initumath
Static task
static1
Behavioral task
behavioral1
Sample
4bd7686f8138d782f9a1ff1dd4810126cf2edc0039c0328f571bbd4182471311.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4bd7686f8138d782f9a1ff1dd4810126cf2edc0039c0328f571bbd4182471311.dll
Resource
win10v2004-20240508-en
General
-
Target
4bd7686f8138d782f9a1ff1dd4810126cf2edc0039c0328f571bbd4182471311
-
Size
403KB
-
MD5
0dee061da9f16129ac9070375e3e316c
-
SHA1
3e2c31804c0c0ffdb9d738222af4bfa363df812f
-
SHA256
4bd7686f8138d782f9a1ff1dd4810126cf2edc0039c0328f571bbd4182471311
-
SHA512
36a43ff630b94901997aadb5b12e7336eb3918cb58ec9e8803a31fe090314178a2feedd630ddd129db26791adef243708d5d3898a8494634a5568656fc152872
-
SSDEEP
6144:iTZ3HW66AGhpBfEBwVvzKvAwITBq5RTmkbqJ+1CVhE+bq3jfQ/2GYQCpHMAmybLO:cHW63Ghp5z6B2X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bd7686f8138d782f9a1ff1dd4810126cf2edc0039c0328f571bbd4182471311
Files
-
4bd7686f8138d782f9a1ff1dd4810126cf2edc0039c0328f571bbd4182471311.dll windows:4 windows x86 arch:x86
468da7f8efc52cbe7c920bd82c977220
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddAtomA
FindAtomA
GetAtomNameA
msvcrt
_cabs
_hypot
_nextafter
_assert
abort
memset
msvcr71
__dllonexit
_errno
_hypot
_iob
acos
asin
atan
ceil
cos
cosh
exp
fflush
floor
fmod
fprintf
free
frexp
ldexp
log
log10
malloc
memcpy
memmove
modf
pow
sin
sinh
sprintf
sqrt
strcpy
strlen
tan
tanh
python25
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
PyBool_Type
PyCObject_AsVoidPtr
PyCObject_FromVoidPtr
PyCObject_Type
PyCallable_Check
PyComplex_Type
PyDict_GetItem
PyDict_GetItemString
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Format
PyErr_NoMemory
PyErr_Occurred
PyErr_SetObject
PyErr_SetString
PyErr_WarnEx
PyEval_CallObjectWithKeywords
PyEval_GetBuiltins
PyEval_RestoreThread
PyEval_SaveThread
PyExc_AttributeError
PyExc_FloatingPointError
PyExc_ImportError
PyExc_IndexError
PyExc_NameError
PyExc_RuntimeError
PyExc_RuntimeWarning
PyExc_TypeError
PyExc_ValueError
PyFloat_FromDouble
PyFloat_Type
PyGILState_Ensure
PyGILState_Release
PyImport_ImportModule
PyInt_AsLong
PyInt_FromLong
PyInt_Type
PyList_New
PyList_Type
PyLong_FromLongLong
PyLong_Type
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyModule_GetDict
PyNumber_Absolute
PyNumber_Add
PyNumber_And
PyNumber_Divide
PyNumber_FloorDivide
PyNumber_Invert
PyNumber_Lshift
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_TrueDivide
PyNumber_Xor
PyOS_snprintf
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CallObject
PyObject_Cmp
PyObject_Compare
PyObject_GetAttrString
PyObject_HasAttrString
PyObject_Init
PyObject_IsTrue
PyObject_Not
PyObject_Repr
PyObject_RichCompareBool
PySequence_GetItem
PySequence_Size
PyString_AsStringAndSize
PyString_ConcatAndDel
PyString_FromFormat
PyString_FromString
PyString_FromStringAndSize
PyString_InternFromString
PyString_Type
PyThreadState_GetDict
PyTuple_New
PyTuple_Size
PyTuple_Type
PyType_IsSubtype
PyType_Ready
PyUnicodeUCS2_AsASCIIString
PyUnicode_Type
Py_BuildValue
Py_InitModule4
_Py_NoneStruct
_Py_NotImplementedStruct
_Py_TrueStruct
_Py_ZeroStruct
Exports
Exports
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 70B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ