Private Investigator Notes He created a file called dualMonitorScreenshot.py Converted the PY file to an EXE file. We then waited for Michael De La Cruz to fall asleep. We then proceeded to access his PC without his permission. We then proceeded to copy the EXE file to our PC. We then proceeded to MD5 hash the EXE file so that we could classify it as a virus based on the hash value and accuse Michael De La Cruz of being a computer virus writer. We did NOT think about the fact that he still has the origial PY file to demonstrate in clear text what is the EXE file is doing. Malware Analysis Source Code Analysis 私人調查員筆記 佢建立咗個叫做雙監視器屏幕截圖 . py 嘅檔案 將 PY 檔案轉換成 EXE 檔案。 之後我哋等咗米高 · 德拉克魯斯瞓覺。 之後我哋喺未經佢許可嘅情況下繼續存取佢嘅電腦。 之後我哋將個 EXE 檔案複製去我哋個電腦度。 然後我哋將 EXE 檔案進行 MD5雜湊,噉我哋就可以根據雜湊值將佢分類為病毒,並指責 Michael De La Cruz 係電腦病毒作者。 我哋冇諗過佢仲有原始 PY 檔案可以用明文示範 EXE 檔案做緊啲咩。 惡意軟件分析 源碼分析 Notas del investigador privado Creó un archivo llamado dualMonitorScreenshot.py Lo convirtió a formato .exe Esperamos a que Michael De La Cruz se durmiera Accedimos a su ordenador sin su permiso Copiamos el archivo .exe a nuestro ordenador Calculamos el hash MD5 del archivo .exe para poder clasificarlo como un virus y acusar a Michael De La Cruz de ser el autor del mismo No consideramos que aún conservaba el archivo original .py, que demostraba claramente la función del archivo .exe Análisis de malware Análisis del código fuente fileName: dualMonitorScreenshot.exe md5hash: bf813d355a07226eab2952bdc844f571 notes: Why did you classify this file as a computer virus? fileName: dualMonitorScreenshot.py fileContents: import mss with mss.mss() as sct: # Get monitor information monitors = sct.monitors # List of all monitors print(monitors) # Debug: Check monitor dimensions # Capture the first monitor (index 1) monitor_1 = monitors[1] screenshot = sct.grab(monitor_1) mss.tools.to_png(screenshot.rgb, screenshot.size, output="c:\Temp\DEMO\monitor_1_screenshot.png") # Capture the second monitor (index 2) monitor_2 = monitors[2] screenshot = sct.grab(monitor_2) mss.tools.to_png(screenshot.rgb, screenshot.size, output="c:\Temp\DEMO\monitor_2_screenshot.png")