7b2bff0897e0bf6263752ab0f437a46f1a05467eab80a7c22bfbf274a70df10d

Sharing

Copy URL Twitter E-mail

General

Target

7b2bff0897e0bf6263752ab0f437a46f1a05467eab80a7c22bfbf274a70df10d
Size

2.0MB
MD5

46f41b194c459bf0cf598d7eb8ef949d
SHA1

ce09546d5859ff87ac434ed8e703f8bf2fc43f00
SHA256

7b2bff0897e0bf6263752ab0f437a46f1a05467eab80a7c22bfbf274a70df10d
SHA512

19ed0c10c49f8fd8b1ae0e5e2d9f5cc5b782bf33f07a90464ac56024465d0c7f3359e222aa4d53d59bbcad2cadda0e79777a08975c215b8ad88bbb05c9e32451
SSDEEP

49152:365DttjVyW1hjqhriK3a3yz1q3l/bQ7q:3rg0ril/k7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b2bff0897e0bf6263752ab0f437a46f1a05467eab80a7c22bfbf274a70df10d

Files

7b2bff0897e0bf6263752ab0f437a46f1a05467eab80a7c22bfbf274a70df10d
.dll windows:6 windows x64 arch:x64

e18ea143931ceaf5aca005f37e1334a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

drives_mapper.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

kernel32

GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
IsDebuggerPresent
InitializeSListHead
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetDiskFreeSpaceA
DisableThreadLibraryCalls
SetFileInformationByHandle
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
GetStdHandle
HeapReAlloc
GetSystemInfo
TerminateProcess
QueryPerformanceFrequency
LoadLibraryW
lstrlenW
ReleaseMutex
FindNextFileW
FindClose
GetFileInformationByHandleEx
HeapAlloc
HeapCompact
FindFirstFileW
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
GetModuleHandleW
WriteConsoleW
CreateThread
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
CreateMutexA
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetConsoleMode
GetFileInformationByHandle
GetProcAddress
GetModuleHandleA
Sleep
CloseHandle
FormatMessageW

ntdll

RtlNtStatusToDosError
NtWriteFile

python312

PyUnicode_AsEncodedString
PyBytes_AsString
PyBytes_Size
PyObject_Repr
PyObject_Str
Py_IsInitialized
PyGILState_Ensure
PyGILState_Release
_Py_Dealloc
PyList_New
PyNumber_Index
PyExc_TypeError
PyCMethod_New
PyExc_AttributeError
PyErr_GivenExceptionMatches
PyModule_GetName
PyLong_AsUnsignedLongLong
PyException_GetCause
PyObject_SetAttrString
PyObject_GetAttr
PyLong_FromSsize_t
PyErr_Fetch
PyErr_PrintEx
PyErr_NewExceptionWithDoc
PyException_SetCause
PyErr_NormalizeException
PyErr_Print
PyModule_Create2
PyObject_GenericGetDict
PyObject_GenericSetDict
PyType_FromSpec
PyObject_GetItem
PyObject_SetItem
PyObject_DelItem
PyExc_RuntimeError
PyExc_ImportError
PyExc_ValueError
PyExc_BaseException
PyTuple_SetItem
PyTuple_New
PyUnicode_FromStringAndSize
PyExc_IOError
PyExc_SystemError
PyUnicode_AsUTF8AndSize
PyList_Append
PyObject_SetAttr
PyErr_WriteUnraisable
PyBaseObject_Type
_Py_NoneStruct
PyErr_Restore
PyType_IsSubtype
PyUnicode_InternInPlace

vcruntime140

memset
__std_type_info_destroy_list
__CxxFrameHandler3
_CxxThrowException
memcpy
memmove
memcmp
strchr
strrchr
__C_specific_handler
memchr

api-ms-win-crt-string-l1-1-0

strlen
strspn
strcmp
strcspn
strncmp

api-ms-win-crt-heap-l1-1-0

realloc
free
malloc
_msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_cexit
_beginthreadex
_endthreadex
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

log

Exports

Exports

PyInit_drives_mapper

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 282KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e18ea143931ceaf5aca005f37e1334a1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

python312

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 282KB - Virtual size: 281KB

.data Size: 23KB - Virtual size: 25KB

.pdata Size: 76KB - Virtual size: 76KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 282KB - Virtual size: 281KB

.data
Size: 23KB - Virtual size: 25KB

.pdata
Size: 76KB - Virtual size: 76KB

.reloc
Size: 6KB - Virtual size: 5KB