Static task
static1
Behavioral task
behavioral1
Sample
d4f92f305ec0afa8e75c76c86ee3ddb2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d4f92f305ec0afa8e75c76c86ee3ddb2.exe
Resource
win10v2004-20240226-en
General
-
Target
d4f92f305ec0afa8e75c76c86ee3ddb2
-
Size
284KB
-
MD5
d4f92f305ec0afa8e75c76c86ee3ddb2
-
SHA1
c9aab5f98148326fc7adb91e32b9017b5de41fec
-
SHA256
8c02ddfa12c9d95ec4fe6c9841245cb6bc4c97445c6a30d59236949bf6391123
-
SHA512
fff2e6feb7eb2b8785048322e2d671b7f002c515d7852148760d7673144cfe9d57da92771d6c0018765861181c5ad21ef665b5f337b1e556fc101c9d0110a5e1
-
SSDEEP
3072:IDIQFLE72D5z5R72Fc/Zo7wGOv+9fnD54xMtfUyS8odrU3kVLA4wmPt2oF:XQFg72dzj2F4ZUM+9fDuSMRw2YoF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4f92f305ec0afa8e75c76c86ee3ddb2
Files
-
d4f92f305ec0afa8e75c76c86ee3ddb2.exe windows:6 windows x64 arch:x64
9eccaf2eeb0ba657aeb2f41bafdf623a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
CommandLineToArgvW
python39
PyObject_ClearWeakRefs
PyObject_GetAttrString
PyObject_GenericSetAttr
PyObject_IsInstance
_PyObject_GC_Malloc
PyCallable_Check
PyMem_Malloc
PyArg_UnpackTuple
PyObject_Repr
PyArg_ParseTuple
_PyAsyncGenWrappedValue_Type
PyErr_GivenExceptionMatches
PyObject_SelfIter
PyLong_FromSsize_t
_PyGen_FetchStopIterationValue
Py_BuildValue
PyFrame_GetLineNumber
PyCoro_Type
PyCode_NewWithPosOnlyArgs
PyErr_ExceptionMatches
_PyErr_FormatFromCause
_PyGen_SetStopIterationValue
PyExc_StopAsyncIteration
PyEval_GetFrame
PyGen_Type
PyObject_CallMethodObjArgs
PyAsyncGen_Type
PyTraceBack_Type
PyEval_EvalFrameEx
PyObject_Call
Py_GenericAlias
PyModule_GetFilenameObject
PyFrozenSet_Type
PyExc_ImportWarning
PyBaseObject_Type
PyObject_SetAttr
PyObject_Malloc
PyErr_WarnEx
PyFrame_New
PyExc_KeyError
PyUnicode_AsUnicode
PyUnicode_DecodeUTF8
PyNumber_FloorDivide
PyExc_UnboundLocalError
PyLong_FromUnsignedLongLong
PyComplex_FromDoubles
PyModule_GetName
PyBytes_FromString
PyDict_SetItemString
PyLong_FromLongLong
PyFrame_Type
PyFloat_FromDouble
PySet_Add
PyUnicode_New
PyUnicode_FromWideChar
PyNumber_Add
PyEval_EvalCodeEx
PyUnicode_InternInPlace
PyNumber_InPlaceLshift
PyTuple_Type
PyImport_GetModule
PyNumber_InPlaceAdd
PyLong_Type
PyModule_GetDict
PyExc_OverflowError
PyObject_Free
PyUnicode_FindChar
PyLong_AsLong
PyCode_Type
PyNumber_InPlaceMultiply
PySet_New
PySlice_New
PyObject_RichCompareBool
PyNumber_Index
PyFrozenSet_New
PyByteArray_FromStringAndSize
PyNumber_Negative
_PySet_NextEntry
PyList_Type
PyErr_NoMemory
PyObject_Realloc
PyDict_GetItemString
PyEllipsis_Type
PyDict_GetItem
PyObject_CallObject
PyComplex_Type
PyIndex_Check
PyBytes_FromStringAndSize
PyNumber_AsSsize_t
_PyObject_New
PyMem_Realloc
PyExc_NameError
PyTuple_Pack
_PyUnicode_Ready
PyExc_IndexError
PyExc_ImportError
PyException_SetCause
PyErr_Print
PyRange_Type
PyObject_Size
PyType_Type
PyUnicode_FromStringAndSize
PyObject_SetAttrString
Py_CompileStringExFlags
PyCMethod_New
PyArg_ParseTupleAndKeywords
PyImport_ExecCodeModule
PyDict_DelItemString
PyOS_snprintf
PyList_Insert
PyImport_ExecCodeModuleEx
PyUnicode_Concat
_PyImport_FixupExtensionObject
PyModule_GetDef
PyMarshal_ReadObjectFromString
_Py_PackageContext
PyModule_NewObject
PyImport_ImportFrozenModule
PyModule_AddObject
PyUnicode_AsWideCharString
PyModule_FromDefAndSpec2
PyModule_ExecDef
PyImport_FrozenModules
PyModuleDef_Type
PyList_SetItem
PySys_WriteStderr
PyObject_CallFunctionObjArgs
PyMethod_Type
PyDict_Type
PyDict_Next
PyObject_GetIter
PyIter_Next
_PyObject_GC_Resize
PyObject_GetAttr
PyExc_RuntimeError
PyType_GetFlags
PyEval_GetFuncName
PyImport_ImportModule
_PyArg_NoKeywords
_Py_NewReference
_Py_NotImplementedStruct
PyErr_BadArgument
PyUnicode_FromFormat
PyObject_GC_Del
PyObject_RichCompare
PyObject_GC_UnTrack
Py_FrozenFlag
Py_IgnoreEnvironmentFlag
Py_InspectFlag
Py_InteractiveFlag
Py_UTF8Mode
PyStructSequence_SetItem
Py_OptimizeFlag
PyDict_DelItem
PySys_SetArgv
Py_VerboseFlag
Py_BytesWarningFlag
PyUnicode_AsUTF8
Py_DebugFlag
Py_DontWriteBytecodeFlag
Py_Initialize
PyImport_GetModuleDict
Py_NoUserSiteDirectory
Py_NoSiteFlag
PySys_GetObject
Py_SetPythonHome
_PyWarnings_Init
Py_GetPath
PyUnicode_Substring
PyEval_AcquireThread
PyUnicode_GetLength
PyExc_GeneratorExit
_PyObject_GC_New
PyException_GetContext
_Py_TrueStruct
PyModule_Type
PyDict_Copy
PyObject_IsSubclass
PyObject_GC_Track
PyExc_StopIteration
PyException_SetContext
PyUnicode_Type
PySequence_Check
PyDict_New
PyDict_SetItem
PyList_New
PyUnicode_Find
PyUnicode_Join
PySeqIter_Type
PyExc_ValueError
PyErr_WriteUnraisable
_Py_NoneStruct
PyEval_SaveThread
PyErr_NormalizeException
PyErr_PrintEx
Py_Exit
Py_MakePendingCalls
_PyDict_NewPresized
_PyType_Lookup
PyExc_SystemError
PyExc_TypeError
_PyRuntime
PyType_Ready
_Py_Dealloc
PyType_IsSubtype
PyErr_Format
PyExc_AttributeError
PyTuple_New
PyObject_GenericGetAttr
PyFunction_Type
PyCFunction_Type
PyUnicode_FromString
PyCapsule_New
PySys_SetObject
_Py_FalseStruct
PyStructSequence_New
PyStructSequence_InitType
PyLong_FromLong
PyNumber_Subtract
kernel32
WriteConsoleW
CreateFileW
CloseHandle
HeapReAlloc
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
CompareStringW
MultiByteToWideChar
GetFileType
HeapAlloc
HeapFree
GetCommandLineA
GetModuleHandleExW
ExitProcess
WriteFile
GetStdHandle
RaiseException
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwindEx
SetDllDirectoryA
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExW
FormatMessageA
GetProcAddress
GetLastError
SetErrorMode
GetSystemTimeAsFileTime
GetCurrentProcessId
LoadResource
LockResource
FindResourceA
GetModuleFileNameW
GetShortPathNameW
GetCommandLineW
Sections
.text Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ