qkx9dp1.rar
- SHA256 a432007fcb8e27cf5ccf65ff522dc21d10ee8466e05d5417696efebaf05deee5
Password
123
Overview
overview
7Static
static
3id_token_r...op.ini
windows10-2004-x64
1id_token_r...op.ini
windows11-ltsc_2024-x64
1id_token_r...an.exe
windows10-2004-x64
7id_token_r...an.exe
windows11-ltsc_2024-x64
7id_token_p...ed.pyc
windows10-2004-x64
3id_token_p...ed.pyc
windows11-ltsc_2024-x64
3id_token_r...م.txt
windows10-2004-x64
1id_token_r...م.txt
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
id_token_rayan/desktop.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
id_token_rayan/desktop.ini
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
id_token_rayan/id_token_rayan.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
id_token_rayan/id_token_rayan.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
id_token_protected.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
id_token_protected.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
id_token_rayan/مهمممممممم.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
id_token_rayan/مهمممممممم.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target qkx9dp1.rar
- Size 22.0MB
- Sample261030-wfe9dazzhw
- SHA256 a432007fcb8e27cf5ccf65ff522dc21d10ee8466e05d5417696efebaf05deee5
- MD5 921e45a71baa2c1b7edeac9b178426b8
- SHA1 16c119bb34f273127e4ddeadc08a7a78b2e8221e
- SHA512 d68e7d2ff50894a74b4578f5bbb4e80e02a74ee3a8fc20b289ec877f185de225f3f2539724c3bc7c751a87b4a79b4770c131ee2998792b5e2f38bdf3d80d1181
- SSDEEP 393216:HN9BeEELvPAhP211BfWGkSh8AQlyBrM2YUlvLqDDsnsh07S5Ez7WiCA7jWJCYbYY:HzBoLv13fW9SWAQlyIUlqAs2G5KWif7E
- TLSH T1893733508631632D67B240BFF3AAE253491102E2DB77D70F9270ABF554E0229EFE6587
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/id_token_rayan/id_token_rayan.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/id_token_rayan/id_token_rayan.exe
File Explorer
-
qkx9dp1.rar.rar 22.0MB
-
id_token_rayan/desktop.ini142B
-
id_token_rayan/id_token_rayan.exe.exe 22.6MB
-
id_token_protected.pyc10.7MB
-
id_token_rayan/مهمممممممم.txt153B
id_token_rayan/desktop.ini
- SHA256 c80a96b2841236ac1763270aa2d5a7865ad652a68f991981cb9818721be837c3
- MD5 7cfcdf7519c1ed9a3485bc708f5260ea
- SHA1 f4254d4d9dc62f4fcfd1b68391f977c351ea118f
- SHA512 e485a9e5e4351d2f67a4a03b673e5131e21b2e7e491bef1fb77178c92da3ef33e6b484c1c48aa3a851f71bb8e08e0cb5f16f500c2af2089dc1880f33ac5d9975
- TLSH T137C02B07605B80B1F707C00FE10689584A900C774CDFF100C391969360D4906CEDCB1C
- MD5 SHA1 SHA512 TLSH
id_token_rayan/id_token_rayan.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 c84d864fe6c4d276730bc8835bc8cc12eb25d3ced60cceb7dd09d3466d66ab64
- MD5 b2f69a4da4cadbd10d5c6e1326a996d1
- SHA1 070a7ed2ca05eff54fb494a408e183581a4ce018
- SHA512 fd58dedce655c727f02c86f56c0ce87d3452fbbbb087e549b3fea7bcd6c4683a700d38a7700880ded8e94140f09f6d5fffe3da71b7dd3ada1ebb584795ae771a
- SSDEEP 393216:2Vs3SW0chMC2dIxUSUW8oLKqeqH92HOhl0hCML+8ADtAiJLwqFaxCjTh:2Vs3SW08uIxqW8o2ud0OhcCMrgtAitVH
- TLSH T1203733A833504E1ED493933A99E0D332BB613E90A244C28745F1FD53B5BF4F6AE986D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
55856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33140,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35215,
count=1, id=258, version=35215,
id_token_protected.pyc
- SHA256 54b65802dd24fb7c5dac17cb344960bdf6c67a5afeb67d8977348d899d996d7a
- MD5 eaaf8c4c82a8723a4b2f702758b18eca
- SHA1 abf049b35a576512306e1b1ce6c493485637c25a
- SHA512 143c9991fd90386070febb687ab49eea368f4d483018116ada1026e189ffe01bfa96ca50e99042e75444441bf70f2327b905a1f4c453bfa182fe4573d0b054e5
- SSDEEP 49152:YYCrHjXf3XHZjwybgmW7xeN+7qDs5i3VJMgMmtm4oPdwvmNhonAZdNH8z6l8OASq:m
- TLSH T1D3B633115F696E6FCE68433931BF2F1E0BA10F85840EF4D993D968CB219EB81153786B
- MD5 SHA1 SHA512 SSDEEP TLSH
id_token_rayan/مهمممممممم.txt
- SHA256 9c4a44676e291569cfde8448bbc98d77bfdc7b36a399e21e486ba6cd5f41d4b2
- MD5 87739e087f9e56ca791d1841f4134ccc
- SHA1 25cecf275e6e17df078478c137d0faa3fb17344a
- SHA512 d6a4b509cd1141ada5b42a31d76c29a1b1e74c689144fbe7b256857b4b680af8937c4e846126b106a48a7d2a8d1c3361cba3a2393da7ea145719a3815a34dab0
- TLSH T1C9C048A806B7087046434CEA0BD09818F4CE6A32A33DF0101F5DA29F01C88CEB38B121
- MD5 SHA1 SHA512 TLSH