3efbe5eb45669f0f3da3665114e75840N

Sharing

Copy URL Twitter E-mail

General

Target

3efbe5eb45669f0f3da3665114e75840N
Size

31KB
MD5

3efbe5eb45669f0f3da3665114e75840
SHA1

ea1be8d0f2b28cf0f6c3ee46dc01fdba734d1e2f
SHA256

48cc81a61a68b9b013985519437de7d8f3e35bf3a67b664d69326d03b4ea23f0
SHA512

73b837de347dd4b7173e4a302f84dcb863192954785f7aca488dd6508d0c1a9fbf8cba81d2b6553acc66b1c194ed527fc47c21ad1b762bd4978957b7d1832530
SSDEEP

768:vIiKUgaDTPlQMlwOYSgj0IqIrY7neT6JOtu1iTZKt:wagaDTdvlwOYSE0IqIrY7nj6uqKt

Score

1^/10

Malware Config

Signatures

Files

3efbe5eb45669f0f3da3665114e75840N
.dll windows:6 windows x64 arch:x64

124bcb72e140421a23a8f828dc15966e

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:26

Not After

11/09/2023, 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:7f:f9:cb:5a:26:48:eb:52:2c:a1:0e:08:7b:4a:b4
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

11/11/2020, 13:33

Not After

11/11/2023, 13:33

Subject

CN=Stichting Blender Foundation,O=Stichting Blender Foundation,L=Amsterdam,ST=Noord-Holland,C=NL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:26

Not After

11/09/2023, 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:b3:15:28:6b:73:5c:0c:c1:9a:97:f2:f2:85:73:70:c7:0b:b3:31:fd:64:67:03:18:39:87:af:de:99:31:4f
Signer

Actual PE Digest

17:b3:15:28:6b:73:5c:0c:c1:9a:97:f2:f2:85:73:70:c7:0b:b3:31:fd:64:67:03:18:39:87:af:de:99:31:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\db19\build\S\VS1564R\build\python\src\external_python\PCbuild\amd64\winsound.pdb

Imports

winmm

PlaySoundW

kernel32

GetModuleHandleW
GetStartupInfoW
Beep
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RtlCaptureContext

user32

MessageBeep

python39

PyDict_SetItem
PyMem_Free
_PyLong_AsInt
PyEval_RestoreThread
PyBuffer_Release
PyErr_SetExcFromWindowsErr
PyUnicode_FromString
PyModule_Create2
PyObject_GetBuffer
PyUnicode_AsWideCharString
PyModule_GetDict
_Py_Dealloc
PyType_IsSubtype
PyFloat_Type
PyErr_Format
PyExc_ValueError
_PyArg_UnpackKeywords
PyErr_SetString
_Py_NoneStruct
PyLong_FromLong
PyExc_RuntimeError
PyEval_SaveThread
PyErr_Occurred
PyExc_TypeError

vcruntime140

memset
__std_type_info_destroy_list
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_cexit
terminate
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_crt_atexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv

Exports

Exports

PyInit_winsound

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

124bcb72e140421a23a8f828dc15966e

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

43:7f:f9:cb:5a:26:48:eb:52:2c:a1:0e:08:7b:4a:b4Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

17:b3:15:28:6b:73:5c:0c:c1:9a:97:f2:f2:85:73:70:c7:0b:b3:31:fd:64:67:03:18:39:87:af:de:99:31:4fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

kernel32

user32

python39

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 804B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 76B

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

43:7f:f9:cb:5a:26:48:eb:52:2c:a1:0e:08:7b:4a:b4
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

17:b3:15:28:6b:73:5c:0c:c1:9a:97:f2:f2:85:73:70:c7:0b:b3:31:fd:64:67:03:18:39:87:af:de:99:31:4f
Signer

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 804B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 76B