2dd5ca728be233595eaa546099411c7ad0d4652cee7870bf27b5dbd7b3fc299d

Sharing

Copy URL Twitter E-mail

General

Target

2dd5ca728be233595eaa546099411c7ad0d4652cee7870bf27b5dbd7b3fc299d
Size

27KB
MD5

09eb38528554303e1fbcfb50baa71164
SHA1

fe4135ca301dc7c39f82b4e31014d40faaf7abae
SHA256

2dd5ca728be233595eaa546099411c7ad0d4652cee7870bf27b5dbd7b3fc299d
SHA512

510a66a11d4a2315d45c817f4110edc7c4d6c1dbf87adfeac7be5fc55e9b68f9634658504576702b57a08227ba685664031b5a620729f43c5560f3f1ab6f9863
SSDEEP

768:pb2Uh2uIBRNQGPL4vzZq2o9W7GsxBbPr:l2I2bR6GCq2iW7z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dd5ca728be233595eaa546099411c7ad0d4652cee7870bf27b5dbd7b3fc299d

Files

2dd5ca728be233595eaa546099411c7ad0d4652cee7870bf27b5dbd7b3fc299d
.exe windows:5 windows x86 arch:x86

e6b1f6b05d423778aa58837c5f95b963

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\glyph\pywin32-219\build\temp.win32-2.7\Release\pythonservice.pdb

Imports

advapi32

RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegCloseKey

python27

PyErr_Clear
Py_Initialize
PyEval_InitThreads
PyImport_ImportModule
PyObject_GetAttrString
PyString_AsString
PyUnicodeUCS2_AsUnicode
PyExc_RuntimeError
PyErr_Format
PyThreadState_Swap
PyEval_ReleaseThread
PyExc_TypeError
PyErr_SetString
PyErr_Occurred
PyErr_Fetch
PyErr_Restore

pywintypes27

?GetPythonTraceback@@YAPADPAU_object@@00@Z

msvcr90

fprintf
__iob_func
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv
_initterm
_initterm_e
malloc
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
free
wprintf
_configthreadlocale

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleA
GetModuleHandleW
GetLastError
GetProcAddress
MultiByteToWideChar
FormatMessageW
LocalFree
GetModuleFileNameW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�L'�u+
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e6b1f6b05d423778aa58837c5f95b963

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

python27

pywintypes27

msvcr90

kernel32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 804B

�L'�u+ Size: 16KB - Virtual size: 20KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 804B

�L'�u+
Size: 16KB - Virtual size: 20KB