PyInit_libpynxlog
Static task
static1
Behavioral task
behavioral1
Sample
0cb5b7f86e158864d350f15673b62c80.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
0cb5b7f86e158864d350f15673b62c80.dll
Resource
win10v2004-20240704-en
General
-
Target
0cb5b7f86e158864d350f15673b62c80.exe
-
Size
1.1MB
-
MD5
0cb5b7f86e158864d350f15673b62c80
-
SHA1
d55c47bc1fa21ee469edbb21e0a462c2b9181dca
-
SHA256
ae7b41a3434e212f18847e58aaf7706f0696b8ef36cc2355e00c275d06180067
-
SHA512
57cf5c9ae10fbe629d585e052cca5cec45d70ee60050d5f50976e97c9eb56b3c1ec1a7830a3b11199475646fc401cf30c825da42300048ada6fa1a696cdcc792
-
SSDEEP
24576:zEAAMsJfjS4azvrxrwGHFc5sfr5cxCFthf28:WjS4a7rxrwGHFisfr5cUrX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cb5b7f86e158864d350f15673b62c80.exe
Files
-
0cb5b7f86e158864d350f15673b62c80.exe.dll windows:4 windows x64 arch:x64
e0156646cc40c32da8d78aa0fb868a63
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
libnx-0
nx_assertion_failed
nx_date_to_iso
nx_event_add
nx_event_new
nx_log
nx_module_add_record_input
nx_module_data_get
nx_module_data_set
nx_record_delete_field
nx_record_new
nx_record_set_boolean
nx_record_set_integer
nx_record_set_string
nx_value_to_string
nx_value_type_to_string
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strcmp
strlen
strncmp
vfprintf
libapr-1-0
apr_time_now
python38
PyArg_ParseTuple
PyBool_FromLong
PyBool_Type
PyBytes_AsString
PyCapsule_GetPointer
PyCapsule_New
PyEval_RestoreThread
PyEval_SaveThread
PyList_Append
PyList_New
PyLong_AsLong
PyLong_FromLong
PyMemoryView_FromMemory
PyModule_Create2
PyObject_Str
PyThreadState_Get
PyUnicode_AsEncodedString
PyUnicode_FromString
Py_BuildValue
_Py_Dealloc
_Py_FalseStruct
_Py_NoneStruct
_Py_TrueStruct
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 272B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 83B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/31 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/45 Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/57 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/70 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/81 Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/97 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/113 Size: 1011KB - Virtual size: 1010KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/126 Size: 1024B - Virtual size: 609B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ