4a2925da311e183aad05b5dab1757d8f139cd4b09f915ad56bc448a6a25ed420

Sharing

Copy URL Twitter E-mail

General

Target

4a2925da311e183aad05b5dab1757d8f139cd4b09f915ad56bc448a6a25ed420
Size

28KB
MD5

d0c5c4d6e911c2c47dfd243f8800e143
SHA1

ddc8fd7e23752df81ce06d5d9bdaaa469c9d5237
SHA256

4a2925da311e183aad05b5dab1757d8f139cd4b09f915ad56bc448a6a25ed420
SHA512

6b108e73196c62c6fd90ca0043d35d69367cc37ace58b0445a26fe6fc9387de2ff33a172c7660a12f0b91166e86e5e67b4a65d3172ce2f5a0277614b3233f7a0
SSDEEP

384:yXaXbLja+jx3TXksdCRh57WcRLUGHnuI+GjC37usOo8Vd6IHiPKDkAKB5F0cKQ9g:yK7i7WcRLUGHnwahoICS4AI6Q58

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a2925da311e183aad05b5dab1757d8f139cd4b09f915ad56bc448a6a25ed420

Files

4a2925da311e183aad05b5dab1757d8f139cd4b09f915ad56bc448a6a25ed420
.dll windows:6 windows x86 arch:x86

897c96b8e22bba95ec1e53664856ecf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\code\kodi-deps\Build\win10-win32\pycryptodome-prefix\src\pycryptodome-build\RelWithDebInfo\_raw_aes.pdb

Imports

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

vcruntime140_app

__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

free
calloc

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_seh_filter_dll

Exports

Exports

AES_start_operation
AES_stop_operation
PyInit__raw_aes

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

897c96b8e22bba95ec1e53664856ecf1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

vcruntime140_app

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 920B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 920B

.reloc
Size: 1KB - Virtual size: 1KB