946112b366fe3d335408c20c80b457ab46b469aba0fa33ed7bba141fad708b4a

Sharing

Copy URL Twitter E-mail

General

Target

946112b366fe3d335408c20c80b457ab46b469aba0fa33ed7bba141fad708b4a
Size

90KB
MD5

90cb432fc6f5d7d063e930858de29df6
SHA1

8f37cee3f80ee220afff776ea757cc836e7fb511
SHA256

946112b366fe3d335408c20c80b457ab46b469aba0fa33ed7bba141fad708b4a
SHA512

c76a3efb20738daeac5ba99a71daf3f77172a755256d569945ac8e0b6a29cb97b0832276f35db05941bab587634389c3fafffa73d8c34b56962308becd09e398
SSDEEP

1536:VBA0X3JnD9qhExw5PZuoqs6GK0s2uufAnX4XKRJQec:0euhYYZuoqs6P0uuYnoXKRJQd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
946112b366fe3d335408c20c80b457ab46b469aba0fa33ed7bba141fad708b4a

Files

946112b366fe3d335408c20c80b457ab46b469aba0fa33ed7bba141fad708b4a
.dll windows x64

ee507bda6826e54e4be7758bbab6fc62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shell32

SHChangeNotify
SHAddToRecentDocs
SHCreateItemFromParsingName
CommandLineToArgvW
SHGetKnownFolderPath
SHGetFolderPathW

wininet

InternetGetConnectedState

advapi32

GetUserNameW

gdi32

CreateCompatibleBitmap
DeleteObject
GetObjectW

rstrtmgr

RmRegisterResources
RmGetList
RmEndSession
RmStartSession

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

python310

PyType_Ready
PyErr_SetExcFromWindowsErrWithFilenameObject
PyBytes_Type
_Py_NoneStruct
PyEval_RestoreThread
PyEval_SaveThread
PyMem_Malloc
PyModule_AddIntConstant
PyModule_AddObject
_Py_Dealloc
Py_DecRef
PyBytes_FromStringAndSize
_PyBytes_Resize
PyExc_RuntimeError
PyUnicode_FromWideChar
PyUnicode_AsWideCharString
PyLong_FromLong
PyLong_FromUnsignedLong
PyLong_AsUnsignedLong
PyLong_FromVoidPtr
PyLong_AsVoidPtr
PyLong_FromLongLong
PyTuple_New
PyList_New
PyList_Append
PyModuleDef_Init
PyErr_SetString
PyErr_Occurred
_Py_BuildValue_SizeT
_PyArg_ParseTuple_SizeT
PyErr_SetExcFromWindowsErrWithFilenameObjects
PyErr_NoMemory
PyErr_SetFromErrno
PyExc_TypeError
PyExc_ValueError
PyExc_FileExistsError
PyMem_Free
PyExc_OverflowError
PyErr_Format
PyErr_SetFromWindowsErr
PyExc_IndexError
PyExc_OSError
_Py_TrueStruct
PyUnicode_FromFormat
_Py_FalseStruct
PyLong_Type

user32

DestroyIcon
CreateIconFromResourceEx
CreateIconIndirect
WaitForInputIdle
GetDC
GetAsyncKeyState

ole32

CoUninitialize
CoTaskMemFree
IIDFromString
CoInitialize
StringFromIID
CoCreateInstance

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsProcessorFeaturePresent
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
OutputDebugStringW
IsDebuggerPresent
GetUserDefaultLocaleName
VerifyVersionInfoW
ReadDirectoryChangesW
CreateHardLinkW
MoveFileExW
GetDllDirectoryW
QueryFullProcessImageNameW
FormatMessageW
SetThreadExecutionState
LocalFree
LocalAlloc
EnumResourceNamesW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
FreeLibrary
FindResourceExW
IsWow64Process
GetComputerNameExW
OpenProcess
CreateProcessW
GetCurrentProcess
GetProcessTimes
CreateMutexW
DeleteCriticalSection
InitializeCriticalSectionEx
WaitNamedPipeW
CreateNamedPipeW
ConnectNamedPipe
GetLastError
SetHandleInformation
GetHandleInformation
InitializeSListHead
GetTempPathW
WriteFile
SetFilePointerEx
SetFileInformationByHandle
SetFileAttributesW
ReadFile
GetVolumeInformationW
GetLongPathNameW
GetFileSizeEx
GetFileInformationByHandle
GetDriveTypeW
GetDiskFreeSpaceExW
DeleteFileW
CreateFileW
CompareFileTime
VerSetConditionMask

shlwapi

AssocQueryStringW

vcruntime140

__std_type_info_destroy_list
__std_exception_copy
__C_specific_handler
_CxxThrowException
__std_exception_destroy
memset
memmove
memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
_seh_filter_dll
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
fclose
_getmaxstdio
_setmaxstdio
__acrt_iob_func
_wfreopen_s

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

api-ms-win-crt-locale-l1-1-0

localeconv

Exports

Exports

PyInit_winutil

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee507bda6826e54e4be7758bbab6fc62

Headers

DLL Characteristics

File Characteristics

Imports

shell32

wininet

advapi32

gdi32

rstrtmgr

msvcp140

python310

user32

ole32

kernel32

shlwapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 476B

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 476B