236dad046aaa912e92663d231ffec88346665da34e6e29e8096a508fcd00adf0

Sharing

Copy URL Twitter E-mail

General

Target

236dad046aaa912e92663d231ffec88346665da34e6e29e8096a508fcd00adf0
Size

197KB
MD5

58759dea7668cc224272acf46032ad13
SHA1

2b7e4f2a92d605fb005a3995bcedc876c6e26670
SHA256

236dad046aaa912e92663d231ffec88346665da34e6e29e8096a508fcd00adf0
SHA512

8f2061e8b8c9d7818e70a67f3febade89fc8ead26d7bfad89dc4468ba3e01232a486c15897f5f301106bee0ebca91fe32734cc8f370e5f5bb5e5d79caacadfcd
SSDEEP

3072:hEXfL3WKu5oz9HDIYtwU957Xrm+EcM6Bd0l+8hjgQc4o40JX9/8Fe5IcAff:hEXjhu5oDzwU9lrcU58ehN/E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
236dad046aaa912e92663d231ffec88346665da34e6e29e8096a508fcd00adf0

Files

236dad046aaa912e92663d231ffec88346665da34e6e29e8096a508fcd00adf0
.dll windows:6 windows x64 arch:x64

1d43334c56c42d93514c99352abd92a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\A\3\s\PCBuild\amd64\_elementtree.pdb

Imports

kernel32

GetModuleHandleA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
FreeLibrary
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
RtlCaptureContext

python36

PyModule_AddObject
_PyArg_ParseTuple_SizeT
PyObject_GC_Del
PyObject_CallFunctionObjArgs
_PyBytes_Resize
PyObject_ClearWeakRefs
_PyTrash_thread_destroy_chain
PyUnicode_AsUTF8
PyUnicode_FromFormat
PyObject_GetBuffer
PySequence_Fast
PyList_New
PyModule_Create2
PyType_Ready
PyExc_SyntaxError
PyObject_GetAttrString
PyErr_NewException
PyErr_Clear
PyList_Append
PyBytes_Type
PyObject_RichCompareBool
PyDict_SetItem
PyDict_New
PyUnicode_Type
PyMem_Free
PyExc_StopIteration
PyObject_Free
PyCapsule_Import
PyList_Type
PyErr_NoMemory
PyObject_Realloc
PyDict_GetItem
_PyArg_ParseStack_SizeT
PyObject_GC_Track
PyBytes_FromStringAndSize
Py_ReprLeave
PyDict_DelItem
PyNumber_AsSsize_t
Py_ReprEnter
PyExc_TypeError
PyMem_Realloc
_PyTrash_thread_deposit_object
PyObject_IsTrue
PyDict_Copy
PyTuple_Pack
_PyUnicode_Ready
PyMem_Malloc
PyExc_IndexError
PyExc_ImportError
PyState_FindModule
PyArg_UnpackTuple
PyModule_GetState
_PyArg_ParseTupleAndKeywordsFast_SizeT
_PyObject_GC_New
PyList_SetItem
_PyObject_FastCallDict
PyDict_Keys
PyUnicode_FromString
PyBuffer_Release
PyUnicode_FromStringAndSize
PySequence_Size
PyExc_OverflowError
PyUnicode_Join
_PyObject_CallMethodId_SizeT
PyType_IsSubtype
PyDict_Type
PyErr_Format
_PyArg_ParseTupleAndKeywords_SizeT
PyDict_Next
PyExc_ValueError
PyErr_SetString
PyUnicode_New
PyExc_AttributeError
PyDict_Items
_Py_HashSecret
PyDict_Size
PyTuple_New
_Py_NoneStruct
PyErr_SetNone
PyObject_GC_UnTrack
PySlice_Unpack
PyLong_FromLong
PyObject_SetAttrString
PyExc_RuntimeError
PyUnicode_AsUTF8AndSize
PyErr_ExceptionMatches
PyObject_GenericGetAttr
_PyUnicode_EqualToASCIIString
PyUnicode_DecodeUTF8
PyLong_FromSsize_t
PyErr_Occurred
PyDict_Update
PyObject_SelfIter
PyImport_ImportModule
PySlice_Type
PyExc_DeprecationWarning
PyErr_WarnEx
PyObject_Malloc
_PyObject_SetAttrId
_PyObject_CallFunction_SizeT
_Py_BuildValue_SizeT
PyErr_SetObject
PySlice_AdjustIndices
PyThreadState_Get
PyCFunction_Type
_PyArg_Parse_SizeT
PyUnicode_AsEncodedString
PyType_GenericAlloc

vcruntime140

memmove
memcpy
memcmp
__std_type_info_destroy_list
__C_specific_handler
memset

api-ms-win-crt-string-l1-1-0

strncat
strpbrk
strcmp

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_register_onexit_function
_execute_onexit_table
terminate
_crt_atexit
_initterm
_crt_at_quick_exit
_cexit

Exports

Exports

PyInit__elementtree

Sections

.text
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d43334c56c42d93514c99352abd92a7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

python36

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 145KB - Virtual size: 145KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 5KB - Virtual size: 6KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 145KB - Virtual size: 145KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 5KB - Virtual size: 6KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB