lasttry[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lasttry.zip
Size 14.0MB
Sample261113-w984jsft4v
SHA256 1876905c8260e5717c2789e99916ef41dde160cfff4b0a02662354168252555a
MD5 3beceb252e1ca6a55f66c073f4182217
SHA1 ead05d26b8395e27a0d7a47230f4c158a4dbd250
SHA512 f513d0d3bcf904d1fd808c01813d80ed2d214bf07c1b976dc28296fe3cf76d303ff2c748e80c471f37b6b2c049e5513d15f2d216b6ae9a1d4465e2b6825c2696
SSDEEP 393216:7VIBCX32thhSro5lrS87ljSvAOKsPjgOizBqEDLxC5uKA0:Gq32tzzlW87hSvAGLrWThC5uF0
TLSH
T13BE633D85CD9E2ED8F84A2D669DC3098DD9C6EFD25214AB3E0A8FAC6905F31504F350B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/thoukeyson/bore.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/thoukeyson/bore.exe
unpack001/thoukeyson/thykey.exe

File Explorer

lasttry.zip

.zip 14.0MB
thoukeyson/bore.exe

.exe 9.9MB
bore.pyc

3KB
thoukeyson/thykey.exe

.exe 14.6MB

lasttry.zip

SHA256 1876905c8260e5717c2789e99916ef41dde160cfff4b0a02662354168252555a
MD5 3beceb252e1ca6a55f66c073f4182217
SHA1 ead05d26b8395e27a0d7a47230f4c158a4dbd250
SHA512 f513d0d3bcf904d1fd808c01813d80ed2d214bf07c1b976dc28296fe3cf76d303ff2c748e80c471f37b6b2c049e5513d15f2d216b6ae9a1d4465e2b6825c2696
SSDEEP 393216:7VIBCX32thhSro5lrS87ljSvAOKsPjgOizBqEDLxC5uKA0:Gq32tzzlW87hSvAGLrWThC5uF0
TLSH
T13BE633D85CD9E2ED8F84A2D669DC3098DD9C6EFD25214AB3E0A8FAC6905F31504F350B
MD5 SHA1 SHA512 SSDEEP TLSH

thoukeyson/bore.exe

IMPHASH e3e80a143805ea18936c8f612e25d363
SHA256 059a3d8231690f10a74adb1e9ef350ec523bbc78c12087d3cefaf069c1e42f35
MD5 945ead1cbd483313e3deb2baa616042d
SHA1 f788deb34162ccc4304bf9af71d983f779d043f0
SHA512 cefaca4ef2476927238489f5e5d0c09ed76d49b6f99130671dfc42a19e1678811ccdbc38d11a477f4c85fc858e471bc9fc1d3a3ca9e93109424c7004b422fffc
SSDEEP 196608:Md0W8/9E6x8OXMCHGLLc54i1wN+VPIcu9KYK39srRqZksfiU3PPTE3MrROv5:MWW81x8OXMCHWUj6cuIOeT3/PTY3
TLSH
T1BEA63388BBC400E8E8576139EDE12A9796E970B603B4C6D74BF44E912D732C4EE79713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

GetTokenInformation OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

61KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

thoukeyson/thykey.exe

IMPHASH f2997636f237562ce14e2a81240a7ee6
SHA256 a6f5cda2302f174e0790d2d31325b0a91596c10d2d9ea94504f0640bfc9053db
MD5 30e0d7006406115e990a50d20d93fa74
SHA1 02f26aabb1c36b6203ca41cb04ab4db38fca39c4
SHA512 a67cb9588a3828eb1a95daea2db70f0d0300e9eab01d9c8dc4f8de6aac28c6b41107e6ae3ee69ad8a48a8519aefe6b1711e05810af7bdb73fb8e9400a82b9672
SSDEEP 196608:vWG3xCICMdU5My34+OcgswKEu4SYdw3x2:v64+fc
TLSH
T158F68CC777275CEEC9A50374CDA723293374F844371E6F332608A6206D676D89E4AA93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateFontW CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat ExtTextOutW GetDIBits GetDeviceCaps GetDeviceGammaRamp GetICMProfileW GetPixelFormat GetTextExtentPoint32A GetTextExtentPoint32W GetTextMetricsW Rectangle SelectObject SetBkMode SetDeviceGammaRamp SetPixelFormat SetTextColor SwapBuffers

imm32

ImmAssociateContext ImmGetCandidateListW ImmGetCompositionStringW ImmGetContext ImmGetIMEFileNameA ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionStringW ImmSetCompositionWindow

kernel32

CancelIo CloseHandle CompareStringA CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateProcessA CreateSemaphoreW CreateThread DeleteCriticalSection DeviceIoControl EnterCriticalSection EnumResourceNamesW ExitProcess FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileSizeEx GetFileTime GetLastError GetLocaleInfoA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetThreadId GetTickCount GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MulDiv MultiByteToWideChar OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetErrorMode SetFilePointer SetFilePointerEx SetLastError SetThreadExecutionState SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _i64toa _initterm _isctype _lock _lseeki64 _ltoa _onexit _stricmp _strlwr _strnicmp _strrev _strupr _ui64toa _ultoa _unlock _wcsicmp _wcsnicmp _wfopen abort acos asin atan atof atoi bsearch calloc exit fclose ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper iswctype isxdigit ldexp localeconv log10 malloc memchr memcmp memcpy memmove memset putc putwc qsort rand realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strrchr strstr strtol strtoul strxfrm system tan tolower toupper towlower towupper ungetc ungetwc vfprintf wcscmp wcscoll wcsftime wcslen wcsncmp wcsstr wcsxfrm _strtoui64 _strtoi64 _write _read _itoa _fileno _fdopen

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

SysFreeString

setupapi

CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

shell32

DragAcceptFiles DragFinish DragQueryFileW SHGetFolderPathW ShellExecuteW

user32

AdjustWindowRectEx AttachThreadInput CallNextHookEx CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CopyImage CreateIconFromResource CreateIconIndirect CreateWindowExA CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EmptyClipboard EndDialog EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW FillRect FlashWindowEx GetAsyncKeyState GetClassInfoExW GetClientRect GetClipCursor GetClipboardData GetClipboardSequenceNumber GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDoubleClickTime GetFocus GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoW GetParent GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetUpdateRect GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IntersectRect InvalidateRect IsClipboardFormatAvailable IsIconic KillTimer LoadCursorW LoadIconW MapVirtualKeyW MessageBoxA MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostMessageW PostThreadMessageW PtInRect RegisterClassExA RegisterClassExW RegisterClassW RegisterDeviceNotificationW RegisterRawInputDevices RegisterWindowMessageA ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassA UnregisterClassW UnregisterDeviceNotification ValidateRect

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

winmm

timeBeginPeriod timeEndPeriod waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetErrorTextW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

359KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/106

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/122

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/138

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lasttry.zip

thoukeyson/bore.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

bore.pyc

thoukeyson/thykey.exe

advapi32

gdi32

imm32

kernel32

msvcrt

ole32

oleaut32

setupapi

shell32

user32

version

winmm

generic