pandora's litterbox 1 (1)[.]zip

resource	yara_rule
static1/unpack001/tempest1.0.1.exe	pyinstaller
static1/unpack001/tempest1.0.2.exe	pyinstaller

resource
unpack001/satans_piss.exe
unpack001/tempest.exe
unpack001/tempest1.0.1.exe
unpack001/tempest1.0.2.exe
unpack001/tempest1.0.5.exe

pandora's litterbox 1 (1).zip

SHA256 7799d0eb63c0250b8108e95d087f82b4b117b08d67392b084140d253bb9303d5
MD5 0dda97d3a7b135c7b975d66aaed979f5
SHA1 726b3b6610d301b4f52975ab6e5b6acb3472017b
SHA512 70c3339ab734cebb3615ac1cb899b2181ef3ea4ea9457ab595efe6c852c9d5919da748170c2fb0b096b6ac5b7e6dba388ad6af537d905746e7621685d4ea10d9
SSDEEP 196608:pT9Tu8l28pODhZRdg0YWfk0kX+SuKtTO+OUxdNBHygfp9FTdU45GwFJuatHoSDcw:h9ThcF60EX+StkzUBFRSQJuatH2+H
TLSH
T19F0733E936B2A24CBF99EA17374C22D022C34720596389E99C5D87CC359FABB5DF504C
MD5 SHA1 SHA512 SSDEEP TLSH

READ ME PLS!!!!!.txt

SHA256 6b9c1d7dc3ba26c50cdcfd33c6d3740eb27d8d8f6f0270b81df8f4e7f52f44c3
MD5 aaade2d9f99e6b05a9a4eab22e14f743
SHA1 361fb82fbd0f2469890ec5be10b5296b8f35ca60
SHA512 610b562cf392fe815a4647590d8abf5d406d89a93d1b4c95d0870ad2e1b2d0ba29b92b5722a812d25ac78c7ec9ce8dc301c88f1ffe8926ada124f178bef9e286
MD5 SHA1 SHA512

satans_piss.exe

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 af257a35f5bcc5a7e0e35803641f13cb5996352abce85db89124614f103f0d6a
MD5 00c11ffddd2a648f1667a3e40dc1bf72
SHA1 c5eebfe7b568c7b96d39c1019b66f766dd07b14b
SHA512 6515b857df6187458df9b2dc5bada8ded503e4d1fd1e95c419c64c74bccc962d3069f2c59c483f75f6ede554c1204025240006dfeb61efbe675d63b2ea2b80cf
SSDEEP 1536:77fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfwxBOU:Xq6+ouCpk2mpcWJ0r+QNTBfwX
TLSH
T1C1936C45F3E241F7E9F10A3100A6712FA73A66249724E8DBC34C3D829953AD59A7C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

tempest.exe

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 72820f4e95f4ad650252c5beee9a98fd54f95c6481fe039e5971bbe2d326dfb7
MD5 cdf97987c94264f55655e4f9a0b75382
SHA1 90afcb02d588202044f8cf2b728cc0e2ad55cf0d
SHA512 9737b83ee680b35b48b731f60fdd770a2ae9d5520afd4f9cb20b811d1a73354c8536aebd2ffe09e067bf1ab6bfe8629393272ebca974bb118e518b54dcd6248e
SSDEEP 1536:z7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfdxYRNO8:vq6+ouCpk2mpcWJ0r+QNTBfdGR9
TLSH
T179937C45F3E242F7EAF10A3100A6712FA73566249724E8DBC34C3D829953AD59A3D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

tempest1.0.1.exe

IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
SHA256 76b5d38acb5c4cb14ec0787a0a1187470844da460e83587ff476996038369b97
MD5 39902d6f70e07193c21940175da428be
SHA1 f96f9cf3cfdf64af7bdafbe3740dfec91821de29
SHA512 20c715671f1c4bdf1164fb9e8219d782d9c698a22f655b167ce68e83b1183609fcab50a9ea231438c4c7714f3d06ca79a738906367c3af37bd24d9f5e89a35b9
SSDEEP 196608:qhoGzmtbW897GJr1LDsBTG9Wd6WQGa/R6:uZzm1S3sB1QWQhA
TLSH
T1B086335872B005D9F9A7A13F5A655082A3F3B4224761CADF1B78829D3F0B7B25D3DB08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsFree FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc GetCurrentDirectoryW FlsAlloc FlsGetValue FlsSetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tempest1.0.pyc

SHA256 08a97435ed63c6863687fa60b37290e29bda8b696e2bb8afd67a9351a99aa6ea
MD5 91024ff084dd978ceef9cee1cacbb74e
SHA1 8fec047c1e25b974793b7d2a76631ef52b750b5f
SHA512 83dbbc5d5808768d60fc78c27bbca174e5b13d5ce15cfa8abbb0c4a01af76f7ed2329f340b19ab51ef767946d7ef1e4269bec11d0a7628a9d9680043a3d3e49d
TLSH
T163F02BBCD66D3480D8AC4538A84284CC2781C511F6D1528FFB20909E5D6D00FD610912
MD5 SHA1 SHA512 TLSH

tempest1.0.2.exe

IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
SHA256 a12973b9480b9bafe1d123d9b600a8374931c698bb9a7dac2fb488307b605d88
MD5 dcacc01cf59f9ff1c2ee6cc8948c9f7f
SHA1 87fb3d03cabc228f253445562dafc5e1f6244558
SHA512 3211fcb043f5515f647b2095c6759f91ffa9c191b0c8827b3040255fa5b9a4fb7a2eb680c282515fd0dca4d4993672824076987b64543d35839ce1d5e9c7429a
SSDEEP 196608:MfRJctbW897GIr1LDsBTG9WdkWQrH4Ila/R6n:wM1r3sB1mWQrHgA
TLSH
T13A96331473B401EEF8A7A63FAAA5905153F3B4255771CADF1BA842983F1B2E54C3DB08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsFree FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc GetCurrentDirectoryW FlsAlloc FlsGetValue FlsSetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

tempest1.0.2.pyc

SHA256 8a3481bc983f1dbdc5f4419fb7edbb6552057a27fbfe1dac2bec7c4c2a5b8fee
MD5 06593fe2a29856ecd804a01306bec16f
SHA1 f85102d6ee7e461fca6e3a3a2f9ab3361ee2ccd7
SHA512 27073398f7a81aa18a2a6661e7162f6b8ae8f5c443076e4f7eeb73ce9c2458a732668d4c45ca163a179146e42bdce9cdc3eb374339abaf7b318bc29ccaf09c5c
SSDEEP 48:+AO/jXHC/dCExEG+7SElTUEG1ExyoW3ETCACc9xAwr+QDlmIm5mUPEO6VBLq7qXi:+li/dCU0+El4Eod+PbrnKEUPEO6VBF6t
TLSH
T16EC15078DB6C3682F9CD4974B2C088D17B228356F5D2CA8FF5218DFC4EE8253061590B
MD5 SHA1 SHA512 SSDEEP TLSH

tempest1.0.5.exe

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 8c69853c28cf73096a20bc45443c7523ffcb6b64adb9d77a817fafd484d47f51
MD5 021fd9b920e9f1816595ee3ac72911ca
SHA1 0c7a303f2e22cbf84886f8947b66623a12385fb2
SHA512 daca106c82a808765b21a306d35b80eaa8f33882e124c98fb8c36952793d772615bbb8b618b2e0ed1fcb9ef150a4736f47fd834538859d20444d79842db806c7
SSDEEP 1536:j7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfpx2T2:/q6+ouCpk2mpcWJ0r+QNTBfp5
TLSH
T17D937C45F3D242F7EAF10A7100A6712FA73666249724E8DBC34C3D829953AD59A3C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

Sharing

General

Malware Config

Signatures

File Explorer

pandora's litterbox 1 (1).zip

READ ME PLS!!!!!.txt

satans_piss.exe

msvcrt

kernel32

user32

gdi32

comctl32

shell32

winmm

ole32

shlwapi

generic

tempest.exe

msvcrt

kernel32

user32

gdi32

comctl32

shell32

winmm

ole32

shlwapi

generic

tempest1.0.1.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

tempest1.0.pyc

tempest1.0.2.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

tempest1.0.2.pyc

tempest1.0.5.exe

msvcrt

kernel32

user32

gdi32

comctl32

shell32

winmm

ole32

shlwapi

generic