0814ebf9fd7ce7928f945d58a664944a94a39b06c4877be2337b63d38d35b525

Sharing

Copy URL Twitter E-mail

General

Target

0814ebf9fd7ce7928f945d58a664944a94a39b06c4877be2337b63d38d35b525
Size

220KB
MD5

99a6d85d3457ab753416db8b9292638c
SHA1

0ac6f0dc9855c8904f154776614740fea4ee8f04
SHA256

0814ebf9fd7ce7928f945d58a664944a94a39b06c4877be2337b63d38d35b525
SHA512

dde2519710cf481170fc252253e08be74dbbc2394a411cf6e4598b166cc9b435f87131a67b15017dba660126892b2a3588a54a4103b439087263f590207f71fb
SSDEEP

3072:Q3QmtLpE6zm7TuZswvAAYdRduGysM8es3fsdNCfkrYeoKJIG+/+4Eku6MIPQeKa:QtLpEo+TToIDduG8MkB7+/+4Lu6U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0814ebf9fd7ce7928f945d58a664944a94a39b06c4877be2337b63d38d35b525

Files

0814ebf9fd7ce7928f945d58a664944a94a39b06c4877be2337b63d38d35b525
.dll windows x86

4a024aa2f7ee76556a9339bf03125cf9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAGetLastError
select

crypt32

CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertAddStoreToCollection
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCRLsInStore
CertFreeCRLContext

libcrypto-1_1

ASN1_STRING_type
ASN1_STRING_get0_data
ASN1_OCTET_STRING_free
i2a_ASN1_INTEGER
i2t_ASN1_OBJECT
ASN1_STRING_to_UTF8
ASN1_TIME_print
OBJ_nid2obj
OBJ_nid2ln
OBJ_nid2sn
OBJ_obj2nid
OBJ_txt2obj
OBJ_obj2txt
OBJ_sn2nid
EC_KEY_new_by_curve_name
EC_KEY_free
X509_OBJECT_get_type
X509_OBJECT_get0_X509
X509_STORE_get0_objects
X509_STORE_add_cert
X509_VERIFY_PARAM_set_flags
X509_VERIFY_PARAM_clear_flags
X509_VERIFY_PARAM_get_flags
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_set1_ip
X509_verify_cert_error_string
d2i_X509_bio
i2d_X509_bio
X509_get_default_cert_dir
X509_get_default_cert_file
X509_get_default_cert_dir_env
X509_get_default_cert_file_env
X509_free
i2d_X509
X509_get_version
X509_get_serialNumber
X509_get_issuer_name
X509_get_subject_name
X509_get0_notBefore
X509_get0_notAfter
X509_up_ref
X509_subject_name_hash
X509_cmp
X509_NAME_print_ex
X509_NAME_entry_count
X509_NAME_get_entry
X509_NAME_ENTRY_get_object
X509_NAME_ENTRY_get_data
X509_NAME_ENTRY_set
X509_get_ext_d2i
GENERAL_NAME_free
GENERAL_NAME_print
CRL_DIST_POINTS_free
AUTHORITY_INFO_ACCESS_free
X509_check_ca
a2i_IPADDRESS
PEM_read_bio_X509
PEM_write_bio_X509
PEM_write_bio_X509_AUX
PEM_read_DHparams
COMP_get_type
ERR_get_error
ERR_peek_last_error
ERR_clear_error
ERR_reason_error_string
RAND_bytes
RAND_add
RAND_status
DH_free
BIO_puts
BIO_write
BIO_gets
BIO_read
BIO_up_ref
BIO_free
BIO_new
BIO_new_fp
BIO_s_file
BIO_ctrl_pending
BIO_clear_flags
BIO_set_flags
CRYPTO_free
OpenSSL_version
OpenSSL_version_num
OPENSSL_sk_find
OPENSSL_sk_pop_free
OPENSSL_sk_value
OPENSSL_sk_num
BIO_free_all
BIO_s_mem
BIO_new_mem_buf
BIO_printf
ASN1_STRING_length
ASN1_OBJECT_free
BIO_ctrl

libssl-1_1

SSL_pending
SSL_set_fd
SSL_CIPHER_get_auth_nid
SSL_get_rbio
SSL_get_wbio
SSL_set_read_ahead
SSL_get_verify_mode
SSL_get_verify_callback
SSL_set_verify
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_chain_file
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_SESSION_get_ticket_lifetime_hint
SSL_SESSION_get_id
SSL_SESSION_free
i2d_SSL_SESSION
SSL_set_session
d2i_SSL_SESSION
SSL_get_peer_certificate
SSL_get_peer_cert_chain
SSL_CTX_get_verify_mode
SSL_CTX_get_verify_callback
SSL_CTX_set_verify
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_CTX_set_session_id_context
SSL_new
SSL_CTX_get0_param
SSL_get0_param
SSL_free
SSL_read_ex
SSL_write_ex
SSL_ctrl
SSL_CTX_ctrl
SSL_CTX_callback_ctrl
SSL_get_error
SSL_get_version
TLS_method
TLS_server_method
TLS_client_method
SSL_get_ciphers
SSL_get_client_ciphers
SSL_do_handshake
SSL_shutdown
SSL_verify_client_post_handshake
SSL_CTX_set_post_handshake_auth
SSL_set_post_handshake_auth
SSL_set_connect_state
SSL_set_accept_state
SSL_CIPHER_description
SSL_get_shutdown
SSL_CTX_set_default_verify_paths
SSL_CTX_load_verify_locations
SSL_get_session
SSL_get1_session
SSL_get_SSL_CTX
SSL_set_SSL_CTX
SSL_get_verify_result
SSL_get0_verified_chain
SSL_set_ex_data
SSL_get_ex_data
SSL_get_current_compression
SSL_CIPHER_get_cipher_nid
SSL_CIPHER_get_kx_nid
SSL_CTX_set_num_tickets
SSL_CTX_get_num_tickets
SSL_session_reused
SSL_CTX_get_security_level
TLSv1_method
TLSv1_1_method
TLSv1_2_method
SSL_CIPHER_get_id
SSL_CIPHER_get_name
SSL_CIPHER_get_version
SSL_CIPHER_get_bits
SSL_get_current_cipher
SSL_CTX_get_cert_store
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_cipher_list
SSL_get_peer_finished
SSL_get_finished
SSL_CIPHER_get_digest_nid
SSL_is_init_finished
SSL_get_servername
SSL_CTX_set_keylog_callback
SSL_get0_alpn_selected
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_alpn_protos
SSL_select_next_proto
SSL_set_msg_callback
SSL_CTX_set_msg_callback
SSL_CTX_set_options
SSL_CTX_clear_options
SSL_CTX_get_options
SSL_CIPHER_is_aead
SSL_set_bio

kernel32

GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetLastError

python311_d

PyObject_GC_Del
PyBytes_FromStringAndSize
PyBytes_FromString
PyBytes_AsString
_PyBytes_Resize
PyUnicode_FromStringAndSize
PyUnicode_FromString
PyUnicode_FromEncodedObject
PyUnicode_FromFormat
PyUnicode_InternFromString
PyUnicode_Decode
PyUnicode_DecodeUTF8
PyUnicode_AsUTF8String
PyUnicode_AsUTF8AndSize
PyUnicode_AsASCIIString
PyUnicode_FSConverter
PyUnicode_DecodeFSDefault
PyLong_FromLong
PyLong_FromUnsignedLong
PyLong_FromSize_t
PyLong_AsLong
_PyLong_AsInt
PyBool_FromLong
PyFloat_AsDouble
PyTuple_New
PyTuple_Pack
PyList_New
PyList_Size
PyList_SetItem
PyList_Insert
PyList_Append
PyList_AsTuple
PyDict_New
PyDict_GetItemWithError
PyDict_SetItem
PyDict_SetItemString
PySet_New
PyFrozenSet_New
PySet_Add
PyModule_GetState
PyModuleDef_Init
PyCapsule_Import
PyGILState_Ensure
PyGILState_Release
PyErr_WarnEx
PyErr_WarnFormat
PyWeakref_NewRef
PyWeakref_GetObject
_PyTime_AsTimeval_clamp
_PyDeadline_Init
_PyDeadline_Get
PyErr_SetObject
PyErr_SetString
PyErr_Occurred
PyErr_Fetch
PyErr_ExceptionMatches
PyErr_BadArgument
PyErr_NoMemory
PyErr_SetFromErrno
PyErr_SetFromErrnoWithFilenameObject
PyErr_Format
PyErr_SetFromWindowsErr
_PyErr_BadInternalCall
PyErr_NewExceptionWithDoc
PyErr_WriteUnraisable
PyErr_CheckSignals
_PyErr_ChainExceptions
PyThread_allocate_lock
PyThread_acquire_lock
PyThread_release_lock
_PyArg_Parse_SizeT
_PyArg_ParseTuple_SizeT
_Py_BuildValue_SizeT
PyModule_AddObjectRef
PyModule_AddObject
PyModule_AddIntConstant
PyModule_AddStringConstant
PyModule_AddType
_PyArg_NoKeywords
_PyArg_NoPositional
_PyArg_BadArgument
_PyArg_CheckPositional
_PyArg_UnpackKeywords
PyEval_SaveThread
PyEval_RestoreThread
PyObject_CallNoArgs
PyObject_CallObject
_PyObject_CallFunction_SizeT
PyObject_CallFunctionObjArgs
PySequence_List
_Py_fopen_obj
_Py_RefTotal
_Py_NoneStruct
_Py_NotImplementedStruct
PyByteArray_Type
_PyByteArray_empty_string
_Py_FalseStruct
_Py_TrueStruct
PyFloat_Type
PyExc_AttributeError
PyExc_OSError
PyExc_MemoryError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_TypeError
PyExc_UnicodeEncodeError
PyExc_ValueError
PyExc_TimeoutError
PyExc_DeprecationWarning
PyExc_RuntimeWarning
PyObject_GC_UnTrack
PyObject_GC_Track
_PyObject_GC_New
PyType_GetModuleByDef
_Py_Dealloc
_Py_NegativeRefcount
PyCallable_Check
PyObject_IsTrue
PyObject_SetAttr
PyObject_Str
PyMem_Malloc
PyMem_Free
PyObject_CheckBuffer
PyObject_GetBuffer
PyBuffer_IsContiguous
PyBuffer_FillInfo
PyType_FromSpecWithBases
PyType_FromModuleAndSpec
PyType_GetModule
PyType_GetModuleState
PyType_IsSubtype
PyBuffer_Release

vcruntime140d

__std_type_info_destroy_list
__current_exception_context
memcpy
memcmp
strchr
memset
__current_exception
_except_handler4_common

ucrtbased

fseek
ftell
fwrite
__stdio_common_vfprintf
_close
_lseek
_read
_setmode
_write
_open
fread
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_initterm
_fileno
fgets
fflush
ferror
feof
clearerr
__acrt_iob_func
_wassert
_errno
__stdio_common_vsprintf
fclose
fopen

Exports

Exports

OPENSSL_Applink
PyInit__ssl

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a024aa2f7ee76556a9339bf03125cf9

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

libcrypto-1_1

libssl-1_1

kernel32

python311_d

vcruntime140d

ucrtbased

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 108KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 21KB - Virtual size: 22KB

.idata Size: 14KB - Virtual size: 13KB

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 108KB - Virtual size: 108KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 21KB - Virtual size: 22KB

.idata
Size: 14KB - Virtual size: 13KB

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 11KB - Virtual size: 11KB