fecbff590a8d8bfc11173987c8e7cc8e2f82fd907f26afb6374aaeda8c041a77

Sharing

Copy URL Twitter E-mail

General

Target

fecbff590a8d8bfc11173987c8e7cc8e2f82fd907f26afb6374aaeda8c041a77
Size

122KB
MD5

1addf40fe65d9283123fa407ea975d03
SHA1

3406c6128074d98e25a7cc86520e518627dc6f3f
SHA256

fecbff590a8d8bfc11173987c8e7cc8e2f82fd907f26afb6374aaeda8c041a77
SHA512

8115a3ea274ab84463f566189f15326f3d2581899ecf3337d71735f29d0998505455bd6cacee929337395302e6b6810814a80d9182aa7a9dc36f245d654b136c
SSDEEP

3072:fkVo5wHydlUQRk/MOec4iRUwK3C3LI3X9+ShHTGjFzBq:sVYwHyHUQRk/MOec4iR5K3ALGN+SJGj6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fecbff590a8d8bfc11173987c8e7cc8e2f82fd907f26afb6374aaeda8c041a77

Files

fecbff590a8d8bfc11173987c8e7cc8e2f82fd907f26afb6374aaeda8c041a77
.dll windows:4 windows x86 arch:x86

9027394e73afe4c715576909c6393906

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

cygwin1

__assert_func
__getreent
_impure_ptr
abort
calloc
close
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
dup
free
fwrite
malloc
realloc
strlen

cygdbus-1-3

dbus_bus_get_private
dbus_bus_get_unique_name
dbus_bus_register
dbus_bus_set_unique_name
dbus_connection_add_filter
dbus_connection_allocate_data_slot
dbus_connection_close
dbus_connection_flush
dbus_connection_get_data
dbus_connection_get_is_authenticated
dbus_connection_get_is_connected
dbus_connection_get_unix_fd
dbus_connection_get_unix_process_id
dbus_connection_get_unix_user
dbus_connection_list_registered
dbus_connection_open_private
dbus_connection_ref
dbus_connection_register_fallback
dbus_connection_register_object_path
dbus_connection_remove_filter
dbus_connection_send
dbus_connection_send_with_reply
dbus_connection_send_with_reply_and_block
dbus_connection_set_allow_anonymous
dbus_connection_set_data
dbus_connection_set_exit_on_disconnect
dbus_connection_unref
dbus_connection_unregister_object_path
dbus_error_free
dbus_error_init
dbus_free
dbus_free_string_array
dbus_message_copy
dbus_message_get_auto_start
dbus_message_get_destination
dbus_message_get_error_name
dbus_message_get_interface
dbus_message_get_member
dbus_message_get_no_reply
dbus_message_get_path
dbus_message_get_path_decomposed
dbus_message_get_reply_serial
dbus_message_get_sender
dbus_message_get_serial
dbus_message_get_signature
dbus_message_get_type
dbus_message_has_destination
dbus_message_has_interface
dbus_message_has_member
dbus_message_has_path
dbus_message_has_sender
dbus_message_has_signature
dbus_message_is_error
dbus_message_is_method_call
dbus_message_is_signal
dbus_message_iter_abandon_container
dbus_message_iter_append_basic
dbus_message_iter_append_fixed_array
dbus_message_iter_close_container
dbus_message_iter_get_arg_type
dbus_message_iter_get_basic
dbus_message_iter_get_element_type
dbus_message_iter_get_fixed_array
dbus_message_iter_get_signature
dbus_message_iter_init
dbus_message_iter_init_append
dbus_message_iter_next
dbus_message_iter_open_container
dbus_message_iter_recurse
dbus_message_new_error
dbus_message_new_method_call
dbus_message_new_method_return
dbus_message_new_signal
dbus_message_ref
dbus_message_set_auto_start
dbus_message_set_destination
dbus_message_set_error_name
dbus_message_set_interface
dbus_message_set_member
dbus_message_set_no_reply
dbus_message_set_reply_serial
dbus_message_set_sender
dbus_message_unref
dbus_pending_call_block
dbus_pending_call_cancel
dbus_pending_call_get_completed
dbus_pending_call_set_notify
dbus_pending_call_steal_reply
dbus_pending_call_unref
dbus_server_allocate_data_slot
dbus_server_disconnect
dbus_server_get_address
dbus_server_get_data
dbus_server_get_id
dbus_server_get_is_connected
dbus_server_listen
dbus_server_set_auth_mechanisms
dbus_server_set_data
dbus_server_set_new_connection_function
dbus_server_unref
dbus_signature_iter_get_current_type
dbus_signature_iter_get_element_type
dbus_signature_iter_get_signature
dbus_signature_iter_init
dbus_signature_iter_next
dbus_signature_iter_recurse
dbus_signature_validate
dbus_signature_validate_single

libpython2.6

PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
PyBool_FromLong
PyCObject_FromVoidPtr
PyDict_DelItem
PyDict_GetItem
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_Type
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_NoMemory
PyErr_Occurred
PyErr_Print
PyErr_Restore
PyErr_SetObject
PyErr_SetString
PyErr_WarnEx
PyErr_WriteUnraisable
PyEval_RestoreThread
PyEval_SaveThread
PyExc_AssertionError
PyExc_AttributeError
PyExc_KeyError
PyExc_KeyboardInterrupt
PyExc_MemoryError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_SystemExit
PyExc_TypeError
PyExc_UnicodeError
PyExc_UserWarning
PyExc_ValueError
PyFloat_AsDouble
PyFloat_Type
PyGILState_Ensure
PyGILState_Release
PyImport_Import
PyInt_AsLong
PyInt_FromLong
PyInt_Type
PyIter_Next
PyList_Append
PyList_GetItem
PyList_New
PyList_SetItem
PyList_Type
PyLong_AsLong
PyLong_AsLongLong
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyLong_FromUnsignedLong
PyLong_FromVoidPtr
PyLong_Type
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyNumber_Long
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_ClearWeakRefs
PyObject_Free
PyObject_GenericGetAttr
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetItem
PyObject_GetIter
PyObject_HasAttrString
PyObject_IsInstance
PyObject_IsTrue
PyObject_Repr
PyObject_SetAttrString
PySequence_Fast
PyString_AsString
PyString_AsStringAndSize
PyString_Concat
PyString_ConcatAndDel
PyString_FromFormat
PyString_FromString
PyString_InternFromString
PyString_Type
PyTuple_GetItem
PyTuple_New
PyTuple_Pack
PyTuple_Size
PyTuple_Type
PyType_GenericAlloc
PyType_IsSubtype
PyType_Ready
PyUnicodeUCS2_AsEncodedString
PyUnicodeUCS2_AsUTF32String
PyUnicodeUCS2_AsUTF8String
PyUnicodeUCS2_DecodeUTF8
PyUnicodeUCS2_FromFormat
PyUnicodeUCS2_FromStringAndSize
PyUnicode_Type
PyWeakref_GetObject
PyWeakref_NewRef
Py_BuildValue
Py_InitModule4
_PyArg_ParseTupleAndKeywords_SizeT
_PyArg_ParseTuple_SizeT
_PyErr_BadInternalCall
_PyObject_CallFunction_SizeT
_PyObject_CallMethod_SizeT
_PyObject_New
_Py_BuildValue_SizeT
_Py_NoneStruct
_Py_NotImplementedStruct
_Py_TrueStruct
_Py_ZeroStruct

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

init_dbus_bindings

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 312B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9027394e73afe4c715576909c6393906

Headers

File Characteristics

Imports

cygwin1

cygdbus-1-3

libpython2.6

kernel32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.data Size: 56KB - Virtual size: 56KB

/4 Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 312B

.edata Size: 512B - Virtual size: 88B

.idata Size: 9KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 3KB

/14 Size: 512B - Virtual size: 28B

.text
Size: 50KB - Virtual size: 49KB

.data
Size: 56KB - Virtual size: 56KB

/4
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 312B

.edata
Size: 512B - Virtual size: 88B

.idata
Size: 9KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 3KB

/14
Size: 512B - Virtual size: 28B