init_AES
Static task
static1
Behavioral task
behavioral1
Sample
d385e024a506e08f0fa1725bf03d78a9ae82ff1a5a64b76afcbe1ccce9ebcfbe.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d385e024a506e08f0fa1725bf03d78a9ae82ff1a5a64b76afcbe1ccce9ebcfbe.dll
Resource
win10v2004-20240412-en
General
-
Target
d385e024a506e08f0fa1725bf03d78a9ae82ff1a5a64b76afcbe1ccce9ebcfbe
-
Size
30KB
-
MD5
31b5da2e3cc7e88dfbf013c191193c6f
-
SHA1
40f6d42314d8b48d1b76b6f0de65e48197fa8cda
-
SHA256
d385e024a506e08f0fa1725bf03d78a9ae82ff1a5a64b76afcbe1ccce9ebcfbe
-
SHA512
903fe185d1120a4ebac4d0ac7ca98f5460c7581d6c21575c0e03b48961bf64fbb9d3bf3bf996bce12ff26cc3da51457f3ef91920d0595cab2128b3b3f7add4f8
-
SSDEEP
384:Tje1Ow5cJiQhvAMs2WdMnkkLtu37usOo8Vd6IHiPKDkAKB5F0lKqpLd6hRpM:Ty75/+o9CkkQahoICS4AIoR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d385e024a506e08f0fa1725bf03d78a9ae82ff1a5a64b76afcbe1ccce9ebcfbe
Files
-
d385e024a506e08f0fa1725bf03d78a9ae82ff1a5a64b76afcbe1ccce9ebcfbe.dll windows:5 windows x64 arch:x64
4d4b3d13003e7f78008acb197c212afd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
python27
PyType_Type
Py_InitModule4_64
PyModule_AddIntConstant
Py_FatalError
PyInt_FromLong
Py_FindMethod
PyExc_AttributeError
PyArg_Parse
PyString_FromStringAndSize
PyExc_MemoryError
PyEval_SaveThread
PyEval_RestoreThread
PyExc_SystemError
PyObject_CallObject
PyString_Size
PyString_AsString
PyExc_OverflowError
PyArg_ParseTupleAndKeywords
PyErr_Format
PyExc_TypeError
PyObject_HasAttrString
PyErr_Occurred
PyCallable_Check
PyObject_Free
_PyObject_New
PyExc_ValueError
PyErr_SetString
msvcr90
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
malloc
free
memmove
memcpy
memset
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
Sleep
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ