Zapret2GUI-Full.zip
- SHA256 31cb48f05fde134cf4913cb403590b4875bcd9d4532d2a30958a35bf5437c54a
Behavioral task
behavioral1
Sample
Zapret2GUI.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zapret2GUI.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target Zapret2GUI-Full.zip
- Size 18.3MB
- Sample261027-mxkqract4y
- SHA256 31cb48f05fde134cf4913cb403590b4875bcd9d4532d2a30958a35bf5437c54a
- MD5 2f70ba57dee03c1af4f9e49fa10cf25b
- SHA1 e3851325cbdf88bc90923c21226156739d2443f5
- SHA512 e6fe7e666012a8ee7f09b84681e14d1895c870ede5449ed42b9e77b1f81ba54f9368c8218e663e0d214651f6b28d28e99f946199addc5678898b3c6475eb629b
- SSDEEP 393216:dFtE9msH903oBp6qK0+3niqX67xmaQHRe/eG+J7qjnaiKilDp1+ooQc92+9sppxE:t6d903ouv3niVxURe/eG+J7AaiKi9pXM
- TLSH T1C417337DA0D141D3A18F292CD5EBA3B04A746E312799E65AA913E1113C43CFBD339F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Zapret2GUI.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Zapret2GUI.exe
File Explorer
-
Zapret2GUI-Full.zip.zip 18.3MB
-
Zapret2GUI.exe.exe 18.5MB
-
main.pyc9KB
Zapret2GUI.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 6b5d671fe23341924269a17ffa06f1ced15338314935c5bf3191e36533539028
- MD5 ed48051bf1f6407c37ddbb3a49ddc3ef
- SHA1 4b96b230cfe9adab5f1978afadb39116d0192cbb
- SHA512 06384fc03298b86164262914c41a9e6afa3b6dd9cf472194fb344184e7484ce86132019adc1c72aac21ba162615821383233f3f67b592bc6aa56042bb36790ad
- SSDEEP 393216:czTBU7rQHt8vTcO+I/yr76hdZqHt8vTcinGCnGjei2bjRon7Yx4r0B8oENflQWHD:QY8t8vTcOfa7KZqt8vTcinGCnkei2nR7
- TLSH T188173368A0C105E3E5DB1E3C89E7D272CB75BE232761E4CF16A6D0212C079FB9539B85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
main.pyc
- SHA256 c9662eb493ba1989505193da496dca5033a173db2ef0bb005b3c16695a32e09e
- MD5 b85efe9154b26fdcda1eedcde8525370
- SHA1 2b57455ecc5237bdb792deb25b521ea722c4d4cc
- SHA512 173664262cd6bdafccd8263033d07814454efe05a80f93cdc15d1f36cc291bf8b5452ddb3934207f79d2d427ef6aea3ee8ceae79a64c370bf0d45d72f7aab678
- SSDEEP 192:Hmx0hT5XTDteD9wnOKj1YoVmvUKhPVVELIggU4au:y2+5wnCIYhdVIKau
- TLSH T139121B524140188BEF30A6B794996514D76FBAF77928C323200D1AB91CCB26ACEE930D
- MD5 SHA1 SHA512 SSDEEP TLSH