PyInit__sqlite3
Static task
static1
Behavioral task
behavioral1
Sample
f4f8f96f7ad74fbd959961cae7929f4dc8a61c5a255d67e36a656b29e14ef0b7.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f4f8f96f7ad74fbd959961cae7929f4dc8a61c5a255d67e36a656b29e14ef0b7.dll
Resource
win10v2004-20230703-en
General
-
Target
f4f8f96f7ad74fbd959961cae7929f4dc8a61c5a255d67e36a656b29e14ef0b7
-
Size
77KB
-
MD5
91282a645471c0eb3e519717d7ceb8ca
-
SHA1
fba946ddb783a06dcf2d2012e199709b94ce36d6
-
SHA256
f4f8f96f7ad74fbd959961cae7929f4dc8a61c5a255d67e36a656b29e14ef0b7
-
SHA512
f789906001d6d7c99de6d5384d8eed62a177e22679e41b2810755b6f7421af0dfd73f3287f3d86273bb50d09782be0bb488574c51ed24182c0e3ea0edfa156f0
-
SSDEEP
1536:trAbDpaB0pb6bRLvZDkI9XpxUQyIVD6KIPCBstD5tWuvzFM8BI0I6IPOQwE8:tMb9aq9+9ttpxWIVWPCBqD5tWuvxM8Zn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4f8f96f7ad74fbd959961cae7929f4dc8a61c5a255d67e36a656b29e14ef0b7
Files
-
f4f8f96f7ad74fbd959961cae7929f4dc8a61c5a255d67e36a656b29e14ef0b7.dll windows x86
ce783347237bc9b4e04e310657940d93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
python311
PyType_IsSubtype
PyErr_Restore
PyExc_OverflowError
_Py_Dealloc
PyModule_GetDict
PyErr_ExceptionMatches
PyObject_CheckBuffer
_PyArg_ParseTuple_SizeT
PyErr_Fetch
PyObject_Vectorcall
PyObject_GetBuffer
PySys_Audit
PyList_New
PyErr_Clear
PyList_Append
PyUnicode_FSConverter
PyList_GetItem
PyUnicode_Type
PyObject_VectorcallMethod
PyMem_Free
PyLong_AsLongAndOverflow
PyErr_NoMemory
PyObject_CallObject
PyObject_GC_Track
PyBytes_FromStringAndSize
PyGILState_Ensure
PyThread_get_thread_ident
PyType_GetModuleByDef
PyExc_TypeError
PyType_FromModuleAndSpec
PyObject_IsTrue
_PyUnicode_Ready
PyCallable_Check
PyMem_Malloc
_PyLong_AsInt
PyObject_CallMethodObjArgs
_Py_TrueStruct
PyModule_GetState
_PyObject_GC_New
PyUnicode_FromString
PyBuffer_Release
PyObject_CallNoArgs
PyEval_RestoreThread
PyUnicode_FromStringAndSize
PySequence_Size
PyOS_snprintf
PyErr_SetObject
PySequence_GetItem
PyObject_SelfIter
PyIter_Next
_Py_NoneStruct
PyDict_Type
PyTuple_Type
PyLong_Type
PyExc_UnicodeDecodeError
_PyErr_FormatFromCause
PyObject_ClearWeakRefs
_Py_FalseStruct
PyUnicode_Decode
PySequence_Check
PyByteArray_FromStringAndSize
PyList_Type
PyObject_GetItem
PyTuple_Pack
PyExc_LookupError
PyErr_Print
PyByteArray_Type
PyIter_Check
Py_BuildValue
_PyObject_LookupAttr
PyModule_AddObjectRef
PyDict_SetItem
PyDict_New
PyExc_Exception
PyModule_AddIntConstant
PyModule_AddType
PyModule_AddStringConstant
PyObject_GetAttrString
PyErr_NewException
PyModuleDef_Init
PyExc_ImportError
PyUnicode_CompareWithASCIIString
PyBool_FromLong
PySlice_Type
PyObject_Hash
PyObject_RichCompare
PyTuple_GetItem
_Py_ctype_tolower
PyObject_RichCompareBool
PyTuple_Size
_Py_NotImplementedStruct
PyNumber_AsSsize_t
PyExc_IndexError
PyObject_SetAttrString
PyLong_AsLongLongAndOverflow
PySlice_AdjustIndices
PySlice_Unpack
PyLong_FromUnsignedLong
PyLong_AsLong
PyIndex_Check
PyGILState_Release
PyFloat_AsDouble
PyObject_GetAttr
PyDict_GetItemWithError
PyExc_MemoryError
PyBuffer_IsContiguous
PyObject_GC_UnTrack
PyLong_FromLong
_PyErr_ChainExceptions
PyEval_SaveThread
PyUnicode_AsUTF8AndSize
PyErr_Occurred
PyImport_ImportModule
_PyArg_CheckPositional
_PyArg_NoKeywords
PyFloat_Type
PyExc_ValueError
PyErr_Format
_PyArg_UnpackKeywords
PyErr_WriteUnraisable
PyErr_SetString
PyList_Size
_PyArg_BadArgument
PyExc_AttributeError
PyWeakref_GetObject
PyBuffer_FillInfo
PyFloat_FromDouble
PyLong_FromLongLong
PyType_GetModule
PyBytes_Type
PyTuple_New
_PyObject_CallFunction_SizeT
_Py_BuildValue_SizeT
PyObject_CallOneArg
PyWeakref_NewRef
PyObject_GetIter
PyUnicode_InternFromString
sqlite3
sqlite3_errcode
sqlite3_result_blob
sqlite3_value_bytes
sqlite3_enable_load_extension
sqlite3_backup_pagecount
sqlite3_blob_open
sqlite3_step
sqlite3_create_window_function
sqlite3_serialize
sqlite3_value_blob
sqlite3_backup_step
sqlite3_malloc64
sqlite3_value_double
sqlite3_trace_v2
sqlite3_result_error_toobig
sqlite3_libversion_number
sqlite3_bind_double
sqlite3_column_text
sqlite3_last_insert_rowid
sqlite3_changes
sqlite3_bind_blob
sqlite3_column_count
sqlite3_column_type
sqlite3_bind_text
sqlite3_progress_handler
sqlite3_column_decltype
sqlite3_data_count
sqlite3_exec
sqlite3_column_int64
sqlite3_bind_null
sqlite3_column_bytes
sqlite3_column_name
sqlite3_column_blob
sqlite3_bind_parameter_count
sqlite3_column_double
sqlite3_bind_int64
sqlite3_reset
sqlite3_bind_parameter_name
sqlite3_shutdown
sqlite3_enable_shared_cache
sqlite3_initialize
sqlite3_complete
sqlite3_libversion
sqlite3_threadsafe
sqlite3_extended_errcode
sqlite3_errmsg
sqlite3_blob_close
sqlite3_blob_write
sqlite3_blob_read
sqlite3_blob_bytes
sqlite3_stmt_readonly
sqlite3_close_v2
sqlite3_create_collation_v2
sqlite3_get_autocommit
sqlite3_errstr
sqlite3_limit
sqlite3_expanded_sql
sqlite3_result_error_nomem
sqlite3_value_int64
sqlite3_value_type
sqlite3_result_text
sqlite3_sleep
sqlite3_context_db_handle
sqlite3_result_null
sqlite3_close
sqlite3_prepare_v2
sqlite3_stricmp
sqlite3_backup_finish
sqlite3_open_v2
sqlite3_value_text
sqlite3_db_handle
sqlite3_result_double
sqlite3_result_int64
sqlite3_busy_timeout
sqlite3_user_data
sqlite3_total_changes
sqlite3_finalize
sqlite3_result_error
sqlite3_free
sqlite3_backup_init
sqlite3_interrupt
sqlite3_deserialize
sqlite3_backup_remaining
sqlite3_create_function_v2
sqlite3_set_authorizer
sqlite3_aggregate_context
sqlite3_load_extension
vcruntime140
memset
memcpy
_except_handler4_common
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm
api-ms-win-crt-string-l1-1-0
_strnicmp
kernel32
QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
DisableThreadLibraryCalls
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ