PyInit_mtrand
Static task
static1
Behavioral task
behavioral1
Sample
1e41f709b8d0864da031169504aa07c0N.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1e41f709b8d0864da031169504aa07c0N.dll
Resource
win10v2004-20240802-en
General
-
Target
1e41f709b8d0864da031169504aa07c0N.exe
-
Size
635KB
-
MD5
1e41f709b8d0864da031169504aa07c0
-
SHA1
0116de7e7e6b8d4825cdcfbf1728792fee04c990
-
SHA256
116e0e34277faff3117d7408b32d293bedc0073b37bdd2441937d9bd750bf503
-
SHA512
2559f8c5d386d0686c2402b3037018690f94de8dc0a6aa3df7a4878b683ad64b4d423d96289be1dcdca8e80e056c3fd9c7e6c2bb95ef5559d6fae816be0db242
-
SSDEEP
12288:ndnyCdjIr3XiY3BiPb96IzmcAK/pyiChBN8G6supYMXJidmSHiZCsjV36n73mgE:nUPOVsupYM5ZS+Cr72
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e41f709b8d0864da031169504aa07c0N.exe
Files
-
1e41f709b8d0864da031169504aa07c0N.exe.dll windows:5 windows x86 arch:x86
4ad4e6ba70fb1c7aec18b62c263251b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
python34
PyErr_NormalizeException
PyType_IsSubtype
PyObject_GetItem
PyLong_FromSsize_t
PyErr_Clear
PyErr_ExceptionMatches
PyExc_OverflowError
PyTuple_Type
PyList_Type
PyExc_ValueError
PyExc_StopIteration
PyNumber_Subtract
PyNumber_InPlaceSubtract
PyFloat_FromDouble
PyFloat_Type
PyLong_FromLongLong
PyLong_FromLong
PyLong_Type
PyObject_RichCompare
_Py_FalseStruct
_Py_TrueStruct
PyNumber_Add
PyNumber_InPlaceAdd
PyImport_ImportModuleLevelObject
PyDict_New
PyModule_GetDict
PyList_New
PyObject_SetItem
PyCapsule_New
PyMem_Realloc
PyMem_Malloc
PyUnicode_FromFormat
PyUnicode_FromString
PyTraceBack_Here
PyLong_FromUnsignedLong
PyLong_FromUnsignedLongLong
PyErr_WarnEx
Py_GetVersion
PyOS_snprintf
PyImport_Import
_Py_NoneStruct
PyUnicode_FromStringAndSize
PyException_SetTraceback
PyObject_IsTrue
PyNumber_Long
PyEval_RestoreThread
PyEval_SaveThread
PyMethod_Type
PySequence_Tuple
PyObject_GetIter
PyUnicode_Format
PyNumber_InPlaceTrueDivide
PyObject_IsInstance
PyObject_Size
PyFloat_AsDouble
PyLong_AsLong
PyGILState_Release
PyExc_ZeroDivisionError
PyGILState_Ensure
PyErr_Restore
PyErr_Fetch
PyObject_GC_UnTrack
PyObject_CallFinalizerFromDealloc
PyLong_FromString
PyType_Modified
PyNumber_Multiply
PyErr_Print
PyCFunction_NewEx
PyType_Ready
PyDict_SetItemString
PyDict_GetItemString
PyImport_GetModuleDict
PyObject_SetAttrString
PyImport_AddModule
PyModule_Create2
_PyUnicode_Ready
PyUnicode_Type
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyLong_AsLongLong
PyNumber_Or
PyList_AsTuple
PySequence_List
_Py_EllipsisObject
PyErr_GivenExceptionMatches
PyTraceBack_Type
PyObject_IsSubclass
PyObject_CallObject
PyException_SetCause
PyFunction_Type
PyCFunction_Type
PyObject_Call
PyExc_SystemError
PyDict_Size
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
PyTuple_New
PyEval_EvalCodeEx
_PyThreadState_Current
PyFrame_New
PyEval_EvalFrameEx
PyDict_GetItem
PyDict_Next
PyUnicode_AsUnicode
PyUnicode_Compare
PyErr_Occurred
PyDict_SetItem
PyExc_TypeError
PyExc_NameError
PyTuple_Pack
PySlice_New
PyCode_New
PyUnicode_Decode
PyBaseObject_Type
PyMem_Free
PyList_Append
PyObject_SetAttr
PySequence_Contains
_PyType_Lookup
PyErr_SetObject
PyObject_GetAttr
PyBytes_FromStringAndSize
PyImport_ImportModule
PyExc_ImportError
PyErr_SetString
PyObject_GetAttrString
PyExc_AttributeError
PyCapsule_Type
PyExc_RuntimeError
PyCapsule_GetPointer
PyErr_Format
PyUnicode_InternFromString
msvcr100
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
ceil
_CIcos
_CIacos
_CIfmod
floor
_CIexp
_CIpow
_ftime64
clock
_CIlog
_CIsqrt
memset
_finite
strchr
memcpy
_except_handler4_common
kernel32
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsProcessorFeaturePresent
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
Exports
Exports
Sections
.text Size: 333KB - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 144KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ