PyInit__overlapped
Static task
static1
Behavioral task
behavioral1
Sample
be36758c506abe60fe4c94769a2012b2d0b50e77956a3a61852717ee68cd67c3.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
be36758c506abe60fe4c94769a2012b2d0b50e77956a3a61852717ee68cd67c3.dll
Resource
win10v2004-20230703-en
General
-
Target
be36758c506abe60fe4c94769a2012b2d0b50e77956a3a61852717ee68cd67c3
-
Size
30KB
-
MD5
f906d48f0061f14d5bef27b70faa46f5
-
SHA1
0a63c49ad6ebc6129b2458fe37afa39a955f3e17
-
SHA256
be36758c506abe60fe4c94769a2012b2d0b50e77956a3a61852717ee68cd67c3
-
SHA512
2ea5c3d6ad7d5528f48db21451caa5c9f61006fefe738a01ab5a0eed34664a1f86ee105b3f21e80435044ddf84eefbccb180fb0414f2d607838752f829bb9bdb
-
SSDEEP
768:dbfTD50hSd3rm63Z7ncMewobNbWDZ0IGIPXt:BeK3rm2WowbWDZ0IGIPXt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be36758c506abe60fe4c94769a2012b2d0b50e77956a3a61852717ee68cd67c3
Files
-
be36758c506abe60fe4c94769a2012b2d0b50e77956a3a61852717ee68cd67c3.dll windows x86
faa000c37cf7f20f3595ee7d82738ae3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
WSASendTo
WSAConnect
socket
ntohl
WSARecv
WSARecvFrom
inet_ntop
htons
WSAStringToAddressW
WSASend
closesocket
WSAIoctl
ntohs
bind
WSAGetLastError
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
ConnectNamedPipe
CreateIoCompletionPort
ReadFile
SetLastError
WriteFile
RegisterWaitForSingleObject
UnregisterWait
GetQueuedCompletionStatus
CreateFileW
PostQueuedCompletionStatus
CreateEventW
FormatMessageW
GetLastError
SetEvent
CloseHandle
CancelIoEx
ResetEvent
GetOverlappedResult
UnregisterWaitEx
LocalFree
CreateEventA
python311
_Py_TrueStruct
PyModule_GetState
PyMem_RawFree
PyUnicode_FromString
PyErr_SetExcFromWindowsErr
PyBuffer_Release
PyArg_ParseTuple
PyType_FromModuleAndSpec
PyEval_RestoreThread
_PyObject_New
PyTuple_Type
PyModule_AddType
PyErr_Format
PyLong_FromUnsignedLong
PyExc_ValueError
PyErr_WriteUnraisable
PyBytes_FromStringAndSize
PyModuleDef_Init
_PyArg_ParseStack
PyExc_ConnectionRefusedError
PyExc_OSError
PyLong_FromVoidPtr
PyUnicode_FromFormat
_PyBytes_Resize
_PyUnicode_WideCharString_Opt_Converter
PyModule_AddObject
PyObject_Free
_Py_FalseStruct
_Py_Dealloc
_PyArg_ParseTupleAndKeywordsFast
PyErr_SetFromErrno
PyErr_SetString
_PyArg_BadArgument
PyTuple_New
_Py_NoneStruct
PyMem_RawMalloc
Py_BuildValue
_PyUnicode_AsUnicode
PyExc_RuntimeError
PyEval_SaveThread
PyImport_ImportModule
PyExc_ConnectionAbortedError
PyBool_FromLong
PyArg_Parse
vcruntime140
__std_type_info_destroy_list
memset
_except_handler4_common
api-ms-win-crt-string-l1-1-0
iswctype
api-ms-win-crt-runtime-l1-1-0
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
Exports
Exports
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ