requirements.zip
- SHA256 872bd27badf2c3dc4783b8dbaf095994b782a083ab8219fcb027bdc421587510
Static task
static1
Behavioral task
behavioral1
Sample
requirements.zip
Resource
win11-20260911-en
windows11-21h2-x64
23 signatures
600 seconds
General
- Target requirements.zip
- Size 26.6MB
- Sample261102-eqyd9ssv6m
- SHA256 872bd27badf2c3dc4783b8dbaf095994b782a083ab8219fcb027bdc421587510
- MD5 1047074d22662b4fc993de4088a26641
- SHA1 73f79848a9493ec9c127dfcd8cf333fcacb33f2f
- SHA512 d90f3b4cf1970063d72524377e110d2e9cb57731db68c4b6872e73c283062039854b7cae5a64164dbeb3afad600fe158a662db510616a72b10685bb85111803a
- SSDEEP 393216:cihU8erVfIVVDxpINdyzfmKdR4OSvQWJhKHQRZqYnwjtrc41oRRW2Gc13pwZIT:csUDrVQVVDHc4z1dRSyQRZfn6NV2PzPB
- TLSH T18D57338AD1059EA959B29CC414B3B7DF5ED29C27922C8830C53DFDE0265BA7F0777A08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
requirements.zip.zip 26.6MB
-
python-3.13.0-amd64.exe.exe 26.9MB
-
requirements.txt10B
-
wiper.py1KB
python-3.13.0-amd64.exe
- IMPHASH f57d7a40ebfca87e6f8082251d937ed8
- SHA256 78156ad0cf0ec4123bfb5333b40f078596ebf15f2d062a10144863680afbdefc
- MD5 f5e5d48ba86586d4bef67bcb3790d339
- SHA1 118838d3bc5d1a13ce71d8d83de52427b1562124
- SHA512 ffaef212d55e3bdd87e79cbfacebc0612ffc1c8c4b495585392746202dce6332383199f0206113ee95ebb4a76d718d0700e1aed9ad518d43b7569a44f0a39427
- SSDEEP 393216:NQs3AMrF2S7Pr96of7sv2iZpAs2vEqhlKBe//u4fW9Xj9uXU//EAa6L4pGROW:NQs31rFn7Pr4Y4vbpCye//zf0TAEVJGq
- TLSH T19C573333E0404976EBF108F27935E3757E68ED291314C879D2E8FC983A798AA17B7251
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ec:6e:fc:58:4f:8b:b1:af:5e:eb:81:3f:c7:03:74:d9:2d:9f:5a:7b:4e:1f:bb:6d:4b:a2:58:ee:f7:13:b8:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
Chains
Oct 7, 2024
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2013 - Jan 15, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
Serial Number
07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 17, 2022 - Jan 15, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
188546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\138\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
InitializeAcl
DecryptFileW
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetCPInfo
GetOEMCP
GetACP
CreateFileW
CloseHandle
GetLastError
HeapSetInformation
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
ExpandEnvironmentStringsW
CreateDirectoryW
GetFullPathNameW
GetTempFileNameW
GetTempPathW
Sleep
GetLocalTime
GetModuleFileNameW
CompareStringW
CreateFileA
SetFilePointer
WriteFile
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetCommandLineA
SetCurrentDirectoryW
GetCurrentDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
MoveFileExW
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetCurrentProcess
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetWindowsDirectoryW
GetNativeSystemInfo
GetCommandLineW
FreeLibrary
GetModuleHandleExW
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitForSingleObject
GetProcessId
OpenProcess
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
LocalFileTimeToFileTime
SetEndOfFile
SetFileTime
ResetEvent
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadLocale
IsValidCodePage
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileSizeEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemInfo
VirtualProtect
VirtualQuery
GetSystemWow64DirectoryW
GetProcessHeap
GetFileType
ExitProcess
GetStdHandle
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
295KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=143, id=261, version=26213,
count=19, id=260, version=26706,
count=19, id=259, version=26706,
count=43, id=261, version=26706,
count=21, id=260, version=26213,
count=2, id=262, version=26213,
count=17, id=257, version=26213,
count=334, id=1, productName=Unmarked objects,
count=75, id=261, version=27045,
count=1, id=255, version=27045,
count=2, id=151,
count=1, id=258, version=27045,
requirements.txt
- SHA256 d1fbe88e7f8319cdc2e12efa0c539c176145a8132993a10e908e20cae43f429a
- MD5 1cbf9ba87c3dc6739e650785e18f1877
- SHA1 498cd5187cb5636d4e13727c287ff1ed95bf0ad1
- SHA512 b45d489a0ded690e35cb6ab012794eae8d17632f4b1c69c1942b0f02d56e75e03c5fb3cb4bd5ac3860e6ff33fd8557a62f17408b369d2331c4be2029ec398055
- MD5 SHA1 SHA512
wiper.py
- SHA256 92b68af01268f3e5f148ec41d6e9a240dbf4ec7d7ef15b6bba55c8f58b46f175
- MD5 4d4a8af9be15c19252ee2f57696df057
- SHA1 6b23a1c1e2b89b9a39deffe6600441bb4fc403a4
- SHA512 67f3052529c5f9ea623a7e650fbe4a3e0c7967b190b345e55ba1dff1a0b7da80d44fe302968675bf4de6f1ac5010109b19c9af393074e5e359ac03a2b623f5bd
- TLSH T1BB3112135CEF5597D1B0D69E3A2E4621E31A12037D59F3027AFDE714AF7883642E2CA8
- MD5 SHA1 SHA512 TLSH