56a5e7556d46dbf09be648dc2f4cf731e73562a39bca350fb352a1028091606e

Sharing

Copy URL Twitter E-mail

General

Target

56a5e7556d46dbf09be648dc2f4cf731e73562a39bca350fb352a1028091606e
Size

172KB
MD5

d607d31f2d2286bb67ac4271dc567266
SHA1

f25ae328cad7ab45b971e462343eaf6db3c6e9ae
SHA256

56a5e7556d46dbf09be648dc2f4cf731e73562a39bca350fb352a1028091606e
SHA512

5b4bff2ecc4abd002bc716859c00dee09276afc9d21c5b818c1f5259d05b98a0998d26d797a6f66a4c42241840b597361708ea296963a672dd5b2ec3608147e3
SSDEEP

3072:wwBBN3AEFBNUWP+uqTHma3/9XPxFlQGh2bwWojdStBuIHU5WhUW1DUbUd:j/17NUWPZozzFlQGh2hHuIHUWUWOI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56a5e7556d46dbf09be648dc2f4cf731e73562a39bca350fb352a1028091606e

Files

56a5e7556d46dbf09be648dc2f4cf731e73562a39bca350fb352a1028091606e
.dll windows:6 windows x86 arch:x86

8429ab11364266c13f931550257afdbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\src\pywin32\build\temp.win32-3.7\Release\win32gui.pdb

Imports

gdi32

EqualRgn
ExtFloodFill
FillRgn
FrameRgn
GetROP2
GetBkColor
GetBkMode
GetCurrentObject
GetCurrentPositionEx
GetGraphicsMode
GetMapMode
GetObjectType
GetPixel
GetPolyFillMode
GetRgnBox
GetStockObject
GetStretchBltMode
GetTextCharacterExtra
GetTextAlign
GetTextColor
GetTextExtentPoint32W
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
InvertRgn
LineTo
OffsetRgn
PatBlt
Pie
PaintRgn
PtInRegion
RectInRegion
Rectangle
RestoreDC
RoundRect
SaveDC
SelectObject
SetBkColor
SetBkMode
SetGraphicsMode
SetMapMode
EnumFontFamiliesW
SetPixelV
SetPolyFillMode
StretchBlt
SetRectRgn
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextColor
SetTextAlign
GetTextMetricsW
AbortPath
ArcTo
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetPath
PathToRegion
SetArcDirection
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
ExtCreatePen
GetMiterLimit
GetArcDirection
GetObjectW
MoveToEx
ExtTextOutW
CreatePolygonRgn
Polygon
Polyline
PolyBezier
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
GetTextFaceW
Ellipse
DeleteObject
DeleteDC
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateFontIndirectW
CreateEllipticRgnIndirect
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CombineRgn
Chord
BitBlt
SetPixel
Arc

user32

GetFocus
GetCapture
SetCapture
ReleaseCapture
EnableWindow
IsWindowEnabled
GetNextDlgGroupItem
DestroyAcceleratorTable
TranslateAcceleratorW
LoadMenuW
GetMenu
SetMenu
GetMenuState
DrawMenuBar
GetSystemMenu
CreateMenu
CreatePopupMenu
DestroyMenu
CheckMenuItem
EnableMenuItem
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
DeleteMenu
SetMenuItemBitmaps
TrackPopupMenu
InsertMenuItemW
GetMenuItemInfoW
SetMenuItemInfoW
GetMenuDefaultItem
SetMenuDefaultItem
GetMenuItemRect
DragDetect
DrawIcon
DrawTextW
UpdateWindow
SetActiveWindow
GetForegroundWindow
PaintDesktop
SetForegroundWindow
WindowFromDC
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRgn
SetWindowRgn
GetWindowRgn
InvalidateRect
ValidateRect
InvalidateRgn
ValidateRgn
RedrawWindow
ScrollWindowEx
EnumPropsExW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
MessageBoxW
MessageBeep
SetCursor
GetCursorPos
GetActiveWindow
CreateCaret
DestroyCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
ScreenToClient
WindowFromPoint
ChildWindowFromPoint
ChildWindowFromPointEx
GetSysColor
GetSysColorBrush
DrawFocusRect
FillRect
FrameRect
InvertRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongW
SetClassLongW
GetDesktopWindow
GetParent
SetParent
EnumChildWindows
FindWindowW
FindWindowExW
EnumWindows
EnumThreadWindows
GetClassNameW
GetWindow
CheckMenuRadioItem
LoadCursorW
LoadIconW
DestroyIcon
CreateIconFromResource
LoadImageW
DrawIconEx
CreateIconIndirect
CopyIcon
GetIconInfo
IsDialogMessageW
SetScrollInfo
GetScrollInfo
SystemParametersInfoW
GetCursorInfo
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
CreateDialogIndirectParamW
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
CloseWindow
FlashWindow
ShowWindow
DestroyWindow
IsChild
SetFocus
DefDlgProcW
GetDlgCtrlID
GetCursor
GetNextDlgTabItem
IsWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
SetDoubleClickTime
GetDoubleClickTime
CallWindowProcW
PostQuitMessage
DefWindowProcW
WaitMessage
ReplyMessage
PostThreadMessageW
PostMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
SendMessageTimeoutW
SendMessageW
RegisterHotKey
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
DrawAnimatedRects
DrawEdge
RegisterWindowMessageW
CreateAcceleratorTableW

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

comctl32

_TrackMouseEvent
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControlsEx
ord17

shell32

ExtractIconExW
ExtractIconW
DragAcceptFiles
Shell_NotifyIconW

python37

PyObject_CallObject
_Py_FalseStruct
_Py_TrueStruct
PyExc_AttributeError
PyObject_Call
PyExc_TypeError
PyExc_PendingDeprecationWarning
PyEval_RestoreThread
PyEval_InitThreads
PyEval_SaveThread
PyEval_CallObjectWithKeywords
PyErr_Print
PyModule_Create2
PyArg_ParseTupleAndKeywords
PyErr_Format
PyErr_NoMemory
PyErr_Fetch
PyErr_Clear
PyErr_WarnEx
PyGILState_Release
PyGILState_Ensure
PyModule_GetDict
PyDict_SetItemString
PyDict_DelItem
PyDict_SetItem
PySys_WriteStderr
PyDict_GetItem
PyDict_New
PyTuple_GetItem
PyTuple_Size
PyTuple_New
PyFloat_FromDouble
PyBool_FromLong
PyLong_AsUnsignedLongMask
PyLong_AsLongLong
PyLong_FromVoidPtr
PyExc_MemoryError
PyBytes_FromStringAndSize
PyLong_FromLong
PyLong_FromUnsignedLong
PyLong_AsUnsignedLong
PyList_New
PyLong_AsLong
PyLong_FromSsize_t
PyUnicode_AsUTF8
PyUnicode_AsUnicode
PyBytes_AsStringAndSize
PyBytes_FromString
PyCallable_Check
PyObject_IsTrue
PyObject_GenericSetAttr
PyObject_GenericGetAttr
PyObject_GetAttrString
PyType_Ready
PyExc_ValueError
PyExc_NotImplementedError
_Py_NoneStruct
PySequence_Tuple
Py_BuildValue
PyArg_ParseTuple
PyErr_Occurred
PyErr_SetString
PyList_Append

pywintypes37

?PyHANDLEType@@3U_typeobject@@A
?PyWinExc_ApiError@@3PAU_object@@A
??1PyHANDLE@@UAE@XZ
??0PyHANDLE@@QAE@PAX@Z
?PyWinGlobals_Ensure@@YAHXZ
?PyWinObject_FromMSG@@YAPAU_object@@PBUtagMSG@@@Z
?PyWinObject_AsMSG@@YAHPAU_object@@PAUtagMSG@@@Z
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z
?PyWinObject_AsDEVMODE@@YAHPAU_object@@PAPAU_devicemodeW@@H@Z
?PyWinObject_FromRECT@@YAPAU_object@@PAUtagRECT@@@Z
?PyWinObject_AsRECT@@YAHPAU_object@@PAUtagRECT@@@Z
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z
?PyWinObject_AsDWORDArray@@YAHPAU_object@@PAPAKPAKH@Z
?PyWinObject_AsPOINT@@YAHPAU_object@@PAUtagPOINT@@@Z
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_WH@Z
?ok@PyWinBufferView@@QAE_NXZ
??0PyWinBufferView@@QAE@PAU_object@@_N1@Z
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z
?PyBuffer_FromMemory@@YAPAU_object@@PAXH@Z
?PyBuffer_New@@YAPAU_object@@H@Z
?PyWinObject_FreeResourceId@@YAXPA_W@Z
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z
?len@PyWinBufferView@@QAEKXZ
?ptr@PyWinBufferView@@QAEPAXXZ
?init@PyWinBufferView@@QAE_NPAU_object@@_N1@Z
??1PyWinBufferView@@QAE@XZ
??0PyWinBufferView@@QAE@XZ
?PyWinObject_FreeWCHAR@@YAXPA_W@Z
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z

kernel32

IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsBadStringPtrW
IsBadWritePtr
IsBadReadPtr
LoadLibraryW
GetProcAddress
GetModuleHandleW
SetLastError
GetLastError
GlobalFree
GlobalLock
GlobalUnlock
GlobalReAlloc
GetStartupInfoW
GlobalAlloc

vcruntime140

__CxxFrameHandler3
memcpy
__std_terminate
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-string-l1-1-0

wcsncpy

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_initterm

Exports

Exports

PyInit_win32gui
_DllMain@12

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8429ab11364266c13f931550257afdbb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

comdlg32

comctl32

shell32

python37

pywintypes37

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 104KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 7KB - Virtual size: 8KB

.gfids Size: 512B - Virtual size: 76B

.rsrc Size: 1024B - Virtual size: 852B

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 105KB - Virtual size: 104KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 7KB - Virtual size: 8KB

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 1024B - Virtual size: 852B

.reloc
Size: 15KB - Virtual size: 14KB