4e598f503253ad684fe9686215f88bf64f0e4eba193e26db6d99bea5e4b68453

Sharing

Copy URL

Twitter E-mail

General

Target

4e598f503253ad684fe9686215f88bf64f0e4eba193e26db6d99bea5e4b68453
Size

90KB
MD5

f22ef3db748d6218784372be6f9b7a5c
SHA1

002a4cfa3ce54dff2c62cf04aa80d3104f6ab862
SHA256

4e598f503253ad684fe9686215f88bf64f0e4eba193e26db6d99bea5e4b68453
SHA512

7d018780a31918e00da9862e193cbcb8ae1eb43c0c40dbe8ce2099f4825986cfa758fad8c5281ca53d50e6c0965b1e152fe67b62b3c0bb157ca9f2f8f926e3b1
SSDEEP

1536:6r1TfDXW4Y83kD1M7XStYUqMuz56cwxxKEYfRn9A9kGQBUOQBTY7bi0xjCKmNfFa:uJ3S1M+tYU06cwxxKEYflBUfY7bi0tSa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e598f503253ad684fe9686215f88bf64f0e4eba193e26db6d99bea5e4b68453

Files

4e598f503253ad684fe9686215f88bf64f0e4eba193e26db6d99bea5e4b68453
.dll windows:5 windows x86 arch:x86

65d2f170b5141415ae2f3c82705ce2ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\glyph\pywin32-219\build\temp.win32-2.7\Release\pywintypes.pdb

Imports

advapi32

InitializeAcl
IsValidAcl
AddAce
GetAce
GetExplicitEntriesFromAclW
GetLengthSid
AddAuditAccessAce
DeleteAce
SetEntriesInAclW
GetEffectiveRightsFromAclW
GetAuditedPermissionsFromAclW
RegCloseKey
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetAclInformation
GetSecurityDescriptorControl
MakeSelfRelativeSD
GetSecurityDescriptorLength
IsValidSecurityDescriptor
MakeAbsoluteSD
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
IsValidSid
InitializeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
CopySid
EqualSid
AllocateAndInitializeSid
IsTextUnicode

user32

wsprintfA
wsprintfW

ole32

CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CLSIDFromString

oleaut32

SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
SysStringLen

python27

PyEval_AcquireThread
PyEval_ReleaseThread
PyThreadState_Delete
PyThreadState_Clear
PyErr_SetObject
PyUnicode_DecodeMBCS
PyLong_FromUnsignedLong
PyLong_AsUnsignedLong
PyObject_AsWriteBuffer
PyDict_GetItemString
PyRun_StringFlags
PyImport_ImportModule
PyExc_Exception
PyEval_InitThreads
PyUnicode_Type
PyModule_AddIntConstant
PyModule_GetDict
Py_InitModule4
PyObject_CallObject
PyCallable_Check
PyInt_AsUnsignedLongMask
PyDict_SetItemString
PyInt_AsLong
PyFloat_FromDouble
PyObject_HasAttrString
PySequence_Tuple
PyErr_NoMemory
PyBool_FromLong
PyString_AsString
PyLong_FromUnsignedLongLong
PyLong_FromLongLong
PyLong_AsUnsignedLongLong
PyErr_Occurred
PyLong_AsLongLong
PyExc_PendingDeprecationWarning
PyErr_WarnEx
PyObject_CheckReadBuffer
PyObject_AsReadBuffer
PyUnicodeUCS2_AsWideChar
PyObject_GenericSetAttr
PyErr_Fetch
PyThreadState_New
PyObject_Print
_Py_HashPointer
_Py_TrueStruct
_Py_NotImplementedStruct
_Py_ZeroStruct
PyEval_SaveThread
PyEval_RestoreThread
PyExc_WindowsError
PyExc_AttributeError
PyString_AsStringAndSize
PyString_FromString
PyString_FromStringAndSize
PyType_Type
PyObject_GenericGetAttr
PySequence_Check
PyTuple_SetItem
Py_BuildValue
PyTuple_New
PyArg_ParseTupleAndKeywords
PyExc_ValueError
PyMapping_Check
PyObject_CallMethod
PyDict_New
PySequence_Size
PyTuple_GetItem
PySequence_GetItem
PyDict_SetItem
PyErr_Clear
PyObject_GetAttrString
PyExc_NotImplementedError
PyInt_FromLong
PyArg_ParseTuple
_Py_NoneStruct
PyExc_TypeError
PyErr_SetString
PyExc_MemoryError
PyErr_Format
PyUnicodeUCS2_FromWideChar
PyMem_Free
PyMem_Malloc
PyUnicode_EncodeMBCS
PyString_Size
PyEval_CallObjectWithKeywords
Py_FatalError
PyThreadState_Swap
Py_MakePendingCalls
PyList_New
PyList_Append
PyErr_Restore
PyUnicodeUCS2_AsUnicode
PyNumber_Check
PyExc_SystemError
PyType_Ready
PyErr_BadArgument

msvcr90

_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
?terminate@@YAXXZ
fprintf
__iob_func
strncpy
wcsncpy
strftime
_mktime64
_localtime64
__CxxFrameHandler3
_snwprintf
??2@YAPAXI@Z
malloc
free
memset
realloc
memcpy
??3@YAXPAX@Z
_strdup

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleA
LoadLibraryA
GetProcAddress
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
TlsFree
LeaveCriticalSection
EnterCriticalSection
DosDateTimeToFileTime
FormatMessageA
TlsGetValue
LocalAlloc
TlsSetValue
MultiByteToWideChar
GetDateFormatA
GetTimeFormatA
SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
SetLastError
lstrlenA
CloseHandle
GetLastError
LocalFree

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65d2f170b5141415ae2f3c82705ce2ed

Headers

File Characteristics

PDB Paths

Imports

advapi32

user32

ole32

oleaut32

python27

msvcr90

kernel32

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 6KB - Virtual size: 7KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 6KB - Virtual size: 7KB

.reloc
Size: 5KB - Virtual size: 5KB