Benign Download

bea71312be331c8cffa99dc028e397b92fb5c8c5702866dced41474bd133c186.exe

Standard PyInstaller Python app

.rdata significantly larger than .textAssembly LOOP target mnemonic

SHA-256bea71312be331c8cffa99dc028e397b92fb5c8c5702866dced41474bd133c186

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₃(AmLi₁₂Mc₂)O₁₃(Al₂As₁₈C₁₀CaCo₃Dy₂Er₈EuI₄La₂PPr₂S₃)H₁₁(Cm₃₉Cr₂₆Db₃₆DsF₂₄Hf₇Mg₇Os₂₆Po₃₂Ti₂U₅)Md₈(Bi₂₃BkIn₃₄₆Pa₅PmPt₂Si₄)Th

Evidence

Largest PE section below ten percent 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400488b05c1f902008908488bc848895008H........H..H.P.
0x410e9bb300000cccccccccccccccccccccc..0.............
0x420488d05a96a0400c3ccccccccccccccccH...j...........
0x43048895c24204c89442418555657415541H.\$ L.D$.UVWAUA
0x440574883ec30488bea498bf8488d15e2e7WH..0H..I..H....
0x4500200488bd941bdffffffffe8303f0000..H..A......0?..
0x4604c8bf84885c07517488d5512488d0dc5L..H..u.H.U.H...
0x470e70200e83823000033f6e9550100008b....8#..3..U....
0x48055044533c048039300100000498bcfe8U.E3.H......I...
0x4909401010085c0792de8df6701004c8d4d......y-..g..L.M
0x4a0124c8d05c8e70200488d0dfde702008b.L......H.......
0x4b010e8ca240000498bcfe8c2fa000033f6...$..I.......3.
0x4c0e90f0100008b4d0c4c89642460e8ee67......M.L.d$`..g
0x4d001004c8be04885c075358b5d0ce89a67..L..H..u5.]...g
0x4e001004c8d4d12895c24204c8d05cfe702..L.M..\$ L.....
0x4f000488d0ddce502008b10e88124000049.H..........$..I
0x5008bcfe879fa0000498bf4e9c000000033...y...I.......3
0x510f6807d100175134d8bcc4533c0488bd5..}..u.M..E3.H..
0x520498bcfe8c8000000eb538b5d0c4c8974I........S.].L.t
0x53024684d8bf485db7438b8002000006690$hM....t8.. ..f.
0x540483bd8488bfb4d8bcf41b80100000048H;.H..M..A.....H
0x5500f47f8498bce488bd7e87efd00004883.G.I..H...~...H.
0x560f801722f4c03f7b800200000482bdf75..r/L.... ..H+.u
0x570cf8bc6488b7c24704c8b74246885c074...H.|$pL.t$h..t
0x58035498bcce827670100498bcfe8eff9005I...'g..I......
0x59000eb3ce8e46601004c8d4d124c8d0515..<..f..L.M.L...
0x5a0e60200488d0d42e602008b10e8cf2300...H..B.......#.
0x5b000418bc5ebbd498bcfe8c2f90000488b.A....I.......H.
0x5c0d7498bcc498bf4e8f43e0000448be84c.I..I....>..D..L
0x5d08b642460488bcee8d4660100488b5c24.d$`H....f..H.\$
0x5e078418bc54883c430415f415d5f5e5dc3xA..H..0A_A]_^].
0x5f0488954241048894c2408535641544155H.T$.H.L$.SVATAU
0x600415641574881ec980000004533e44d8bAVAWH......E3.M.
0x610f04c8bea4c89642460488bf14c896424.L..L.d$`H..L.d$
0x6206841b8580000004c89642470488d15fdhA.X...L.d$pH...
0x630e302004489642438488d4c24304c8964...D.d$8H.L$0L.d
0x6402430498bd9e836b80000448bf885c074$0I...6...D....t
0x6502a498d5512448bc0488d0de1e30200e8*I.U.D..H.......
0x6604c210000b8ffffffff4881c498000000L!.......H......
0x670415f415e415d415c5e5bc34889ac24e0A_A^A]A\^[.H..$.

Convert SID to string representation 0x2efc0–0x2f140

⋯3 more rows
0x2eff050794f626a6563745f43616c6c46756ePyObject_CallFun
0x2f0006374696f6e00000050794f626a656374ction...PyObject
0x2f0105f43616c6c46756e6374696f6e4f626a_CallFunctionObj
0x2f020417267730000000050794f626a656374Args....PyObject
⋯7 more rows
0x2f0a050795374617475735f45786365707469PyStatus_Excepti
0x2f0b06f6e00000000000050795379735f4765on......PySys_Ge
0x2f0c0744f626a6563740050795379735f5365tObject.PySys_Se
⋯8 more rows

PyInstaller script execution error 0x2f948–0x2fa38

⋯3 more rows
0x2f9785f7079695f6d61696e5f636f00000000_pyi_main_co....
0x2f9884661696c656420746f20657865637574Failed to execut
0x2f99865207363726970742027257327206475e script '%s' du
0x2f9a86520746f20756e68616e646c65642065e to unhandled e
0x2f9b87863657074696f6e210a000000000000xception!.......
0x2f9c8303d0440010000005059494e5354414c[email protected]
⋯7 more rows

PyInstaller contents directory option 0x2fcc0–0x2fda0

⋯3 more rows
0x2fcf050795f47494c5f44495341424c454400Py_GIL_DISABLED.
0x2fd007079692d72756e74696d652d746d7064pyi-runtime-tmpd
0x2fd1069720000000000007079692d636f6e74ir......pyi-cont
0x2fd20656e74732d6469726563746f72790000ents-directory..
0x2fd307079692d686964652d636f6e736f6c65pyi-hide-console
⋯7 more rows

PyInstaller embedded PKG archive error 0x2ff90–0x30090

⋯3 more rows
0x2ffc02d0038002e000a000000000000000000-.8.............
0x2ffd0436f756c64206e6f74206c6f61642050Could not load P
0x2ffe079496e7374616c6c6572277320656d62yInstaller's emb
0x2fff0656464656420504b4720617263686976edded PKG archiv
0x30000652066726f6d20746865206578656375e from the execu
0x300107461626c6520282573290a0000000000table (%s)......
0x30020436f756c64206e6f7420736964652d6cCould not side-l
⋯7 more rows