_elementtree[.]pyd

Sharing

Copy URL Twitter E-mail

General

Target

_elementtree.pyd
Size

130KB
MD5

f89c26a967569f393e8e958c9127d4d7
SHA1

ea09407004b2b279f9424c20ba555cfc8909f154
SHA256

4869325e5cffbd13d3cc02dc78226478adfb51a802b52ff65b5adfacff3511f1
SHA512

eb2090ed5e00ea1a1b7b0c21f27bab45ec271dfb8e16c2df07be16df12ceaa1f8d0e0430b0ed65e4945e443aeb5248b42a6448decfc4157a39fa2c3dea20f5c2
SSDEEP

3072:z1VIT1f8995bcC5WgfQfd/N1/G+m4/V2CwaOlIS6fKd0:fIT1E1bcC5TqV320ICwFc

Score

1^/10

Malware Config

Signatures

Files

_elementtree.pyd
.dll windows:6 windows x64 arch:x64

9d95ecaf88a0f327400618bb4ddc0387

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/01/2022, 00:00

Not After

15/01/2025, 23:59

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:f7:0c:88:10:44:56:ba:f3:7e:c1:05:93:c9:dd:1e:5c:0d:06:a1:34:92:46:ff:84:b2:61:7a:8b:58:a9:20
Signer

Actual PE Digest

06:f7:0c:88:10:44:56:ba:f3:7e:c1:05:93:c9:dd:1e:5c:0d:06:a1:34:92:46:ff:84:b2:61:7a:8b:58:a9:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\b\bin\amd64\_elementtree.pdb

Imports

kernel32

GetCurrentProcessId
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
RtlCaptureContext

python312

PyUnicode_Join
PyExc_OverflowError
_Py_Dealloc
_PyTrash_cond
PyObject_Free
PyErr_ExceptionMatches
PyModule_AddObjectRef
PyCapsule_GetPointer
_PyArg_ParseTuple_SizeT
PyObject_CallFunctionObjArgs
_PyBytes_Resize
PyObject_ClearWeakRefs
PyUnicode_AsUTF8
PyUnicode_FromFormat
PyObject_GetBuffer
PySequence_Fast
PyList_New
PyExc_SyntaxError
PyObject_GetAttrString
PyErr_NewException
PyErr_Clear
PyList_Append
PyBytes_Type
PyObject_RichCompareBool
PyType_GetModuleState
PyDict_SetItem
PyDict_New
PyUnicode_Type
PyObject_VectorcallMethod
PyMem_Free
PyExc_StopIteration
PyType_GenericAlloc
PyErr_Format
PyErr_NoMemory
PyObject_Realloc
_PyImport_GetModuleAttrString
PyModuleDef_Init
PyIndex_Check
PyObject_GC_Track
PyBytes_FromStringAndSize
Py_ReprLeave
PyDict_DelItem
PyType_GetModuleByDef
PyNumber_AsSsize_t
Py_ReprEnter
PyExc_TypeError
PyType_IsSubtype
PyMem_Realloc
PyObject_IsTrue
PyDict_Copy
PyTuple_Pack
PyCallable_Check
PyMem_Malloc
PyExc_IndexError
PyExc_ImportError
PyObject_CallMethodObjArgs
PyModule_GetState
_PyTrash_begin
_PyObject_GC_New
PyList_SetItem
PyDict_Keys
PyUnicode_FromString
PyLong_FromSize_t
PyBuffer_Release
PyObject_CallNoArgs
PyUnicode_FromStringAndSize
PyUnicode_AsEncodedString
_PyArg_ParseTupleAndKeywords_SizeT
PyDict_Next
PyExc_ValueError
_PyArg_UnpackKeywords
_PyTrash_end
PyNumber_Add
PyErr_SetString
_PyArg_BadArgument
PyUnicode_New
PyExc_AttributeError
PyDict_Items
_Py_HashSecret
PyModule_AddType
PyTuple_New
_Py_NoneStruct
PyObject_GetAttr
_PyObject_LookupAttr
PyDict_GetItemWithError
PyErr_SetNone
PyObject_GC_UnTrack
PySlice_Unpack
PyLong_FromLong
PyObject_SetAttrString
_PyObject_FastCall
PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyList_SetSlice
PyUnicode_AsUTF8AndSize
PyType_FromModuleAndSpec
PyObject_GenericGetAttr
PyUnicode_DecodeUTF8
PyLong_FromSsize_t
PyErr_Occurred
PyDict_Type
PyDict_Update
PyObject_SelfIter
PyImport_ImportModule
PySlice_Type
PyExc_DeprecationWarning
_PyArg_CheckPositional
PyLong_AsSsize_t
PyExc_RuntimeWarning
PyErr_WarnEx
PyObject_Malloc
_PyObject_CallFunction_SizeT
_PyNumber_Index
_Py_BuildValue_SizeT
PyObject_CallOneArg
PyErr_SetObject
PySlice_AdjustIndices
PyUnicode_InternFromString
PyObject_SetAttr
PyList_Type

vcruntime140

memmove
memcpy
__std_type_info_destroy_list
memset
__C_specific_handler

api-ms-win-crt-string-l1-1-0

strncat
strcmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_cexit
_execute_onexit_table
_initterm

Exports

Exports

PyInit__elementtree

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d95ecaf88a0f327400618bb4ddc0387

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:ddCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

06:f7:0c:88:10:44:56:ba:f3:7e:c1:05:93:c9:dd:1e:5c:0d:06:a1:34:92:46:ff:84:b2:61:7a:8b:58:a9:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

python312

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

06:f7:0c:88:10:44:56:ba:f3:7e:c1:05:93:c9:dd:1e:5c:0d:06:a1:34:92:46:ff:84:b2:61:7a:8b:58:a9:20
Signer

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB