MMacro[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MMacro.exe
Size 107.6MB
Sample261030-asy2csf13w
SHA256 d9fb22eac3def5e1bd0eed7c84433699dcf8a7d1a539f5647476d34c8f495a4e
MD5 e26139c96ef5570269feb7183b63cbfe
SHA1 6d02516b902a7eabc262eda56c2806103324ff4a
SHA512 80be8122715d97f2c1a686672ea8f193a9534b0c79c7ef777f8dcd2ad64f4fafe764a3a044ff6144a722b9727bc91e893c4bdf630f4338d199c6fdfe50228a24
SSDEEP 3145728:6JdtL3L7lx8xUcji6DDQiraLDJ1H0GDm:kdtTKUcHHQyOjbD
TLSH
T13F3833B27B857C42F1AED33549456A2C35DAA80D0E66116A8BF00E713C360EDFB759F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MMacro.exe

File Explorer

MMacro.exe

.exe 107.6MB
app.pyc

196KB

MMacro.exe

IMPHASH e4237bea846d8102cf6b6254bce70a1c
SHA256 d9fb22eac3def5e1bd0eed7c84433699dcf8a7d1a539f5647476d34c8f495a4e
MD5 e26139c96ef5570269feb7183b63cbfe
SHA1 6d02516b902a7eabc262eda56c2806103324ff4a
SHA512 80be8122715d97f2c1a686672ea8f193a9534b0c79c7ef777f8dcd2ad64f4fafe764a3a044ff6144a722b9727bc91e893c4bdf630f4338d199c6fdfe50228a24
SSDEEP 3145728:6JdtL3L7lx8xUcji6DDQiraLDJ1H0GDm:kdtTKUcHHQyOjbD
TLSH
T13F3833B27B857C42F1AED33549456A2C35DAA80D0E66116A8BF00E713C360EDFB759F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken

comctl32

LoadIconMetric

gdi32

CreateFontIndirectW DeleteObject SelectObject

kernel32

AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateProcessW CreateSymbolicLinkW DeleteCriticalSection DeleteFileW EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetCommandLineW GetCurrentProcess GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFinalPathNameByHandleW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx K32EnumProcessModules K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW LocalFree MulDiv MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RemoveDirectoryW SetConsoleCtrlHandler SetDllDirectoryW SetErrorMode SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbstowcs strtol strtoul

api-ms-win-crt-environment-l1-1-0

__p__wenviron _wputenv_s

api-ms-win-crt-filesystem-l1-1-0

_wfullpath _wstat64i32

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy strchr wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _errno _exit _getpid _set_app_type _initialize_wide_environment _initterm _initterm_e _set_invalid_parameter_handler _wcserror abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf _fileno _get_osfhandle _wfopen _wtempnam clearerr fclose feof ferror fflush fread fseek fwrite ftell setbuf

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsdup _wcsdup _wcsnicmp iswctype memset strcmp strcpy strlen strncat strncmp wcscat wcscmp wcslen wcsncmp

user32

CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EndDialog GetClientRect GetDC GetDialogBaseUnits GetMessageW GetWindowLongPtrW InvalidateRect MessageBoxA MessageBoxW MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassW ReleaseDC SendMessageW SetWindowLongPtrW ShowWindow ShutdownBlockReasonCreate SystemParametersInfoW TranslateMessage

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MMacro.exe

advapi32

comctl32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic

app.pyc