40f05aa28cef8e46dcf9eecd3a6c50d0N

Sharing

Copy URL Twitter E-mail

General

Target

40f05aa28cef8e46dcf9eecd3a6c50d0N
Size

297KB
MD5

40f05aa28cef8e46dcf9eecd3a6c50d0
SHA1

f46820987355b85e8af91a1e6a5103fb71c670ce
SHA256

84eaa5cb4dd5bcc94e371a3f28dddf6ad9f7396d820859bf1070bfa2322bdbc8
SHA512

c6710e8e7f1b10b7b7c810b59a825c32f58c82d1cb45d4411ff20e669ca6348641243aaecacd598d39e94226ab00949f07c0dbc995b994167ca738c30a45078f
SSDEEP

6144:In6Uu3DOEmMumHxPp0T/5MT5h6IAk6h8q0mK3X+W5AmuYPP/:qWqEmMumHxP+T/KvdoYPP/

Score

1^/10

Malware Config

Signatures

Files

40f05aa28cef8e46dcf9eecd3a6c50d0N
.dll windows:6 windows x64 arch:x64

98cbe3eb2db51ad402be3b33dcc1881e

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:26

Not After

11/09/2023, 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:7f:f9:cb:5a:26:48:eb:52:2c:a1:0e:08:7b:4a:b4
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

11/11/2020, 13:33

Not After

11/11/2023, 13:33

Subject

CN=Stichting Blender Foundation,O=Stichting Blender Foundation,L=Amsterdam,ST=Noord-Holland,C=NL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:26

Not After

11/09/2023, 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:60:6f:92:b2:01:3d:30:c2:25:26:33:6c:00:f6:aa:f1:22:64:d6:ab:9a:70:37:37:3e:99:ba:0f:23:52:af
Signer

Actual PE Digest

5e:60:6f:92:b2:01:3d:30:c2:25:26:33:6c:00:f6:aa:f1:22:64:d6:ab:9a:70:37:37:3e:99:ba:0f:23:52:af

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\db19\build\S\VS1564R\build\python\src\external_python\PCbuild\amd64\_decimal.pdb

Imports

python39

_PyUnicode_IsWhitespace
PyObject_CallMethod
PyObject_IsInstance
PyMem_Free
PyErr_NoMemory
PyDict_GetItemString
PyObject_CallObject
PyComplex_Type
_Py_NotImplementedStruct
PyUnicode_Compare
PyArg_ParseTupleAndKeywords
_PyObject_New
PyExc_TypeError
PyMem_Realloc
PyDict_New
PyUnicode_AsUTF8String
PyTuple_Pack
PyObject_HashNotImplemented
_PyUnicode_Ready
PyMem_Malloc
PyList_AsTuple
_Py_TrueStruct
PyUnicode_FromString
_PyLong_GCD
PyUnicode_CompareWithASCIIString
PyType_Type
PyArg_ParseTuple
PyContextVar_New
PyFloat_FromString
PyDict_SetItem
PyObject_GenericSetAttr
_PyLong_New
PyTuple_Size
PyList_Append
PyErr_Clear
PyErr_NewException
PyObject_GetAttrString
PyType_Ready
PyModule_Create2
PyList_New
PyUnicode_FromFormat
PyLong_AsLong
PyObject_CallFunctionObjArgs
PyModule_AddObject
PyComplex_AsCComplex
PyObject_Free
_Py_Dealloc
PyExc_OverflowError
PyType_IsSubtype
PyLong_Type
PyFloat_Type
_Py_FalseStruct
PyTuple_Type
PyModule_AddStringConstant
PyExc_ArithmeticError
PyErr_Format
PyLong_FromUnsignedLong
PyExc_ValueError
PyContextVar_Set
PyObject_CallFunction
PyExc_ZeroDivisionError
PyErr_SetString
PyUnicode_FromWideChar
PyList_Size
PyUnicode_New
PyExc_AttributeError
_PyUnicode_ToDecimalDigit
PyFloat_FromDouble
PyDict_Size
PyDict_SetItemString
PyTuple_New
PyList_GetItem
_Py_NoneStruct
PyFloat_AsDouble
PyComplex_FromDoubles
PyDict_GetItemWithError
Py_BuildValue
PyContextVar_Get
PyLong_FromLong
PyExc_RuntimeError
PyUnicode_AsUTF8AndSize
PyObject_GenericGetAttr
PyUnicode_DecodeUTF8
PyLong_FromSsize_t
PyErr_Occurred
PyImport_ImportModule
PyExc_KeyError
PyLong_AsSsize_t
_Py_ascii_whitespace
PyType_GenericNew
PyModule_AddIntConstant
PyBool_FromLong
PyErr_SetObject
PyUnicode_InternFromString
PyObject_IsTrue
PyBaseObject_Type

vcruntime140

memcpy
memset
memmove
__std_type_info_destroy_list
__C_specific_handler

api-ms-win-crt-math-l1-1-0

_isnan
_finite
log10
ceil
copysign

api-ms-win-crt-convert-l1-1-0

mbstowcs
_strtoi64

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsprintf_s
fputc
fputs
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initterm
terminate
_errno
_initialize_narrow_environment
_cexit
_crt_at_quick_exit
_initialize_onexit_table
raise
_crt_atexit
_register_onexit_function
_execute_onexit_table
abort

api-ms-win-crt-string-l1-1-0

isupper
isdigit
tolower
strcmp

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
realloc

kernel32

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter

Exports

Exports

PyInit__decimal

Sections

.text
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98cbe3eb2db51ad402be3b33dcc1881e

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

43:7f:f9:cb:5a:26:48:eb:52:2c:a1:0e:08:7b:4a:b4Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

5e:60:6f:92:b2:01:3d:30:c2:25:26:33:6c:00:f6:aa:f1:22:64:d6:ab:9a:70:37:37:3e:99:ba:0f:23:52:afSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

python39

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 209KB - Virtual size: 208KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 9KB - Virtual size: 10KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

43:7f:f9:cb:5a:26:48:eb:52:2c:a1:0e:08:7b:4a:b4
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

5e:60:6f:92:b2:01:3d:30:c2:25:26:33:6c:00:f6:aa:f1:22:64:d6:ab:9a:70:37:37:3e:99:ba:0f:23:52:af
Signer

.text
Size: 209KB - Virtual size: 208KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 9KB - Virtual size: 10KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB