77b923c0db9653f03bd2217265db2aa996ff2993b0869ccfbe15c6e20780522b

Sharing

Copy URL Twitter E-mail

General

Target

77b923c0db9653f03bd2217265db2aa996ff2993b0869ccfbe15c6e20780522b
Size

57KB
MD5

55abe91ac010389d273e74c229466f64
SHA1

dc65c91173bad0502451e05b6253ff58f3f67a92
SHA256

77b923c0db9653f03bd2217265db2aa996ff2993b0869ccfbe15c6e20780522b
SHA512

dd7ee43883b462aa303dd741616c69dc6408e0735d53e724d3202bee9320f76476420ec2dea4c4f5e7d53d59b78ab132d9f3b78d2fff0d30663a9226306c2773
SSDEEP

768:doQh1N9E4vkk/wZJI0izlPc+UGWooqcqP8j7K0aapoPue/iP/cpDitnHebj2k:djLkkI8hlV/UKNzuhP/cpMs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77b923c0db9653f03bd2217265db2aa996ff2993b0869ccfbe15c6e20780522b

Files

77b923c0db9653f03bd2217265db2aa996ff2993b0869ccfbe15c6e20780522b
.dll windows:6 windows x64 arch:x64

c06318b45b7b533c60e368409fdc6734

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python38

PyModule_GetName
PyModuleDef_Init
PyCapsule_GetPointer
PyCapsule_GetName
PyCapsule_IsValid
PyTraceBack_Here
PyInterpreterState_GetID
PyThreadState_Get
PyGILState_Ensure
PyGILState_Release
_PyThreadState_UncheckedGet
PyErr_WarnEx
PyErr_WarnFormat
PyErr_SetObject
PyErr_SetString
PyErr_Occurred
PyErr_Clear
PyErr_GivenExceptionMatches
PyModule_GetDict
PyException_SetCause
PyErr_Format
PyOS_snprintf
PyCode_New
Py_GetVersion
_Py_CheckRecursiveCall
PyEval_EvalFrameEx
PyEval_SaveThread
PyEval_RestoreThread
PyImport_GetModuleDict
PyImport_AddModule
PyImport_ImportModule
PyObject_Call
PyObject_CallObject
PyObject_GetItem
PyObject_IsSubclass
PyEval_EvalCodeEx
PyFrame_New
PyExc_NotImplementedError
PyModule_NewObject
PyCFunction_NewEx
_PyDict_GetItem_KnownHash
PyDict_SetItemString
PyDict_GetItemString
PyDict_Size
PyDict_Next
PyDict_DelItem
PyDict_SetItem
PyDict_New
PyTuple_Pack
PyTuple_New
PyLong_AsLong
PyLong_FromLong
PyUnicode_Compare
_PyUnicode_Ready
PyUnicode_Decode
PyUnicode_InternFromString
PyUnicode_FromFormat
PyUnicode_FromString
PyUnicode_FromStringAndSize
PyBytes_FromStringAndSize
_PyObject_GenericGetAttrWithDict
PyObject_CallFinalizerFromDealloc
_PyObject_GetDictPtr
_PyType_Lookup
_Py_Dealloc
PyObject_Not
PyObject_IsTrue
PyObject_Hash
PyObject_GenericGetAttr
PyObject_SetAttr
PyObject_GetAttr
PyObject_SetAttrString
PyObject_GetAttrString
PyObject_RichCompareBool
PyObject_RichCompare
PyType_Modified
PyType_Ready
PyMem_Realloc
PyMem_Malloc
_Py_CheckRecursionLimit
PyExc_DeprecationWarning
PyExc_ValueError
PyExc_SystemError
PyExc_TypeError
PyExc_RuntimeError
PyExc_NameError
PyExc_ImportError
PyExc_AttributeError
PyTraceBack_Type
PyMethod_Type
PyFunction_Type
PyCFunction_Type
_Py_TrueStruct
_Py_FalseStruct
PyLong_Type
PyUnicode_Type
_Py_NoneStruct
PyBaseObject_Type
PyErr_ExceptionMatches
PyFrame_Type

arrow

??1ParseOptions@json@arrow@@QEAA@XZ
??1Status@arrow@@QEAA@XZ
?Make@TableReader@json@arrow@@SA?AV?$Result@V?$shared_ptr@VTableReader@json@arrow@@@std@@@3@PEAVMemoryPool@3@V?$shared_ptr@VInputStream@io@arrow@@@std@@AEBUReadOptions@23@AEBUParseOptions@23@@Z
??0ReadOptions@json@arrow@@QEAA@XZ
?Defaults@ReadOptions@json@arrow@@SA?AU123@XZ
??4ParseOptions@json@arrow@@QEAAAEAU012@$$QEAU012@@Z
??4ParseOptions@json@arrow@@QEAAAEAU012@AEBU012@@Z
??0Status@arrow@@QEAA@XZ
??0ParseOptions@json@arrow@@QEAA@XZ
?Defaults@ParseOptions@json@arrow@@SA?AU123@XZ
?CopyFrom@Status@arrow@@AEAAXAEBV12@@Z
??4Status@arrow@@QEAAAEAV01@$$QEAV01@@Z

arrow_python

?check_status@internal@py@arrow@@YAHAEBVStatus@3@@Z

vcruntime140

__std_terminate
__CxxFrameHandler3
memcmp
__C_specific_handler
memset
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

PyInit__json

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c06318b45b7b533c60e368409fdc6734

Headers

DLL Characteristics

File Characteristics

Imports

python38

arrow

arrow_python

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 7KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 352B

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 7KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 352B