646c301feb4c3d4b401534074723f2a991f02e2854bd0438e394474286ac779f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

646c301feb4c3d4b401534074723f2a991f02e2854bd0438e394474286ac779f
Size

4.4MB
MD5

d5a2b46fa8405979b413a8297fb655bc
SHA1

1af88659549059826419eeccb255f75f683f2c77
SHA256

646c301feb4c3d4b401534074723f2a991f02e2854bd0438e394474286ac779f
SHA512

acf9f53406bea805c1d34d9565d4630c2a2c3791d422d325e65844d0ef9a59ff3360c023cee3a1908ab430b4c09b4e36990227d9f0d8bc10aa2e022b1d533ad8
SSDEEP

98304:YFPDDYR1ivObnL3kHq4wp9gzmfNzK1+/Ab:uDMR8GbL3kHoRtKv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
646c301feb4c3d4b401534074723f2a991f02e2854bd0438e394474286ac779f

Files

646c301feb4c3d4b401534074723f2a991f02e2854bd0438e394474286ac779f
.dll windows:6 windows x64 arch:x64

1b1a0d447b9d54c0ed1966ec59676d15

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python39

PyFloat_Type

kernel32

InitializeSListHead

vcruntime140

strrchr

api-ms-win-crt-runtime-l1-1-0

_cexit

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

user32

GetWindow

advapi32

RegSetValueExA

shell32

SHGetFolderPathW

Exports

Exports

PyInit_mymodule_m

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ