5a09aa8c978c04fff188174d916d01e8

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-Nov-22 21:57:16

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 13250844 bytes of data starting at offset 0x61400.
The overlay data has an entropy of 7.98976 and is possibly compressed or encrypted.
Overlay data amounts for 97.0816% of the executable.
Malicious VirusTotal score: 15/70 (Scanned on 2022-11-24 21:04:28) Symantec: ML.Attribute.HighConfidence
ESET-NOD32: Python/PSW.Agent.ADT
APEX: Malicious
ClamAV: Win.Keylogger.Python-9978779-0
Kaspersky: HEUR:Trojan-PSW.Python.Disco.gen
Avast: Python:Creal-A [Pws]
Zillya: Trojan.Stealer.Win32.29558
McAfee-GW-Edition: BehavesLike.Win64.Generic.tc
Jiangmin: Trojan.PSW.Python.iv
Google: Detected
Acronis: suspicious
Malwarebytes: Spyware.DiscordStealer.Python
Fortinet: Python/Agent.ADT!tr.pws
AVG: Python:Creal-A [Pws]
CrowdStrike: win/malicious_confidence_100% (W)

Hashes

MD5 5a09aa8c978c04fff188174d916d01e8
SHA1 158b893dc24fee2675df204f969efab810a86b46
SHA256 abac78f86c22aa089a0b955d2ad690c0001a8d4f795fad8cfc496bd7d1e50fef
SHA3 9bd9327441be754e1be0b13a734db67a1c6c2200c19b762b10a09c30fbff5c7a
SSDeep 393216:kxWbOnzDdQuslGfrAZYCuPJOSSegn5YjT1:kk4vdQubMJuxIza31
Imports Hash a6cec5b1a631d592d80900ab7e1de8df

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2022-Nov-22 21:57:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x28800
SizeOfInitializedData 0x38800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000AFD0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x76000
SizeOfHeaders 0x400
Checksum 0xd0d331
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 36bb8f4cc4ece8c738afab308279a764
SHA1 428f4161dcb1b2f962446ad3aaff815f1c654c64
SHA256 17a484557b42d0a90b0622771d90f683d0659e646ce73daa08143a3569322edd
SHA3 6ec27aeaa6a0a85050f3ee70c8d36f492b188705312cb6661aa26ebceec5d5fa
VirtualSize 0x28750
VirtualAddress 0x1000
SizeOfRawData 0x28800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48534

.rdata

MD5 3700848526d45613b8c5c111334731dc
SHA1 b9001926cca0e584100151bdaf24bebc3ed21c55
SHA256 5043f696ddb6e2e88429e9e91057f4c01a741e0b6c2f0163030e5584a30724d0
SHA3 604d110d645d86c1176c0c9503233b10ccf94f68c66c9c000e522b0cdb63e3b6
VirtualSize 0x12a9e
VirtualAddress 0x2a000
SizeOfRawData 0x12c00
PointerToRawData 0x28c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.81738

.data

MD5 8d7eef00be6638eb3aee48b098126256
SHA1 1ad268200b2c628cf33664dec351bd3f62b52782
SHA256 3f9076f3adc042db735c95b3956a58fa780559ef12ba16e1c5767cab2a47a33d
SHA3 0b212dc03014a0e315834a1ff98df7e907452e87c49699683ca9c6695ef4ed4c
VirtualSize 0x103e8
VirtualAddress 0x3d000
SizeOfRawData 0xe00
PointerToRawData 0x3b800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.80691

.pdata

MD5 e0d714ef4f97c41640e5ba7f6b6e5975
SHA1 6a11628bb8262fa646af0f27f6ab63ebf41dc576
SHA256 69d89060d10e8399144d179bed744b4fdb087dc69878207876c3955205ee41fa
SHA3 c1c0d34bf6427b8710a83dd0f81dccc5a8fce66d07a342ca02f742d4b4c6214d
VirtualSize 0x20c4
VirtualAddress 0x4e000
SizeOfRawData 0x2200
PointerToRawData 0x3c600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.32844

_RDATA

MD5 08c079c8c67a349f9e14c5a9bed16b01
SHA1 fe35d87965d6c2a8a0a8b3891d7dae40bc65478e
SHA256 6ae70e6184740fb7254f159c805a5c55ab2bfbc5272535a703c6eb47761aac76
SHA3 8d192c4fd206010f15e5241397aa765b527638c6d8d5f62fd1c169482176e854
VirtualSize 0x15c
VirtualAddress 0x51000
SizeOfRawData 0x200
PointerToRawData 0x3e800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.75804

.rsrc

MD5 5c8026059d4f369613114e344654b53b
SHA1 7b78636d27e733e8993c7abf5876b049db86db9a
SHA256 c23922905d00e0ff0a7d29fc59a88b7343fbcdeee28c133b3913aa35b8960a3e
SHA3 1034e4ce16be85747d7bb1e74be30612787c72f2ea0f14f9b9c1e58a291eb6b3
VirtualSize 0x220b8
VirtualAddress 0x52000
SizeOfRawData 0x22200
PointerToRawData 0x3ea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.98747

.reloc

MD5 bc11f54c2d33adf3a95c6af00e70eb22
SHA1 31549301083f61b8fdf8df1671f67eef09df21f7
SHA256 b6bd56503a2b57f483f96722ed1c84a3a2c23184bbe957348883285bfc5ed0bc
SHA3 8088d849e1ec86d2de77521f5de6884ed4ae748e374e81e2661e6532255ef364
VirtualSize 0x758
VirtualAddress 0x75000
SizeOfRawData 0x800
PointerToRawData 0x60c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.23621

Imports

USER32.dll CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetCPInfo
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.61067
MD5 39be4c0e86445a082e2e5bc1391c153b
SHA1 ed432373c1e745fce7807c9ce9586565deca94f5
SHA256 d0a4a6b34cd516138a1d6b1e7e40bd178c7e08f6e8685e04815173a4505287e8
SHA3 43392ee5044b7458648a00153bdfa25c35a8f827d7dd4d408f4523112d38850a

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.55103
MD5 0b8e808f97469187e2ea5e3a2a64031d
SHA1 225fae37d4e083af3d6db7b674b59b79493e3926
SHA256 bd0175187eed56fd9893cf851afe2ed678445dce8b51162daddeff8c54a46fb4
SHA3 f8ead452d9a7674da6621ebfb8e754e7b5555c82e2b05ff2f63d8ca7687e9048

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.89131
MD5 0b6b74364ca0842b905a023ec0139c58
SHA1 a8144d0335bcbbf8bde35132a6cb0479b0cc2015
SHA256 ede5e96a77417fef392630047027a1a9723a794930c8e87330a9a279182eeb8f
SHA3 8669885e8d705d458d236dcbd554b1f7a6b6082059c022509ce49daf6768dff6

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.55859
MD5 c4d75254c46fdc01813870abc8dfeb2a
SHA1 e1aead216b1dd4e4aea215df4488d40be5348dca
SHA256 ed004b87c1fecd64f3c3cd72dcce4c2a4d4e465b207da6ede2fd6d304894d03b
SHA3 5b057528eaed7e7063e1dbe860a541af33a74979f5418b64424152018b6b4b99

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89936
MD5 427771c12c01c96f8a6fca1a0391f404
SHA1 0af4bc4ab4f8db777b24c0af501f2b0cfe0101f5
SHA256 ecca4eec7eed3b66241e05451314190f6ae2a40daff43662ccd356c727102982
SHA3 e3cae5d36219701e331deeae7ec8985ed85b4863f20832d40d0c54ce1c56a6d0

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x93e5
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97128
Detected Filetype PNG graphic file
MD5 a40dcc970c9bbb4441e7bb6a9cee16f6
SHA1 458e19c1213087e1fa678ffefc6e4d1c7f009cd5
SHA256 857592c65ffcaabee40723818e23b51951b5a9df220dfcf345253a733e74a067
SHA3 50624e7dfe08a2833a4eb5b8556673635cb2e23577caf3f9c057a16ed9985a68

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 4060a5c5b090480db59102f75e360a59
SHA1 5b42bb165c183538ef049e6263eb1883df8e618c
SHA256 5a4779ab5587eb919909256ac88802e768b0d91f1ee0148a6a25bf2c0e0b0916
SHA3 658204818720d0e223082fcc534897c9c24a804d0de30953a2346a890d30bb4e

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x591
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29324
MD5 abba0d59487cbe20d8d7fcbb84ccb5f9
SHA1 ded21d9f13429f14921d5758dec99dd5cc62b4c9
SHA256 408f040a543c3c8d6848ad3a679cadd8c9960f4b5cfe47b00706b632545c14f4
SHA3 8f28c447face69b4eb76cc271dd92787e72b3020f0f056c4ddb0d1a4dfd262d2

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-Nov-22 21:57:16
Version 0.0
SizeofData 772
AddressOfRawData 0x39958
PointerToRawData 0x38558

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003d008
GuardCFCheckFunctionPointer 5368882200
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x7e60db40
Unmarked objects 0
ASM objects (30795) 7
C++ objects (30795) 191
C objects (30795) 10
253 (VS2022 Update 3 (17.3.0) compiler 31616) 4
C++ objects (VS2022 Update 3 (17.3.0) compiler 31616) 40
C objects (VS2022 Update 3 (17.3.0) compiler 31616) 17
ASM objects (VS2022 Update 3 (17.3.0) compiler 31616) 9
Imports (30795) 11
Total imports 139
C objects (VS2022 Update 3 (17.3.4-5) compiler 31630) 20
Linker (VS2022 Update 3 (17.3.4-5) compiler 31630) 1

Errors

<-- -->