PyInit__overlapped
Static task
static1
Behavioral task
behavioral1
Sample
3d5d472fa8e6672179bd14ddf1dbe81d6997a0a1abe7ddb35a200c279e82d102.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3d5d472fa8e6672179bd14ddf1dbe81d6997a0a1abe7ddb35a200c279e82d102.dll
Resource
win10v2004-20231215-en
General
-
Target
3d5d472fa8e6672179bd14ddf1dbe81d6997a0a1abe7ddb35a200c279e82d102
-
Size
38KB
-
MD5
b9f900728f5420e9c41d91602f025d5c
-
SHA1
be68e5a78226b8dec07b27660a70026d2cc4d0c2
-
SHA256
3d5d472fa8e6672179bd14ddf1dbe81d6997a0a1abe7ddb35a200c279e82d102
-
SHA512
bac8a3d8d13b1b28517954d25dbdff393b53747bffb0603018a02e80fd1a80c0e36749063a10d08645750395bba835fd646a44194e9f4047c60083788f19bcd6
-
SSDEEP
768:XP71kd051nrogeqeKGmuE2BA5CouSwWBlOpccccccccccccccccccccccctfb2iK:D1kd051ExTfSVr/w00f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d5d472fa8e6672179bd14ddf1dbe81d6997a0a1abe7ddb35a200c279e82d102
Files
-
3d5d472fa8e6672179bd14ddf1dbe81d6997a0a1abe7ddb35a200c279e82d102.dll windows:4 windows x64 arch:x64
d077606362f9d1328a4eefc9e17e2b74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
libpython3.11
PyArg_Parse
PyArg_ParseTuple
PyBool_FromLong
PyBuffer_Release
PyBytes_FromStringAndSize
PyErr_Format
PyErr_SetExcFromWindowsErr
PyErr_SetFromErrno
PyErr_SetString
PyErr_WriteUnraisable
PyEval_RestoreThread
PyEval_SaveThread
PyExc_ConnectionAbortedError
PyExc_ConnectionRefusedError
PyExc_OSError
PyExc_RuntimeError
PyExc_ValueError
PyImport_ImportModule
PyLong_FromUnsignedLong
PyLong_FromVoidPtr
PyMem_RawFree
PyMem_RawMalloc
PyModuleDef_Init
PyModule_AddObject
PyModule_AddType
PyModule_GetState
PyObject_Free
PyTuple_New
PyTuple_Type
PyType_FromModuleAndSpec
PyUnicode_FromFormat
PyUnicode_FromString
Py_BuildValue
_PyArg_BadArgument
_PyArg_ParseStack
_PyArg_ParseTupleAndKeywordsFast
_PyBytes_Resize
_PyObject_New
_PyUnicode_AsUnicode
_PyUnicode_WideCharString_Opt_Converter
_Py_Dealloc
_Py_FalseStruct
_Py_NoneStruct
_Py_TrueStruct
kernel32
CancelIoEx
CloseHandle
ConnectNamedPipe
CreateEventA
CreateEventW
CreateFileW
CreateIoCompletionPort
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
GetCurrentProcess
GetLastError
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetQueuedCompletionStatus
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LocalFree
PostQueuedCompletionStatus
ReadFile
RegisterWaitForSingleObject
ResetEvent
SetEvent
SetLastError
Sleep
TerminateProcess
TlsGetValue
UnregisterWait
UnregisterWaitEx
VirtualProtect
VirtualQuery
WriteFile
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
_write
abort
calloc
free
fwrite
iswctype
realloc
strlen
strncmp
vfprintf
ws2_32
WSAConnect
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSAStringToAddressW
bind
closesocket
htons
inet_ntop
ntohl
ntohs
socket
Exports
Exports
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 336B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ