Static task
static1
Behavioral task
behavioral1
Sample
blast_parser_2019041301.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
blast_parser_2019041301.exe
Resource
win10v2004-20230220-en
General
-
Target
blast_parser_2019041301.exe
-
Size
206KB
-
MD5
50c17b229bc286533da1f4633b2c2526
-
SHA1
8946f1300a0355d554332a3aa714f88cb6a5f494
-
SHA256
223a239777e2e31e7e9f33c70a3b7beece01f59be929ae0c6118e02fa51f9ced
-
SHA512
ed55fb3befc52dad2178a213c66b681bacc519f06ee929f7588d640264ae02ec20a93102f1c90a93640166c957493b9c64ff2382d507fd8a8405d9174909efbc
-
SSDEEP
3072:TWiuu2XN7d2BEuoyvm8RN5oKQxG9oxFjujntlGsTvbs:TqN7oBEwZNmKuG9oPUlho
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource blast_parser_2019041301.exe
Files
-
blast_parser_2019041301.exe.exe windows x86
092021a94ed92aa7ac116b1e8ff53b3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
PathRemoveFileSpecA
python27
Py_Py3kWarningFlag
Py_DebugFlag
PyObject_GC_Del
PyObject_GC_UnTrack
PyObject_Compare
PyErr_SetString
_PyObject_GC_Malloc
PyString_AsString
PyDict_New
PyExc_RuntimeError
PyModule_GetDict
PyObject_ClearWeakRefs
_PyObject_GC_Resize
PyDict_Next
PyArg_ParseTuple
PyObject_GetAttr
PyMethod_Type
PyEval_GetFuncName
PyObject_IsInstance
PyObject_Repr
PyObject_RichCompareBool
PyObject_CallFunctionObjArgs
PyObject_GetAttrString
PyImport_ImportModule
PyCallable_Check
PyArg_UnpackTuple
_PyArg_NoKeywords
PyObject_GenericSetAttr
PyExc_GeneratorExit
PyTraceBack_Type
PyObject_SelfIter
PyInt_FromSsize_t
PyCode_New
PyErr_NoMemory
PyMem_Realloc
PyList_New
PyNumber_AsSsize_t
PyUnicodeUCS2_Concat
PyDict_SetItemString
PyCode_Type
PyEval_EvalCode
PyMapping_Check
PyNumber_ToBase
PyObject_Hash
PyByteArray_FromObject
PyCallIter_Type
PyObject_SetAttr
PyType_Type
PySuper_Type
_PyUnicodeUCS2_AsDefaultEncodedString
PyInt_FromString
PyInt_AsLong
PyLong_FromString
PyExc_ImportError
_PyByteArray_empty_string
PyByteArray_Type
PyFloat_Type
PyExc_OverflowError
_PyObject_New
Py_DivisionWarningFlag
PyObject_Size
PyObject_Str
PyUnicodeUCS2_FromStringAndSize
PyString_InternInPlace
PyFloat_FromDouble
_PyFloat_Unpack8
PyByteArray_FromStringAndSize
PyFrame_Type
PyGen_Type
PyTuple_Type
PyNumber_Add
PyLong_Type
PyInt_Type
PyLong_AsLongAndOverflow
PyErr_Print
PyModule_Type
PyEval_EvalCodeEx
PyEval_EvalFrameEx
PyFrame_New
PyNumber_InPlaceAdd
PyBaseObject_Type
PyErr_Occurred
PyNumber_Check
PySet_New
PyFrozenSet_New
_Py_EllipsisObject
PyComplex_Type
PySlice_Type
PyBool_Type
PyFrozenSet_Type
PySet_Type
PyTuple_GetItem
PyErr_ExceptionMatches
PyErr_SetObject
PyUnicode_Type
PyObject_Realloc
PySequence_InPlaceConcat
PyString_Concat
PyFile_SoftSpace
PyFile_WriteString
_PyUnicodeUCS2_IsWhitespace
_Py_ascii_whitespace
PyString_AsStringAndSize
PyFile_WriteObject
PyClass_IsSubclass
PyString_Size
PyFile_Name
PyFile_Type
PyObject_SetAttrString
PyCFunction_NewEx
PyImport_FrozenModules
PyImport_ExecCodeModuleEx
PyList_SetItem
PyModule_New
PySys_WriteStderr
PyArg_ParseTupleAndKeywords
PyMarshal_ReadObjectFromString
PyImport_ImportFrozenModule
PyList_Append
PyTuple_SetItem
PyList_Insert
Py_UnicodeFlag
Py_TabcheckFlag
Py_InspectFlag
Py_InteractiveFlag
Py_OptimizeFlag
Py_DontWriteBytecodeFlag
Py_NoUserSiteDirectory
Py_IgnoreEnvironmentFlag
Py_VerboseFlag
Py_BytesWarningFlag
Py_FrozenFlag
Py_NoSiteFlag
Py_Initialize
PySys_GetObject
_PyWarnings_Init
PyUnicodeUCS2_FromString
PyImport_GetModuleDict
PyDict_DelItem
PyErr_PrintEx
Py_Exit
PySys_SetArgv
PyObject_GenericGetAttr
PyType_Ready
_PyType_Lookup
PyDict_GetItem
PyExc_AttributeError
PyCFunction_Type
PyFunction_Type
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
PyExc_SystemError
PyCObject_FromVoidPtr
_PyDict_NewPresized
PySys_SetObject
PyStructSequence_InitType
PyStructSequence_New
PyString_FromString
Py_InitModule4
PyString_FromStringAndSize
PyExc_AssertionError
PyExc_UnboundLocalError
PyExc_BaseException
PyExc_NameError
PyString_FromFormat
PyTuple_New
PyInt_FromLong
_Py_Ticker
_Py_CheckInterval
Py_MakePendingCalls
PyEval_ThreadsInitialized
PyEval_SaveThread
PyEval_AcquireThread
PyType_IsSubtype
_Py_NotImplementedStruct
PyNumber_CoerceEx
PyList_Type
PyExc_IndexError
PySequence_GetItem
PySequence_GetSlice
PyExc_ValueError
PySequence_Check
PySeqIter_Type
_PyObject_GC_New
PyObject_GC_Track
PyTuple_Size
PyExc_TypeError
PyErr_Format
PyString_Type
_Py_TrueStruct
_Py_ZeroStruct
PyExc_StopIteration
PyErr_GivenExceptionMatches
PyInstance_Type
PyClass_Type
PyObject_IsSubclass
PyErr_WriteUnraisable
PyErr_NormalizeException
_Py_NoneStruct
PyDict_SetItem
_PyThreadState_Current
PyRange_Type
kernel32
LoadResource
FindResourceA
CreateFileW
CloseHandle
WriteConsoleW
SetStdHandle
FlushFileBuffers
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
LCMapStringW
RtlUnwind
SetEnvironmentVariableA
MultiByteToWideChar
CompareStringW
Sleep
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStdHandle
WriteFile
HeapCreate
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapSetInformation
GetCommandLineA
HeapAlloc
HeapFree
GetLastError
GetShortPathNameW
WideCharToMultiByte
GetModuleFileNameW
LockResource
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ