MALICIOUS — 732b8cf362f486b7569eaa85d9e39f71fe1438ba68214300a9b33c204c447264.exe

MALICIOUS — 732b8cf362f486b7569eaa85d9e39f71fe1438ba68214300a9b33c204c447264.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the PyInstaller family. 7 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 732b8cf362f486b7569eaa85d9e39f71fe1438ba68214300a9b33c204c447264
SHA-1: 00b0292f6e85a6e31efb3c223626dbff9d42612b
MD5: 9cca1ed778b5b2450d7010cb1a024535
imphash: 4ba3f97ab4d7908411ad46e497198ac7
ssdeep: 393216:8qbk6dy0JDwNo87jH3w3SFQTsXMCHWUjX1cuI3/PGTAI:8R6E0Dg5bKAXMb8XCH/O7
TLSH: T15A6E3372528F11C1C8E2A558EC55CCFDA033A1192936E58D5D83EC2FA4C8D7B89F0A97
Submitted as: 732b8cf362f486b7569eaa85d9e39f71fe1438ba68214300a9b33c204c447264.exe
File type: pe · Size: 14303156 bytes
Verdict: malicious (99/100) · Family: PyInstaller

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (7 of 53 engines)

capa (capabilities): beacon to command-and-control
MalwareAnalyser heuristics (entropy/packer): PyInstaller
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:PyInstaller
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in tsk_f4500d1ccd (pid 6164) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5347 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3460/files/7353aa61bb67077fe7e4b7ac82d443c4189dfe4586b817d0a3f802d1e318e4f9 - 7353aa61bb67077fe7e4b7ac82d443c4189dfe4586b817d0a3f802d1e318e4f9
/opt/CAPEv2/storage/analyses/3460/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/3460/files/3dbe428c348a0533dbb1cb742c4499137d5979d6923cade20b65df40d7b472f7 - 3dbe428c348a0533dbb1cb742c4499137d5979d6923cade20b65df40d7b472f7
/opt/CAPEv2/storage/analyses/3460/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
/opt/CAPEv2/storage/analyses/3460/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
/opt/CAPEv2/storage/analyses/3460/files/951aac1fd05d47e7a9e95c992c7876caf7562641ab4257dfe2b38f80d7fbe9d9 - 951aac1fd05d47e7a9e95c992c7876caf7562641ab4257dfe2b38f80d7fbe9d9
/opt/CAPEv2/storage/analyses/3460/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
/opt/CAPEv2/storage/analyses/3460/files/60d1ce254f1fade7810bbf0b1e504553c0cb3ef7db083b0475d7d321914d9791 - 60d1ce254f1fade7810bbf0b1e504553c0cb3ef7db083b0475d7d321914d9791
/opt/CAPEv2/storage/analyses/3460/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
/opt/CAPEv2/storage/analyses/3460/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
/opt/CAPEv2/storage/analyses/3460/files/b2aa084acd79322d09f2e63d29d6b8828939c9b514e211ba89cd9b5b267f56df - b2aa084acd79322d09f2e63d29d6b8828939c9b514e211ba89cd9b5b267f56df
/opt/CAPEv2/storage/analyses/3460/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
/opt/CAPEv2/storage/analyses/3460/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
/opt/CAPEv2/storage/analyses/3460/files/a2b284ba9c2bd803135d4de8f3591c05b35f0b54020876dce67b4da824845d56 - a2b284ba9c2bd803135d4de8f3591c05b35f0b54020876dce67b4da824845d56
/opt/CAPEv2/storage/analyses/3460/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

schemas.microsoft.com
6.tw
b.gg
q.za
6.me
i.us
8.ru
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.cloud.microsoft
searchapp.bundleassets.example
www.msftconnecttest.com
outlook.office.com
outlook.office365.com
www.bing.com
tas02.sls.update.microsoft.com
config.edge.skype.com
ctldl.windowsupdate.com
settings-win.data.microsoft.com
to-do.microsoft.com
dns.msftncsi.com
staging.to-do.microsoft.com
edge.microsoft.com
teams.microsoft.com
aps.prod.windows.com

File paths

k:\u
k:\/

More PyInstaller samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report