03152e3472ea98f322a743c46bf02313f31d8c8e435bfedbbd76331c4ba1bf89

Sharing

Copy URL Twitter E-mail

General

Target

03152e3472ea98f322a743c46bf02313f31d8c8e435bfedbbd76331c4ba1bf89
Size

127KB
MD5

979adf01694746ee7626982629663d24
SHA1

2dddffa01a796debb63953e0f4ed92fa838124dc
SHA256

03152e3472ea98f322a743c46bf02313f31d8c8e435bfedbbd76331c4ba1bf89
SHA512

da250a49ad9759834162fd2b99a0b9f653e8cf8fcc4c2648e86e6f8bfd14600362675023ede53373baa24b26a05c4500d67b2f32086aa84697586dcc059d8d2b
SSDEEP

3072:m5KT+H42JTs6RltejUhg33Ocv7UqTQIHIPC77Ky+E:YKT+H4k7teeg33/DUqNhX+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03152e3472ea98f322a743c46bf02313f31d8c8e435bfedbbd76331c4ba1bf89

Files

03152e3472ea98f322a743c46bf02313f31d8c8e435bfedbbd76331c4ba1bf89
.dll windows x86

59e4d69d54b5863f9eb48a18690b9d6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select
WSAGetLastError

crypt32

CertFreeCRLContext
CertOpenStore
CertCloseStore
CertAddStoreToCollection
CertEnumCRLsInStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore

libcrypto-1_1

OpenSSL_version_num
BIO_up_ref
ASN1_OBJECT_free
ERR_peek_last_error
X509_get_subject_name
X509_check_ca
BIO_set_flags
OPENSSL_sk_num
X509_VERIFY_PARAM_set_hostflags
X509_STORE_add_cert
X509_get0_notAfter
DH_free
ERR_get_error
BIO_read
BIO_printf
X509_get_default_cert_file_env
X509_VERIFY_PARAM_set1_ip
OBJ_obj2nid
X509_get_default_cert_dir_env
X509_get_issuer_name
RAND_bytes
X509_NAME_ENTRY_get_data
X509_get0_notBefore
PEM_write_bio_X509_AUX
ASN1_STRING_to_UTF8
ERR_reason_error_string
PEM_write_bio_X509
BIO_ctrl
X509_VERIFY_PARAM_set_flags
i2d_X509
BIO_new
OBJ_nid2sn
i2a_ASN1_INTEGER
OBJ_txt2obj
GENERAL_NAME_free
X509_NAME_get_entry
X509_get_default_cert_dir
X509_get_default_cert_file
RAND_add
OBJ_nid2ln
ERR_clear_error
X509_free
a2i_IPADDRESS
GENERAL_NAME_print
BIO_clear_flags
i2d_X509_bio
X509_VERIFY_PARAM_set1_host
PEM_read_bio_X509
OBJ_obj2txt
COMP_get_type
BIO_s_mem
BIO_free_all
BIO_s_file
BIO_ctrl_pending
CRYPTO_free
EC_KEY_free
X509_get_version
OPENSSL_sk_value
X509_verify_cert_error_string
X509_OBJECT_get0_X509
AUTHORITY_INFO_ACCESS_free
X509_NAME_ENTRY_set
OPENSSL_sk_find
i2t_ASN1_OBJECT
BIO_new_fp
BIO_write
BIO_free
ASN1_STRING_get0_data
CRL_DIST_POINTS_free
X509_NAME_ENTRY_get_object
BIO_puts
BIO_gets
X509_up_ref
OPENSSL_sk_pop_free
OBJ_nid2obj
X509_NAME_print_ex
X509_VERIFY_PARAM_clear_flags
RAND_status
BIO_new_mem_buf
PEM_read_DHparams
ASN1_STRING_length
X509_get_serialNumber
X509_get_ext_d2i
X509_OBJECT_get_type
ASN1_OCTET_STRING_free
X509_cmp
X509_STORE_get0_objects
X509_VERIFY_PARAM_get_flags
EC_KEY_new_by_curve_name
ASN1_TIME_print
OBJ_sn2nid
X509_NAME_entry_count
ASN1_STRING_type
OpenSSL_version
d2i_X509_bio
X509_subject_name_hash

libssl-1_1

SSL_CTX_get_security_level
SSL_CIPHER_get_bits
TLSv1_1_method
SSL_get_peer_cert_chain
SSL_CTX_set_verify
SSL_CTX_get0_param
SSL_get_ciphers
d2i_SSL_SESSION
SSL_CIPHER_get_auth_nid
SSL_pending
SSL_CIPHER_get_kx_nid
SSL_SESSION_get_time
SSL_set_verify
SSL_CIPHER_get_version
SSL_CTX_get_verify_mode
SSL_CTX_set_cipher_list
SSL_set_post_handshake_auth
SSL_set_accept_state
SSL_CTX_load_verify_locations
SSL_CTX_set_num_tickets
SSL_CTX_use_certificate_chain_file
SSL_CIPHER_get_name
SSL_get_peer_finished
SSL_get0_param
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_set_SSL_CTX
SSL_session_reused
SSL_shutdown
SSL_read_ex
SSL_get_current_cipher
SSL_get_verify_mode
SSL_CTX_get_verify_callback
SSL_CTX_set_session_id_context
SSL_CTX_set_msg_callback
SSL_SESSION_get_ticket_lifetime_hint
TLS_server_method
SSL_CTX_set_keylog_callback
SSL_get_error
SSL_CTX_get_num_tickets
SSL_set_connect_state
SSL_get1_session
SSL_SESSION_has_ticket
SSL_SESSION_get_timeout
SSL_ctrl
SSL_CTX_set_default_passwd_cb_userdata
TLSv1_2_method
SSL_CIPHER_get_cipher_nid
SSL_CTX_callback_ctrl
TLS_client_method
SSL_is_init_finished
SSL_get_verify_result
SSL_CTX_get_options
SSL_CTX_set_post_handshake_auth
SSL_CIPHER_description
SSL_set_read_ahead
SSL_select_next_proto
SSL_CTX_new
SSL_set_fd
SSL_CTX_use_PrivateKey_file
SSL_get_verify_callback
SSL_CIPHER_get_digest_nid
SSL_get_finished
SSL_set_ex_data
SSL_get_ex_data
SSL_get0_verified_chain
SSL_get0_alpn_selected
SSL_CTX_clear_options
SSL_get_version
SSL_CTX_ctrl
SSL_CTX_free
SSL_new
SSL_CTX_set_alpn_protos
SSL_CTX_set_default_verify_paths
SSL_CTX_set_alpn_select_cb
SSL_get_peer_certificate
SSL_CTX_set_options
SSL_set_session
SSL_SESSION_free
SSL_CTX_get_cert_store
SSL_get_session
SSL_free
SSL_get_current_compression
TLS_method
SSL_verify_client_post_handshake
SSL_CTX_set_default_passwd_cb
TLSv1_method
SSL_get_servername
SSL_SESSION_get_id
SSL_CIPHER_is_aead
SSL_CTX_get_default_passwd_cb
SSL_get_wbio
SSL_CIPHER_get_id
i2d_SSL_SESSION
SSL_get_shutdown
SSL_get_client_ciphers
SSL_get_rbio
SSL_set_msg_callback
SSL_do_handshake
SSL_get_SSL_CTX
SSL_set_bio
SSL_write_ex

kernel32

UnhandledExceptionFilter
GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetLastError
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter

python311

_Py_FalseStruct
PyFloat_Type
PyErr_SetFromErrno
PyType_IsSubtype
_Py_Dealloc
PyErr_ExceptionMatches
PyThread_release_lock
PyModule_AddObjectRef
PyModule_AddObject
PyObject_CheckBuffer
_PyArg_ParseTuple_SizeT
PyObject_GC_Del
PyErr_Fetch
PyObject_CallFunctionObjArgs
PyLong_AsLong
_PyBytes_Resize
PyUnicode_FromFormat
PyObject_GetBuffer
PyErr_BadArgument
PySet_New
PyList_New
PyType_FromSpecWithBases
PyList_Append
PyUnicode_Decode
PyUnicode_FSConverter
PyType_GetModuleState
PyDict_SetItem
PyDict_New
PyErr_NewExceptionWithDoc
PyMem_Free
PyFrozenSet_New
PyCapsule_Import
PyErr_NoMemory
PyErr_SetFromErrnoWithFilenameObject
PyExc_OSError
PyObject_CallObject
PyErr_CheckSignals
PyModuleDef_Init
PyObject_GC_Track
PyBytes_FromStringAndSize
_Py_NotImplementedStruct
PyGILState_Ensure
PyType_GetModuleByDef
PyUnicode_FromEncodedObject
_PyDeadline_Get
PyExc_TypeError
PyType_FromModuleAndSpec
PyObject_IsTrue
PyObject_Str
PyUnicode_AsUTF8String
PyTuple_Pack
_PyByteArray_empty_string
PyCallable_Check
PyMem_Malloc
PyList_AsTuple
_PyTime_AsTimeval_clamp
PyExc_UnicodeEncodeError
_PyLong_AsInt
_Py_TrueStruct
PyModule_GetState
_PyObject_GC_New
PyList_SetItem
_Py_fopen_obj
PyUnicode_FromString
PyLong_FromSize_t
_PyDeadline_Init
PyBuffer_Release
PyObject_CallNoArgs
PyByteArray_Type
PyEval_RestoreThread
PyUnicode_FromStringAndSize
PyModule_AddStringConstant
PyModule_AddType
PyErr_Format
PyLong_FromUnsignedLong
PyExc_ValueError
_PyArg_UnpackKeywords
PyErr_WarnFormat
PyUnicode_AsASCIIString
PyErr_WriteUnraisable
PyErr_SetString
PyList_Size
_PyArg_BadArgument
PyExc_AttributeError
PySet_Add
PyWeakref_GetObject
PyBuffer_FillInfo
PyExc_TimeoutError
PyThread_acquire_lock
PyDict_SetItemString
PyType_GetModule
_PyArg_NoPositional
PyTuple_New
_Py_NoneStruct
PyGILState_Release
PyBytes_FromString
PyFloat_AsDouble
PyThread_allocate_lock
PyErr_SetFromWindowsErr
PyDict_GetItemWithError
PyExc_MemoryError
PyBuffer_IsContiguous
PyObject_GC_UnTrack
PyLong_FromLong
PyExc_RuntimeError
_PyErr_ChainExceptions
PyEval_SaveThread
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyErr_Occurred
PyBytes_AsString
_PyErr_BadInternalCall
PyExc_DeprecationWarning
_PyArg_CheckPositional
_PyArg_NoKeywords
PyExc_RuntimeWarning
PyErr_WarnEx
PyModule_AddIntConstant
_PyObject_CallFunction_SizeT
PyList_Insert
_Py_BuildValue_SizeT
PyUnicode_DecodeFSDefault
PyBool_FromLong
PyWeakref_NewRef
PyUnicode_InternFromString
PyObject_SetAttr
PySequence_List
_PyArg_Parse_SizeT
PyErr_SetObject

vcruntime140

_except_handler4_common
memset
memcpy
__std_type_info_destroy_list
strchr

api-ms-win-crt-stdio-l1-1-0

fread
feof
_lseek
fwrite
_fileno
_open
fgets
_write
_close
_setmode
__stdio_common_vfprintf
fseek
_read
clearerr
fflush
__acrt_iob_func
fopen
ferror
ftell
__stdio_common_vsprintf
fclose

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_errno

Exports

Exports

OPENSSL_Applink
PyInit__ssl

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59e4d69d54b5863f9eb48a18690b9d6f

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

libcrypto-1_1

libssl-1_1

kernel32

python311

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 55KB - Virtual size: 54KB

.data Size: 18KB - Virtual size: 18KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 55KB - Virtual size: 54KB

.data
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB