PyInit_rp_server_settings
Static task
static1
Behavioral task
behavioral1
Sample
09c49dd68c2bdfa272a579fe712402e2b0a688ed8b999f7c3e0a28d86d8c744b.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
09c49dd68c2bdfa272a579fe712402e2b0a688ed8b999f7c3e0a28d86d8c744b.dll
Resource
win10v2004-20240508-en
General
-
Target
09c49dd68c2bdfa272a579fe712402e2b0a688ed8b999f7c3e0a28d86d8c744b
-
Size
296KB
-
MD5
7aa4eb6c114c4e58a68a77801c91ea9d
-
SHA1
6ca18abfef718d21c3143ee7008ef35f6a35d789
-
SHA256
09c49dd68c2bdfa272a579fe712402e2b0a688ed8b999f7c3e0a28d86d8c744b
-
SHA512
d2274f523f92e81956a3413ba6673cc2d38a3a964880cbb3fb1665bbd68d6d8f7189cc982ed2972173c78606519f08b4a4cf6bf85aa69d5402f2ea2ecef79f37
-
SSDEEP
6144:sf2BRcueA0+oGcTvERcXSsG31bw6cw28BP/ML77iVGXBuuf/r5cFKDy:Ml+4TvERcXSsG31MLyP/ML77ikBuuf/V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09c49dd68c2bdfa272a579fe712402e2b0a688ed8b999f7c3e0a28d86d8c744b
Files
-
09c49dd68c2bdfa272a579fe712402e2b0a688ed8b999f7c3e0a28d86d8c744b.dll windows:5 windows x86 arch:x86
32d60154486fe930c9433aad3fbd3e96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
python33
PyObject_RichCompare
PyFloat_Type
_Py_FalseStruct
PyLong_Type
PyMethod_Type
PyList_Type
PyNumber_Add
PyNumber_InPlaceAdd
PyFloat_FromDouble
PyLong_FromLongLong
PyLong_FromLong
PyExc_UnboundLocalError
PyObject_GetItem
PyLong_FromSsize_t
PyErr_Clear
PyErr_ExceptionMatches
PyExc_OverflowError
PyTuple_Type
PyObject_SetItem
PyNumber_Subtract
PyNumber_InPlaceSubtract
PyExc_ImportError
PyImport_ImportModuleLevelObject
PyDict_New
PyModule_GetDict
PyList_New
PyObject_SetAttrString
PyType_Ready
PyExc_AttributeError
PyObject_GetAttrString
PyImport_AddModule
PyUnicode_FromString
PyUnicode_InternFromString
PyObject_GC_Track
_PyObject_GC_New
PyObject_Free
PyErr_NormalizeException
PyObject_ClearWeakRefs
PyObject_GC_UnTrack
PyMethod_New
PyUnicode_FromFormat
PyTuple_GetItem
PyTuple_GetSlice
PyType_Type
PyType_IsSubtype
PyExc_KeyError
PyObject_Not
_PyObject_GetDictPtr
PyMem_Realloc
PyMem_Malloc
PyTraceBack_Here
PyBaseObject_Type
PyErr_GivenExceptionMatches
PyErr_WarnEx
Py_GetVersion
PyOS_snprintf
PyObject_Hash
PyBytes_FromStringAndSize
PyUnicode_FromStringAndSize
PyUnicode_Decode
PyObject_IsTrue
PyNumber_Long
PyDict_Type
PyDict_SetItemString
PyDict_GetItemString
PyImport_GetModuleDict
PyModule_Create2
PyExc_StopIteration
_PyUnicode_Ready
PyUnicode_Type
PyObject_GetIter
PyObject_Size
PyNumber_TrueDivide
PyException_SetTraceback
PyDict_GetItem
PyExc_ValueError
PyFunction_Type
PyCFunction_Type
PyObject_Call
PyExc_SystemError
PyErr_SetString
PyDict_Size
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
PyTuple_New
PyEval_EvalCodeEx
_PyThreadState_Current
PyEval_EvalFrameEx
PyFrame_New
PyObject_SetAttr
PyDict_Next
PyUnicode_AsUnicode
PyUnicode_Compare
PyErr_Occurred
PyDict_SetItem
PyExc_TypeError
PyExc_NameError
PyErr_Format
PyObject_GetAttr
PyTuple_Pack
PyCode_New
_Py_NoneStruct
_Py_TrueStruct
PySequence_Contains
PyObject_GC_Del
PyList_Append
msvcr100
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
strchr
_except_handler4_common
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
IsDebuggerPresent
Exports
Exports
Sections
.text Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ