1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8

Sharing

Copy URL Twitter E-mail

General

Target
1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8
Size 11.6MB
Sample261102-v1wanaxy7r
SHA256 1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8
MD5 19aa94ee46df7a188737b4daa5f472df
SHA1 ea378328a2c0717fc30d923324d637075a728d11
SHA512 7998255e6c0f2ac31d799214579c37850ee7967af94e74619bc97f63f1ae87c364fe0e27308301ba23499eff73f82a55a9ec4abd5e981fae84a36ac3064bee06
SSDEEP 196608:miOKdI5TcVAgyc27z2p2vtbYPvbJQlHC6T3OxdAwZTvN8VZlc6FAGK3Wdz:mLKdI5TcVAs27z2UkJQli6T3sBT4ZWa7
TLSH
T191C6333BFB9104A6D8BA1B3634F4C93B992DF0DD172102736FB50975DA99BC02AB0719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8

File Explorer

1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8

.exe 11.6MB
desktop.pyc

27KB

1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8

IMPHASH fa2936ff523bbe01bb11c81e10c9ad2d
SHA256 1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8
MD5 19aa94ee46df7a188737b4daa5f472df
SHA1 ea378328a2c0717fc30d923324d637075a728d11
SHA512 7998255e6c0f2ac31d799214579c37850ee7967af94e74619bc97f63f1ae87c364fe0e27308301ba23499eff73f82a55a9ec4abd5e981fae84a36ac3064bee06
SSDEEP 196608:miOKdI5TcVAgyc27z2p2vtbYPvbJQlHC6T3OxdAwZTvN8VZlc6FAGK3Wdz:mLKdI5TcVAs27z2UkJQli6T3sBT4ZWa7
TLSH
T191C6333BFB9104A6D8BA1B3634F4C93B992DF0DD172102736FB50975DA99BC02AB0719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CreateWindowExW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongW GetWindowLongW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

IsValidCodePage GetStringTypeW GetFileAttributesExW HeapReAlloc FlushFileBuffers GetCurrentDirectoryW GetACP GetOEMCP GetModuleHandleW MulDiv GetLastError SetDllDirectoryW GetModuleFileNameW GetProcAddress GetCommandLineW GetEnvironmentVariableW GetCPInfo ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW CloseHandle GetCurrentProcess LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize WriteConsoleW SetEndOfFile SetEnvironmentVariableW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead DecodePointer RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Sharing

General

Malware Config

Signatures

File Explorer

1fab74a64bb91e8ca628818c4db8b3aeecd9f238c414d39fee5507a7330ecac8

user32

comctl32

kernel32

advapi32

gdi32

generic

desktop.pyc