d660c9b158fc023d03be43d738832cf095716e3615708b9a313de1a2ecc1ca5b

Sharing

Copy URL Twitter E-mail

General

Target

d660c9b158fc023d03be43d738832cf095716e3615708b9a313de1a2ecc1ca5b
Size

572KB
MD5

218e45b36932b83151de64b2b25f5477
SHA1

e477c7a25f5a78f7f33514cdfa4096acba66ae9e
SHA256

d660c9b158fc023d03be43d738832cf095716e3615708b9a313de1a2ecc1ca5b
SHA512

55a32407370872c6cea30eea1b2b8ae4bf7794a3ce65b86887a89ed29d4849bbe2720ff8476388356d175b892165091916e2f53b426083336c8f5efec767d243
SSDEEP

6144:o8TqKKSgzlwTnGzzXlIeQpISBSHISqwoSeWkSOKTSRS9SxeSqSWSJSTSOS5S1Sgz:oqqJXeTnmzXiTw+TOenHV/Q9Pish

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d660c9b158fc023d03be43d738832cf095716e3615708b9a313de1a2ecc1ca5b

Files

d660c9b158fc023d03be43d738832cf095716e3615708b9a313de1a2ecc1ca5b
.dll windows:6 windows x64 arch:x64

c325100269343dae16bbfad8993db3d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python38

PyNumber_Index
PyExc_StopIteration
PyList_Type
PyDict_GetItemString
PyObject_GetItem
PyModuleDef_Init
PyBytes_FromStringAndSize
PyNumber_Long
PyUnicode_Compare
PyExc_TypeError
PyMem_Realloc
PyCFunction_NewEx
PyCapsule_Type
PyObject_IsTrue
PyDict_Copy
PyExc_NameError
PyTuple_Pack
_PyUnicode_Ready
PyObject_IsInstance
PyList_AsTuple
PyExc_IndexError
PyExc_ImportError
_Py_TrueStruct
PyExc_SystemError
_PyUnicode_FastCopyCharacters
PyObject_SetItem
PyType_Modified
PyEval_EvalFrameEx
PyUnicode_FromString
_PyType_Lookup
PyUnicode_Format
PyObject_Size
PyObject_Call
PySequence_Tuple
PyEval_RestoreThread
PyUnicode_FromStringAndSize
_PyObject_GetDictPtr
_PyDict_GetItem_KnownHash
PyObject_CallFinalizerFromDealloc
PyUnicode_Type
PyDict_New
PyDict_SetItem
PyCapsule_GetName
PyCapsule_New
PyException_SetTraceback
PyCode_New
PyUnicode_Decode
PyList_Append
PyErr_Clear
PyObject_GetAttrString
PyType_Ready
PyImport_AddModule
PySlice_New
PyList_New
PyUnicode_FromFormat
PyObject_Not
PyLong_AsLong
PyCapsule_GetPointer
PyErr_ExceptionMatches
PyObject_Format
PyModule_GetDict
PyImport_GetModuleDict
_Py_Dealloc
PyExc_OverflowError
PyNumber_Subtract
PyLong_Type
PyMethod_Type
PyModule_NewObject
PyFloat_Type
PyNumber_InPlaceAdd
_Py_FalseStruct
PyTuple_Type
PyBool_Type
PyObject_RichCompare
PyDict_Type
PyErr_Format
PyDict_Next
_Py_CheckRecursiveCall
PyExc_ValueError
PyEval_EvalCodeEx
PyErr_WarnFormat
PyNumber_Add
PyObject_GetIter
PyErr_SetString
PyNumber_Multiply
PyUnicode_New
PyExc_AttributeError
PyFloat_FromDouble
PyFrame_Type
PyLong_FromLongLong
PyDict_Size
PyDict_SetItemString
_Py_EllipsisObject
PySequence_Contains
PyLong_FromString
PyTuple_New
PyLong_AsLongLong
_Py_NoneStruct
PyFloat_AsDouble
PyModule_GetName
PyObject_GetAttr
Py_GetVersion
PyInterpreterState_GetID
PyDict_GetItemWithError
PyObject_Hash
PyObject_GC_UnTrack
PyLong_FromLong
PyObject_SetAttrString
PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyEval_SaveThread
PyTraceBack_Here
PyObject_GenericGetAttr
PyNumber_Remainder
PyLong_FromSsize_t
PyErr_Occurred
PyErr_NormalizeException
PyImport_ImportModuleLevelObject
PyImport_ImportModule
PyExc_KeyError
PyExc_DeprecationWarning
PyLong_AsSsize_t
PyFrame_New
PyFunction_Type
PyCapsule_IsValid
PyErr_WarnEx
PyErr_GivenExceptionMatches
PyErr_SetObject
PyNumber_InPlaceTrueDivide
PyExc_Exception
_Py_CheckRecursionLimit
PyThreadState_Get
PyOS_snprintf
PyCFunction_Type
PyUnicode_InternFromString
PyObject_SetAttr
_PyDict_NewPresized
PyBaseObject_Type
PyMem_Malloc
PySequence_List

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

vcruntime140

memcpy
__C_specific_handler
__std_type_info_destroy_list
memset
memcmp

api-ms-win-crt-math-l1-1-0

sinhf
sinh
sinf
sin
powf
pow
logf
log10f
log10
log
fmodf
fmod
floorf
floor
expf
exp
coshf
cosh
cosf
cos
ceilf
ceil
atanf
atan2f
atan2
atan
asinf
asin
acosf
sqrtf
modff
truncf
rintf
log2f
log1pf
exp2f
expm1f
copysignf
cbrtf
atanhf
asinhf
acoshf
trunc
rint
modf
log2
log1p
ldexp
hypot
frexp
expm1
exp2
copysign
cbrt
atanh
asinh
acosh
_fdclass
_dclass
sqrt
tan
tanf
tanh
tanhf
nextafterl
nextafterf
nextafter
acos

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_clearfp
_execute_onexit_table
_cexit
_initialize_onexit_table
_statusfp

Exports

Exports

PyInit_mtrand
random_beta
random_binomial
random_bounded_bool_fill
random_bounded_uint16_fill
random_bounded_uint32_fill
random_bounded_uint64
random_bounded_uint64_fill
random_bounded_uint8_fill
random_buffered_bounded_bool
random_buffered_bounded_uint16
random_buffered_bounded_uint32
random_buffered_bounded_uint8
random_chisquare
random_exponential
random_f
random_gamma
random_gamma_f
random_geometric
random_geometric_search
random_gumbel
random_interval
random_laplace
random_logistic
random_lognormal
random_logseries
random_multinomial
random_negative_binomial
random_noncentral_chisquare
random_noncentral_f
random_normal
random_pareto
random_poisson
random_positive_int
random_positive_int32
random_positive_int64
random_power
random_rayleigh
random_standard_cauchy
random_standard_exponential
random_standard_exponential_f
random_standard_exponential_fill
random_standard_exponential_fill_f
random_standard_exponential_inv_fill
random_standard_exponential_inv_fill_f
random_standard_gamma
random_standard_gamma_f
random_standard_normal
random_standard_normal_f
random_standard_normal_fill
random_standard_normal_fill_f
random_standard_t
random_standard_uniform
random_standard_uniform_f
random_standard_uniform_fill
random_standard_uniform_fill_f
random_triangular
random_uint
random_uniform
random_vonmises
random_wald
random_weibull
random_zipf

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c325100269343dae16bbfad8993db3d9

Headers

DLL Characteristics

File Characteristics

Imports

python38

kernel32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 223KB - Virtual size: 222KB

.rdata Size: 170KB - Virtual size: 169KB

.data Size: 168KB - Virtual size: 175KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 223KB - Virtual size: 222KB

.rdata
Size: 170KB - Virtual size: 169KB

.data
Size: 168KB - Virtual size: 175KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 2KB - Virtual size: 2KB