PyInit__pysha3
Static task
static1
Behavioral task
behavioral1
Sample
e7cd1716c015ab660e1ae55c8c2c121d861c63470f4a6e38458bf7bc90d0679d.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e7cd1716c015ab660e1ae55c8c2c121d861c63470f4a6e38458bf7bc90d0679d.dll
Resource
win10v2004-20240704-en
General
-
Target
e7cd1716c015ab660e1ae55c8c2c121d861c63470f4a6e38458bf7bc90d0679d
-
Size
72KB
-
MD5
fa7fa5e9e1c16f3ed877f06a1615fa00
-
SHA1
37cf140435758dfce23efc145c7d657759b4c6fa
-
SHA256
e7cd1716c015ab660e1ae55c8c2c121d861c63470f4a6e38458bf7bc90d0679d
-
SHA512
e00903d57c7e554780e67c18c5613faf62f9e3647b3fc355b226f765300de52248562d078de2f7865659404bb818020b5ef7e2732b59ab780139fe9815183481
-
SSDEEP
1536:nbaCU99kbxSLGDpN7ZNfhDGaV/fWpcFI0owa1n:nbaCG9k1YGlNpJV/epEIrwah
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7cd1716c015ab660e1ae55c8c2c121d861c63470f4a6e38458bf7bc90d0679d
Files
-
e7cd1716c015ab660e1ae55c8c2c121d861c63470f4a6e38458bf7bc90d0679d.dll windows:6 windows x64 arch:x64
11d40d1131806dbcc3b20bf30e0aea18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
python311
PyObject_GetBuffer
PyObject_CheckBuffer
PyModule_AddObject
PyThread_release_lock
PyObject_Free
_Py_Dealloc
PyModule_AddStringConstant
PyType_Ready
PyUnicode_New
PyThread_acquire_lock
_Py_NoneStruct
PyThread_allocate_lock
PyLong_FromLong
PyExc_RuntimeError
PyEval_SaveThread
_PyErr_BadInternalCall
PyModule_AddIntConstant
PyThread_free_lock
PyMem_Free
PyErr_NoMemory
PyBytes_FromStringAndSize
PyModule_Create2
PyEval_RestoreThread
PyType_Type
PyBuffer_Release
PyUnicode_FromString
PyMem_Malloc
PyExc_TypeError
_PyObject_New
PyErr_SetString
PyArg_ParseTupleAndKeywords
PyExc_BufferError
kernel32
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlCaptureContext
vcruntime140
memcpy
memset
__std_type_info_destroy_list
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_errno
_cexit
Exports
Exports
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ