fc9e440e14fe92af452877ba771be081a67c67d1982ec89bb873b90d7f02afb4

Sharing

Copy URL Twitter E-mail

General

Target

fc9e440e14fe92af452877ba771be081a67c67d1982ec89bb873b90d7f02afb4
Size

214KB
MD5

57f006647a97bc0a53458b9462e9b938
SHA1

9105625717a31b372dd81a19102f0f815c3de8bf
SHA256

fc9e440e14fe92af452877ba771be081a67c67d1982ec89bb873b90d7f02afb4
SHA512

8535810ce0bf35a124c565c77122d72b8e6b8d5d72c0d92ddd8b413acdf1026f3089ce401ae08949126abf23168140eff754ce20ee3349f8b0bbf139ef331e7d
SSDEEP

6144:dreO5WBfaBXaBk5f4g7BzsJFCX7sEQZEa:ZeO5TBu8zsJFcy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc9e440e14fe92af452877ba771be081a67c67d1982ec89bb873b90d7f02afb4

Files

fc9e440e14fe92af452877ba771be081a67c67d1982ec89bb873b90d7f02afb4
.dll windows:6 windows x86 arch:x86

b956a0dee1981e8b6b1638634ca2ab51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\dulwich\dulwich\target\i686-pc-windows-msvc\release\deps\pack_py.pdb

Imports

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
UnhandledExceptionFilter
GetEnvironmentVariableW
GetCurrentDirectoryW
SetLastError
ReleaseMutex
RtlCaptureContext
GetStdHandle
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
HeapFree
AcquireSRWLockExclusive
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetProcessHeap
HeapAlloc
WaitForSingleObject
GetConsoleMode
GetLastError
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
CloseHandle
GetProcAddress
GetModuleHandleA
Sleep
TlsSetValue
ReleaseSRWLockShared
TlsGetValue
IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError
NtWriteFile

python39

PySequence_Size
PyUnicode_FromStringAndSize
PyUnicode_InternInPlace
PyUnicode_AsUTF8AndSize
PyException_GetCause
PyErr_Restore
PyErr_WriteUnraisable
Py_IsInitialized
PyGILState_Ensure
PyGILState_Release
PyExc_OverflowError
PyBytes_FromStringAndSize
PyLong_FromLong
PyExc_ValueError
PyLong_AsLong
PyObject_Str
PyException_GetTraceback
PyErr_NormalizeException
PyErr_SetString
PyErr_Fetch
PyErr_SetObject
PyModule_GetNameObject
PyCMethod_New
PyImport_Import
PyExc_UnicodeDecodeError
PyException_SetTraceback
PyErr_PrintEx
PyErr_NewExceptionWithDoc
PyException_SetCause
PyErr_Print
PyTuple_New
PyObject_GetIter
PyIter_Next
PyList_Append
PyBytes_AsString
PyBytes_Size
PyObject_Repr
PyExc_AttributeError
PyErr_GivenExceptionMatches
PyObject_GetAttr
PyObject_SetAttr
PyObject_Call
PyUnicode_AsEncodedString
PyExc_ImportError
PyInterpreterState_Get
PyInterpreterState_GetID
PyExc_BaseException
PyModule_Create2
PyExc_SystemError
PyExc_TypeError
PySequence_Check
PyList_New
_Py_NoneStruct
_Py_Dealloc
PyNumber_Index

vcruntime140

memcpy
memcmp
__CxxFrameHandler3
_except_handler4_common
memset
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm_e

api-ms-win-crt-heap-l1-1-0

free

Exports

Exports

PyInit__pack

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b956a0dee1981e8b6b1638634ca2ab51

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

python39

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 163KB - Virtual size: 162KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 163KB - Virtual size: 162KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB