PYD[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

PYD.zip
Size

167KB
MD5

64aaf0de2537c65afcdae513246a2441
SHA1

7dacc0f68f830e7056924673316fa98478f2fc15
SHA256

470fb603b91c0510b98a68cea3f173530b32afad3ad7a46907f8b1a626931380
SHA512

62ced0c4cc855a9ee62bb92517833d51c69f4b49bc6f7d0b8516228c4d9d62f739bfe6656c9b5ccd33d30f7d9ea0f6efe39ea07ff5c0e84053cc32852c8fc4b4
SSDEEP

3072:gZ/7hjjc1DYQb6mcmvosteyszj1lDECOb576eJOnyM8ZG3jy8nLFlum:gZTdczbDRFsdFG576Ks1ENmFIm

Score

1^/10

Malware Config

Signatures

Files

PYD.zip
.zip
pyexpat.pyd
.dll windows:6 windows x64 arch:x64

7598844efa113812ad57ee3cb617cdec

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

16-12-2015 01:00

Not After

16-12-2030 01:00

Subject

CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:a7:0a:41:88:0f:6b:bf:68:3e:37:66:d6:a7:e6:f4
Certificate

Issuer

CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL

Not Before

06-02-2016 00:15

Not After

06-02-2019 00:15

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:6d:71:81:58:bb:90:b0:5c:be:ae:23:4e:fd:71:6e:5d:0f:08:2d:f8:e5:e4:e8:ba:02:1a:19:e2:f4:95:47
Signer

Actual PE Digest

2e:6d:71:81:58:bb:90:b0:5c:be:ae:23:4e:fd:71:6e:5d:0f:08:2d:f8:e5:e4:e8:ba:02:1a:19:e2:f4:95:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\_work\4\s\PCbuild\amd64\pyexpat.pdb

Imports

kernel32

GetModuleHandleA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
FreeLibrary
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RtlCaptureContext

python37

PyDict_New
_PyTraceback_Add
PyMem_Free
PyErr_NoMemory
PyObject_Realloc
PyDict_GetItem
PyObject_CallFunction
PyObject_GC_Track
PyBytes_FromStringAndSize
PyExc_TypeError
PyObject_IsTrue
PyErr_NewException
_PyUnicode_Ready
PyMem_Malloc
_Py_TrueStruct
_PyObject_GC_New
PyUnicode_FromString
PyBuffer_Release
PyByteArray_Type
PyEval_CallObjectWithKeywords
PyDict_SetItem
PyErr_SetString
_PyArg_ParseStackAndKeywords
PyExc_AttributeError
PyType_Ready
PyCapsule_New
PyUnicode_Decode
_PyObject_GetAttrId
PyModule_Create2
PyList_Append
PyList_New
PyErr_Clear
PyObject_GetBuffer
PyUnicode_FromFormat
PyLong_AsLong
PyObject_CallFunctionObjArgs
PyObject_GC_Del
PyModule_AddObject
_PyImport_SetModule
PyObject_Free
PyArg_Parse
PyModule_GetDict
PyType_IsSubtype
_Py_FalseStruct
PyModule_AddStringConstant
PyErr_SetObject
PyModule_New
PyErr_Format
_PyByteArray_empty_string
PyExc_ValueError
_Py_HashSecret
PyDict_SetItemString
PyTuple_New
_Py_NoneStruct
Py_BuildValue
PyObject_GC_UnTrack
PyLong_FromLong
PyObject_SetAttrString
PyExc_RuntimeError
PyUnicode_AsUTF8AndSize
PyObject_GenericGetAttr
_PyUnicode_EqualToASCIIString
PyUnicode_DecodeUTF8
PyErr_Occurred
PyModule_AddIntConstant
PyObject_Malloc
_PyArg_ParseStack

vcruntime140

memcpy
memcmp
memset
__std_type_info_destroy_list
__C_specific_handler
memmove

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strpbrk

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
terminate
_crt_atexit
_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
_crt_at_quick_exit
_configure_narrow_argv
_cexit
_initialize_narrow_environment

Exports

Exports

PyInit_pyexpat

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
update.pyd

Sharing

General

Malware Config

Signatures

Files

7598844efa113812ad57ee3cb617cdec

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86Certificate

Extended Key Usages

Key Usages

69:a7:0a:41:88:0f:6b:bf:68:3e:37:66:d6:a7:e6:f4Certificate

Extended Key Usages

Key Usages

2e:6d:71:81:58:bb:90:b0:5c:be:ae:23:4e:fd:71:6e:5d:0f:08:2d:f8:e5:e4:e8:ba:02:1a:19:e2:f4:95:47Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

python37

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 135KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 5KB - Virtual size: 7KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 1004B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

78:22:43:a1:53:df:28:0a:1f:fa:e1:5c:d0:28:4c:86
Certificate

69:a7:0a:41:88:0f:6b:bf:68:3e:37:66:d6:a7:e6:f4
Certificate

2e:6d:71:81:58:bb:90:b0:5c:be:ae:23:4e:fd:71:6e:5d:0f:08:2d:f8:e5:e4:e8:ba:02:1a:19:e2:f4:95:47
Signer

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 1004B