099ab61349cf7a5eb76dfa13c0c74ed0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

099ab61349cf7a5eb76dfa13c0c74ed0N.exe
Size

148KB
MD5

099ab61349cf7a5eb76dfa13c0c74ed0
SHA1

6664f4d8e3d2a40dfa3b9046b44eea5d2895c298
SHA256

7c3380d03180a7c7de61db69b6cd6731bcba91ba1d50ba7817bcc7365affe8ed
SHA512

a612eae572ac76de89f3f17cd915679efe547ede270d418f3f8ab9b59a6411fb9284ab29b49e4f0b065d18ad2311513f7c6f0bfd36767ee281c22f77f59c3e5f
SSDEEP

3072:ILrxIbJ1wk8jxK2CHX+ZqPL6WY4RRDZJI54ob1uoWTBfCrxigOZNKD:SidMj42CHX+ZqPxDwK4/WTBqrggOZNa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
099ab61349cf7a5eb76dfa13c0c74ed0N.exe

Files

099ab61349cf7a5eb76dfa13c0c74ed0N.exe
.dll windows:5 windows x86 arch:x86

7f18766c16dc23167c2299724b1b3c86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcp100

?_Xlength_error@std@@YAXPBD@Z

python34

PyLong_FromLong
PyDict_SetItemString
PyArg_ParseTupleAndKeywords
PyBytes_FromStringAndSize
_PyBytes_Resize
PyErr_Clear
PyCallable_Check
PyExc_TypeError
_Py_NoneStruct
PyExc_ValueError
PyModule_Create2
PyErr_Print
PyModule_AddIntConstant
PyBytes_AsStringAndSize
PyEval_GetBuiltins
PyDict_GetItemString
PyObject_CallFunction
PyObject_CallMethod
PyObject_AsFileDescriptor
PyNumber_AsSsize_t
PyExc_IOError
PyExc_OverflowError
PyErr_Occurred
PyImport_ImportModule
PyExc_ImportError
PyErr_SetString
PyObject_GetAttrString
PyExc_AttributeError
PyCapsule_Type
PyExc_RuntimeError
PyCapsule_GetPointer
PyErr_Format

msvcr100

_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
fseek
fclose
ftell
_fdopen
memcpy
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove
__CxxFrameHandler3
??_V@YAXPAX@Z
longjmp
fread
_setjmp3
memset
free
floor
_CIpow
fprintf
__iob_func
fflush
fwrite
malloc
_malloc_crt
_encoded_null
_lseek

kernel32

GetCurrentProcessId
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
ExitProcess
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer

Exports

Exports

PyInit__png

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f18766c16dc23167c2299724b1b3c86

Headers

DLL Characteristics

File Characteristics

Imports

msvcp100

python34

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 110KB - Virtual size: 109KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 110KB - Virtual size: 109KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB