PyInit_cygrpc
Static task
static1
Behavioral task
behavioral1
Sample
a3d75df083addb7ff31af32fa6906f43ec3ce949044b56ac657a5ced0ea21683.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3d75df083addb7ff31af32fa6906f43ec3ce949044b56ac657a5ced0ea21683.dll
Resource
win10v2004-20240508-en
General
-
Target
a3d75df083addb7ff31af32fa6906f43ec3ce949044b56ac657a5ced0ea21683
-
Size
5.4MB
-
MD5
351881d52393461060800892f77abfe9
-
SHA1
966e22e28f328e009ed0fc5ed936af4be1a6b239
-
SHA256
a3d75df083addb7ff31af32fa6906f43ec3ce949044b56ac657a5ced0ea21683
-
SHA512
1192561023c631fdedd90c79260b2f41b2573f728e92a7f5c4c18a1a82c3a62e7809daa5f54b4c7b37b884cafaf852976ab0a7aa47e3f4319b8520f4e4c25b7a
-
SSDEEP
49152:f2jxUIwDKrQwSIphoqSDh5vdMTbDsrGtrcwElpa+OipDVFQfgxhzUgc1t/ArfThz:u/8Iendm4rJa+TFVFgYzHc1Srfa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3d75df083addb7ff31af32fa6906f43ec3ce949044b56ac657a5ced0ea21683
Files
-
a3d75df083addb7ff31af32fa6906f43ec3ce949044b56ac657a5ced0ea21683.dll windows:6 windows x86 arch:x86
58ac54c8edf120faebbfcce04859390d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
SystemFunction036
RegGetValueA
ws2_32
getsockname
listen
closesocket
bind
WSAGetLastError
WSAGetOverlappedResult
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
inet_ntop
ntohs
inet_pton
socket
WSAIoctl
setsockopt
getpeername
WSARecv
WSASend
send
connect
recv
shutdown
ioctlsocket
getsockopt
htonl
WSASocketA
htons
dbghelp
SymFromAddr
python39
PyUnicode_DecodeLatin1
PyObject_GetItem
PyObject_CallObject
PyEval_InitThreads
PyErr_CheckSignals
PyModuleDef_Init
PyObject_GC_Track
PyBytes_FromStringAndSize
PyObject_ClearWeakRefs
PyDict_DelItem
PyNumber_Long
PyUnicode_Compare
PyExc_StopAsyncIteration
_Py_NewReference
PyObject_IsSubclass
PyExc_TypeError
PyMem_Realloc
_PyObject_NextNotImplemented
PyObject_IsTrue
PyExc_NameError
PyTuple_Pack
_PyByteArray_empty_string
Py_OptimizeFlag
_PyUnicode_Ready
PyMem_Malloc
PyExc_IndexError
Py_EnterRecursiveCall
PyExc_ImportError
PyGen_Type
_Py_TrueStruct
PyArg_UnpackTuple
PyExc_SystemError
_PyUnicode_FastCopyCharacters
PyExc_AssertionError
PyObject_SetItem
_PyObject_GC_New
PyType_Modified
PyTraceBack_Type
PyMethodDescr_Type
PyExc_GeneratorExit
_PyList_Extend
PyEval_EvalFrameEx
PyUnicode_FromString
PyLong_FromSize_t
_PyType_Lookup
PyUnicode_Format
PyObject_Size
PyObject_Call
PyByteArray_Type
PyNumber_InPlaceSubtract
PyType_Type
PySequence_Tuple
PyEval_RestoreThread
PySet_Discard
PyUnicode_FromStringAndSize
_PyObject_GetDictPtr
PyFrozenSet_New
PyLong_AsLong
PyObject_CallFunctionObjArgs
PyErr_Fetch
PyObject_GC_Del
PyModule_AddObject
_PyErr_FormatFromCause
PyErr_ExceptionMatches
PyObject_Free
PySequence_GetSlice
PyObject_Format
PyModule_GetDict
PyImport_GetModuleDict
PyTuple_GetItem
_Py_Dealloc
PyExc_OverflowError
PyErr_Restore
PyNumber_Subtract
PyType_IsSubtype
PyLong_Type
PyMethod_Type
PyModule_NewObject
PyFloat_Type
PyNumber_InPlaceAdd
PyCoro_Type
_Py_FalseStruct
PyTuple_Type
PyObject_RichCompare
PyExc_StopIteration
PyDict_GetItemString
PyDict_Next
PyLong_FromUnsignedLong
PyExc_ValueError
PyEval_EvalCodeEx
PyErr_WarnFormat
PyNumber_Add
PyObject_GetIter
PyErr_WriteUnraisable
PyIter_Next
_PyBytes_Join
PyErr_SetString
PyNumber_Multiply
PySet_Size
PyUnicode_New
PyTuple_GetSlice
PyExc_AttributeError
PySet_Add
PyFloat_FromDouble
PyFrame_Type
PyLong_FromLongLong
PyDict_Size
PyDict_SetItemString
PySequence_Contains
PyTuple_New
_Py_NoneStruct
PyBytes_AsStringAndSize
PyGILState_Release
PyRun_StringFlags
PyBytes_FromString
PyFloat_AsDouble
PySet_Clear
PyDict_Contains
PyObject_GetAttr
Py_GetVersion
PyInterpreterState_GetID
PyDict_GetItemWithError
PyErr_SetNone
PyExc_UnboundLocalError
PyObject_Hash
PyObject_GC_UnTrack
PyLong_FromLong
PyObject_SetAttrString
PyMethod_New
PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyEval_SaveThread
PyTraceBack_Here
PyObject_GenericGetAttr
PyNumber_Remainder
PyUnicode_DecodeUTF8
PyLong_FromSsize_t
PyType_GetFlags
PyErr_Occurred
PyObject_SelfIter
PyErr_NormalizeException
PyImport_ImportModuleLevelObject
PyImport_ImportModule
Py_LeaveRecursiveCall
PyExc_KeyError
_PyDict_SetItem_KnownHash
PyExc_DeprecationWarning
PyLong_AsSsize_t
PyFrame_New
PyFunction_Type
PyErr_PrintEx
PyExc_RuntimeWarning
PyErr_WarnEx
PyLong_AsUnsignedLong
_PyObject_CallFunction_SizeT
PyNumber_Index
PyErr_GivenExceptionMatches
PyErr_SetObject
PyExc_Exception
PyThreadState_Get
PyOS_snprintf
PyCFunction_Type
PyUnicode_InternFromString
PyObject_SetAttr
PyBaseObject_Type
PyNumber_InPlaceOr
PySequence_List
PyFrozenSet_Type
PyDict_GetItem
PyList_Type
_PySet_NextEntry
PyErr_Format
PyCMethod_New
PyObject_IsInstance
_PyDict_GetItem_KnownHash
PyObject_CallFinalizerFromDealloc
PyUnicode_Type
PyDict_New
PyDict_SetItem
PySet_Type
_PyObject_GenericGetAttrWithDict
PyCapsule_New
PyException_SetTraceback
PyCode_New
PyLong_AsDouble
PyUnicode_Decode
PyObject_RichCompareBool
PyBytes_Type
PyList_Append
PyErr_Clear
PyNumber_InPlaceAnd
_PyDict_Pop
_PyGen_Send
PyObject_GetAttrString
PyType_Ready
PyImport_AddModule
PyObject_GC_IsFinalized
PySlice_New
PyList_New
PySet_New
PyUnicode_FromFormat
PyDict_Type
PyObject_Not
PyGILState_Ensure
kernel32
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetEndOfFile
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetStdHandle
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
WriteFile
ReadFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
GetTimeZoneInformation
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
MultiByteToWideChar
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
TlsFree
CreateEventW
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
EncodePointer
WideCharToMultiByte
FormatMessageW
GetNativeSystemInfo
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
AcquireSRWLockShared
ReleaseSRWLockShared
TlsAlloc
SetLastError
TlsSetValue
InitOnceExecuteOnce
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
InitializeSRWLock
GetLastError
GetCurrentProcess
GetProcAddress
GetModuleHandleA
VirtualAlloc
VirtualFree
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateEventA
CreateThread
CloseHandle
SetEvent
WaitForSingleObject
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
FormatMessageA
LocalFree
GetCurrentThreadId
GetEnvironmentVariableA
GetCurrentProcessorNumber
GetSystemInfo
Exports
Exports
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 238KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 226KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ