PyInit_sites
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.328724561e2eab44b26b0e7d5f801310.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.328724561e2eab44b26b0e7d5f801310.dll
Resource
win10v2004-20231023-en
General
-
Target
NEAS.328724561e2eab44b26b0e7d5f801310.exe
-
Size
99KB
-
MD5
328724561e2eab44b26b0e7d5f801310
-
SHA1
20807fa0a771bac3987eaddb8fd12bebe39c04fd
-
SHA256
ee9f853a73abf15a00fe90ff261ebb160aa2ef6ef5fd1334f8766c7257be83a7
-
SHA512
e9729a2c4a45e3747c9c3ba99008db08924af2873db4bd5fa98965bc399bcfa87c67a03822ee68ab22d00d0ea073e02f6c5f58cc21632b1a5699889648053382
-
SSDEEP
1536:9+As/vFvTn/gSM9UPDy/sMHwPP3lLuBZompyhwGi4:EXFvTn/VusMW3lZm4i4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.328724561e2eab44b26b0e7d5f801310.exe
Files
-
NEAS.328724561e2eab44b26b0e7d5f801310.exe.dll windows:4 windows x86
30860f394dd49266e7ce1d90fa421ada
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_assert
_errno
_iob
abort
calloc
fflush
free
fwrite
malloc
memcmp
memcpy
vfprintf
python37
PyBaseObject_Type
PyBytes_FromStringAndSize
PyCFunction_Type
PyCode_New
PyDict_Contains
PyDict_GetItemString
PyDict_GetItemWithError
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Size
PyDict_Type
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_Occurred
PyErr_SetNone
PyErr_SetObject
PyErr_SetString
PyErr_WarnEx
PyEval_EvalCodeEx
PyEval_EvalFrameEx
PyExc_AssertionError
PyExc_AttributeError
PyExc_ImportError
PyExc_KeyError
PyExc_NameError
PyExc_RuntimeError
PyExc_StopIteration
PyExc_SystemError
PyExc_TypeError
PyFloat_Type
PyFrame_New
PyFrame_Type
PyFunction_Type
PyImport_AddModule
PyImport_GetModuleDict
PyImport_ImportModuleLevelObject
PyInterpreterState_GetID
PyList_Append
PyList_New
PyList_Type
PyLong_FromLong
PyLong_Type
PyMem_Malloc
PyMem_Realloc
PyMethodDescr_Type
PyMethod_New
PyMethod_Type
PyModuleDef_Init
PyModule_GetDict
PyModule_NewObject
PyOS_snprintf
PyObject_Call
PyObject_ClearWeakRefs
PyObject_Format
PyObject_Free
PyObject_GC_Del
PyObject_GC_Track
PyObject_GC_UnTrack
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetItem
PyObject_GetIter
PyObject_Hash
PyObject_IsTrue
PyObject_Not
PyObject_RichCompare
PyObject_SetAttr
PyObject_SetAttrString
PySequence_List
PyThreadState_Get
PyTraceBack_Here
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_Type
PyType_Ready
PyUnicode_Compare
PyUnicode_Concat
PyUnicode_Decode
PyUnicode_FromFormat
PyUnicode_FromString
PyUnicode_FromStringAndSize
PyUnicode_InternFromString
PyUnicode_Type
Py_GetVersion
Py_OptimizeFlag
_PyDict_GetItem_KnownHash
_PyObject_GC_New
_PyObject_GetDictPtr
_PyThreadState_UncheckedGet
_PyUnicode_Ready
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
_Py_FalseStruct
_Py_NoneStruct
_Py_TrueStruct
Exports
Exports
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 476B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 73B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/14 Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/29 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/41 Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/55 Size: 512B - Virtual size: 343B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ