ebb4b54f3cf0d858c69690866b5260aa327b2861d474bf1f5678c55f96eb3a59N

Sharing

Copy URL Twitter E-mail

General

Target

ebb4b54f3cf0d858c69690866b5260aa327b2861d474bf1f5678c55f96eb3a59N
Size

123KB
MD5

31106b504866cf9f2fdf9297bb1be570
SHA1

61ac50afb3f2c64c348de3c4400543a76641cc54
SHA256

ebb4b54f3cf0d858c69690866b5260aa327b2861d474bf1f5678c55f96eb3a59
SHA512

52a5f6c4a2065d6c045d0d30055311b33f0a9327f41a7938f8b0704972393fff52a5bf8fd2f9abc8ee7ca0ea42d48fd988693140bf2fd0db55961724c67ba4cf
SSDEEP

3072:ggxgtiytsv60UQ/akXlG1JKkUu8jYZ3kU1qAx8Du8X:ggxgtiyivQQ/akXlGR8jWpx8Du

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebb4b54f3cf0d858c69690866b5260aa327b2861d474bf1f5678c55f96eb3a59N

Files

ebb4b54f3cf0d858c69690866b5260aa327b2861d474bf1f5678c55f96eb3a59N
.dll windows:6 windows x64 arch:x64

2207a177ac23ef62d0143872ea43ca3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

opengeode-geosciencesio_mesh

?initialize@GeosciencesIOMeshLibrary@geode@@SAXXZ

python312

PyCapsule_SetContext
PyThreadState_DeleteCurrent
PyExc_TypeError
PyThreadState_Clear
PyCapsule_Type
PyDict_Copy
PyObject_Str
PyUnicode_AsUTF8String
PyModule_Type
PyFrame_GetBack
PyFrame_GetCode
PyExc_IndexError
PyExc_ImportError
PyCapsule_SetPointer
PyCapsule_New
PyExc_SystemError
PyObject_SetItem
PyException_SetCause
PyInterpreterState_Get
PyDict_DelItemString
PyUnicode_FromString
PyEval_AcquireThread
_PyType_Lookup
PyGILState_GetThisThreadState
PyBuffer_Release
PyObject_Repr
PyByteArray_Type
PyType_Type
PySequence_Tuple
_PyObject_GetDictPtr
PyGILState_Ensure
PyByteArray_Size
PyThread_tss_get
PyTuple_Size
PyErr_Clear
PyObject_GetAttrString
PyType_Ready
PyModule_Create2
PyList_New
PyUnicode_FromFormat
PyObject_ClearWeakRefs
PyObject_GenericGetDict
PyObject_CallFunctionObjArgs
PyErr_Fetch
PyCapsule_GetPointer
PyTuple_GetItem
_Py_Dealloc
PyExc_OverflowError
PyErr_Restore
PyType_IsSubtype
_Py_FalseStruct
PyThreadState_New
PyDict_Type
PyErr_Format
PyDict_Next
PyExc_ValueError
PyErr_WriteUnraisable
PyErr_SetString
PyByteArray_AsString
_Py_NotImplementedStruct
PyProperty_Type
PyList_Size
PyObject_HasAttrString
PyDict_Size
PyObject_GenericSetDict
PyTuple_New
PyObject_CallObject
PyThread_tss_set
PyCMethod_New
_Py_NoneStruct
PyTuple_SetItem
PyMem_Free
PyObject_IsInstance
PyInstanceMethod_New
PyException_SetContext
PyList_GetItem
PyDict_New
PyBytes_Size
PyException_SetTraceback
PyBytes_AsStringAndSize
PyCapsule_GetName
PyGILState_Release
PyFrame_GetLineNumber
PyCapsule_GetContext
Py_GetVersion
PyDict_GetItemWithError
PyExc_MemoryError
PyInstanceMethod_Type
PyObject_GC_UnTrack
PyObject_SetAttrString
PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyEval_SaveThread
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyErr_Occurred
PyErr_NormalizeException
PyBytes_AsString
PyObject_Malloc
PyThreadState_Get
PyWeakref_NewRef
PyCFunction_Type
PyObject_SetAttr
PyExc_BufferError
PyMem_Calloc
PyBaseObject_Type
PyInterpreterState_GetDict
PyUnicode_AsEncodedString
PyThread_tss_create
_Py_TrueStruct

msvcp140

?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCompare@@YA_NPEBX0@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
memcmp
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
__std_type_info_destroy_list
strchr
__std_terminate
__std_type_info_name
__std_type_info_hash
_purecall
__std_type_info_compare
memchr
__std_exception_destroy
__RTDynamicCast
__std_exception_copy
memmove

api-ms-win-crt-string-l1-1-0

_strdup
strcmp
strncmp

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_aligned_free
malloc
_aligned_malloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn

kernel32

IsProcessorFeaturePresent
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
ReleaseSRWLockExclusive

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

PyInit_opengeode_geosciencesio_py_mesh

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2207a177ac23ef62d0143872ea43ca3d

Headers

DLL Characteristics

File Characteristics

Imports

opengeode-geosciencesio_mesh

python312

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 88KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 176B

.text
Size: 89KB - Virtual size: 88KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 176B