b7eec143315d4304c8b65c93a793c0757a578a65bc431e635447ae132df9b7ce

Sharing

Copy URL Twitter E-mail

General

Target

b7eec143315d4304c8b65c93a793c0757a578a65bc431e635447ae132df9b7ce
Size

585KB
MD5

15cf1ac8e97028b18d88cad3d02fe216
SHA1

3747c4e8c3c96a7c5534d3f38ff451e089274b59
SHA256

b7eec143315d4304c8b65c93a793c0757a578a65bc431e635447ae132df9b7ce
SHA512

8576ade09b7b4791aee0453b5012386db09b869879d51c4516a67f22291e900c8961303f98330abcb929d8869e32a94d0d9dfc7706637d0f948a742277e1251a
SSDEEP

12288:EjSyR4y4ZYvvoI2Jlyk4VoOVIkNXtl2yPlfiSkvmBXJAhFigiT1B7i:YRuuoOfNXTPFiSkvEJAyT1Vi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7eec143315d4304c8b65c93a793c0757a578a65bc431e635447ae132df9b7ce

Files

b7eec143315d4304c8b65c93a793c0757a578a65bc431e635447ae132df9b7ce
.dll windows:6 windows x86 arch:x86

6898f214edd6414866393e40879023b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\code\kodi-deps\Build\win10-win32\pillow-prefix\src\pillow-build\RelWithDebInfo\_imaging.pdb

Imports

python3.8

PyDict_New
PyList_SetItem
PyList_New
PyTuple_New
PyFloat_AsDouble
PyFloat_FromDouble
PyBool_FromLong
PyLong_AsLongLong
PyLong_AsLong
PyLong_FromSsize_t
PyLong_FromLong
PyUnicode_AsLatin1String
PyNumber_AsSsize_t
PyBytes_AsStringAndSize
PyBytes_AsString
PyBytes_FromStringAndSize
_PyObject_New
PyObject_Free
PyObject_Print
_Py_Dealloc
PyType_Ready
PyType_IsSubtype
_Py_NoneStruct
PyExc_ValueError
PyExc_TypeError
PyErr_Occurred
PySequence_GetItem
PyNumber_Check
PyObject_CallFunction
PyDict_SetItemString
PySlice_AdjustIndices
PyErr_Clear
PySlice_Unpack
PySlice_Type
PyErr_NoMemory
PyExc_MemoryError
PyErr_Format
PyErr_SetFromErrno
_PyErr_BadInternalCall
PyModule_GetDict
_PyBytes_Resize
PyExc_SystemError
Py_BuildValue
PyArg_ParseTuple
PyCapsule_New
_PyArg_ParseTuple_SizeT
_Py_BuildValue_SizeT
PyModule_AddObject
_Py_NotImplementedStruct
PyExc_IOError
_Py_TrueStruct
PyUnicode_Type
PyBuffer_Release
PyObject_GetBuffer
PySequence_Fast
PySequence_Size
PySequence_Check
PyObject_Size
PyEval_RestoreThread
PyEval_SaveThread
PyExc_IndexError
PyErr_ExceptionMatches
PyObject_CallMethod
PyLong_AsSsize_t
PyErr_SetString
PyModule_Create2
PyUnicode_FromString
PyModule_AddIntConstant
PyFloat_Type

api-ms-win-core-file-l1-1-0

GetFileSizeEx

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile

api-ms-win-core-memory-l1-1-1

CreateFileMappingFromApp
MapViewOfFileFromApp

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

vcruntime140_app

memcpy
longjmp
_setjmp3
_except_handler4_common
__std_type_info_destroy_list
memmove
memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsprintf
_write
__stdio_common_vsscanf
fwrite
fopen
fclose
__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

strncpy
strncmp

api-ms-win-crt-heap-l1-1-0

realloc
free
malloc
calloc

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise
_CIfmod
_libm_sse2_sqrt_precise
floor
modf
_libm_sse2_cos_precise
_libm_sse2_sin_precise
ceil

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
exit
_execute_onexit_table
_cexit
_initterm

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

PyInit__imaging
round

Sections

.text
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6898f214edd6414866393e40879023b0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

python3.8

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-interlocked-l1-1-0

vcruntime140_app

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 384KB - Virtual size: 383KB

.rdata Size: 167KB - Virtual size: 167KB

.data Size: 21KB - Virtual size: 22KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 384KB - Virtual size: 383KB

.rdata
Size: 167KB - Virtual size: 167KB

.data
Size: 21KB - Virtual size: 22KB

.reloc
Size: 11KB - Virtual size: 10KB