ecc29f698eaed2a1dc7751eb1508e8bc61167518c189bbffe418095a863e19832dc614b8dcf13b1d73c139
- SSDEEP 196608:ExYKhjUVTcIsJPIehWoNJSjpPRiZ14f+Bb3q5qQ2U6GUSXKyW0bs0yuJohn9Tk+d:rWwcB5IehWfjpP4Z1G+1m2Qba0s0+F99
- TLSH T19AC6336C9609AF225CED8A0EFE60B52122B1A1CA3BD5F23B1D710B0457B7856CFF48D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/mr mans downloader.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mr mans downloader.exe
File Explorer
-
mrmansdownloader.zip.zip 11.8MB
-
HOW_TO_USE.txt15KB
-
mr mans downloader.exe.exe 12.0MB
-
ytdlp_gui.pyc195KB
HOW_TO_USE.txt
- SHA256 7b07f382e3b7cc21f60349d5875383a2b9883b41317badc5c137dbb4e3ca12aa
- MD5 3cd6b96dc5b5509eee56cbf05982e8d7
- SHA1 042d33c6d8b398f9e12aedc7a0bee024eabf2dca
- SHA512 80836202c6664ac832a6c1aabb0868ba67d10079369f39fb498b9083465d21e43b0ca848b4e53ea8b8b86c703db7b4cb96628d7b80075681095ecc8ec96f4f9c
- SSDEEP 192:ckLWGGEcQR9BPf9AYrmWwI3DSiM0/u1ELrJjmtNtCtlE0kyzmQ6rUWPxaV:cEpt91fYWwmS6WeLrJjmtNGlKySpaV
- TLSH T13562D86FBE4943709570E16AA68D6195E32BD07722760938787F801C2B33A7191BE3DF
- MD5 SHA1 SHA512 SSDEEP TLSH
mr mans downloader.exe
- IMPHASH e3e80a143805ea18936c8f612e25d363
- SHA256 cf1eea8c91089098a4544b3b3ce09f42f5ef924bd6cba4ca75266df829b7161c
- MD5 d4de36b2a99ffbc3856d5b216c08dca2
- SHA1 1a442702ff5437804e7c6f16b039936521d9d22a
- SHA512 be71243d25e2bfbdfe0fbf2e6e471f23a13950472f6f398517109428fe219782170df3888015503fe0e2b0f6f2995137c2f6da2eb2bffcddc9f065751eedf6cc
- SSDEEP 393216:PhA1FYO7XEAphVtrQSg+nFoIykzwK7vZgt5:J6CMRphfo+FoIygwcvZg
- TLSH T1ECD633D8B74849A4F8BB413CADD0AA6293F278511BA4D2EB1BF10D150E336D8DF74B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
59248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=189, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
ytdlp_gui.pyc
- SHA256 17e4d45490e3747e3ace8a1c65ef76cfa79a6aeafb3806c01b2fe59d7732c471
- MD5 85fd0dd3c27bf13e0f34fbbf05194f07
- SHA1 b417eaefd18b7102f4950e12ef6434cac5a0e36b
- SHA512 a1ae09508bb87290377f000ff21860372773f103b2cd6d5ea05798891bfbec3f1caae1f56942357996b34c894213b9bd582cc19f76cd594a9b4f51b87c0ba56f
- SSDEEP 3072:DI1lrAj7cOkCtbzEo14cUOSP0TKw1UJUcBXyQKZl4ZU:DehAHunsTKw1CUctCT
- TLSH T1B9144DB898349C2FD5C8793971DAC982F721714DB700DB0BD0364DBDACDA3629AA531E
- MD5 SHA1 SHA512 SSDEEP TLSH