13c8876c0e665d7592e62dfc5deff4b429671f07d135f2ad475b399fac4d52a5N

Sharing

Copy URL Twitter E-mail

General

Target

13c8876c0e665d7592e62dfc5deff4b429671f07d135f2ad475b399fac4d52a5N
Size

7.2MB
MD5

0f7fba99437e550cf78fa9aa697124d0
SHA1

ade794866f3133ca0090b5723d6d3f58eebc7b11
SHA256

13c8876c0e665d7592e62dfc5deff4b429671f07d135f2ad475b399fac4d52a5
SHA512

f7babe3053d4bd0822cef75132fcd39dfa67152e2bc507f522f76fc865bbbe3b23c070f86ae94dcd46383a72423d5018c445998bc5cdccef42f2f777519fd2ef
SSDEEP

49152:bcwLZb7rOEFVV38aF7U4lrkmOW2dRZyoJ44ByzUVLRpIvwMIGE8EWzOd31q97L3m:ROkVVP9xHK/IJ+0OxzZCe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13c8876c0e665d7592e62dfc5deff4b429671f07d135f2ad475b399fac4d52a5N

Files

13c8876c0e665d7592e62dfc5deff4b429671f07d135f2ad475b399fac4d52a5N
.dll windows:6 windows x64 arch:x64

61a0a0d01687bd9381cc6617c781c5ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

_rust.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

kernel32

GetStdHandle
GetCurrentThreadId
QueryPerformanceFrequency
HeapFree
GetSystemTimeAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
GetConsoleMode
GetCurrentProcess
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
UnhandledExceptionFilter
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetEnvironmentVariableW
GetCurrentDirectoryW
SetLastError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemInfo
QueryPerformanceCounter
WaitForSingleObject
SwitchToThread
GetCurrentThread
SetThreadStackGuarantee
GetLastError
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
Sleep
CloseHandle
GetCurrentProcessId
IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError
NtWriteFile

python3

PyTuple_Size
PyExc_UnicodeDecodeError
PyExc_RuntimeError
PyUnicode_FromStringAndSize
PyException_GetTraceback
PyException_SetTraceback
PyErr_Fetch
PyObject_Str
PyErr_Restore
PyErr_PrintEx
PyErr_NewExceptionWithDoc
PyExc_OverflowError
PyException_SetCause
PyGILState_Release
PyErr_Print
Py_IsInitialized
PyErr_GivenExceptionMatches
PyGILState_Ensure
PyErr_Clear
PyBytes_AsString
PyBytes_Size
PyBytes_FromStringAndSize
PyBool_Type
PyUnicode_InternInPlace
PyUnicode_AsUTF8String
PyTuple_GetItem
PyLong_FromLong
PyExc_ImportError
PyObject_SetAttrString
PyErr_NormalizeException
PyErr_SetString
PyErr_SetObject
PyLong_FromSsize_t
PyObject_GetItem
PyObject_SetItem
PyObject_DelItem
PyDict_New
PyDict_Size
PyDict_Update
PyDict_SetItem
PyList_Append
PyObject_Repr
PyObject_IsTrue
PyObject_Size
PyCapsule_GetContext
PyIter_Next
PyExc_AttributeError
PyModule_GetNameObject
PyUnicode_AsEncodedString
PyObject_GetAttr
PyObject_SetAttr
PyObject_RichCompare
PyObject_Call
Py_GetVersion
PyNumber_Index
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyType_GenericAlloc
PyCFunction_NewEx
PyType_FromSpec
PyExc_BaseException
PyModule_Create2
PyCapsule_GetPointer
PyCapsule_Type
PyType_IsSubtype
_Py_NotImplementedStruct
PyExc_Exception
PyObject_IsInstance
PyTuple_SetItem
PyTuple_New
PyList_SetItem
PyList_New
PyImport_Import
PyExc_SystemError
_Py_FalseStruct
_Py_TrueStruct
PyBaseObject_Type
PyType_GetFlags
PyDict_Next
PyLong_FromUnsignedLongLong
PyObject_GC_UnTrack
PyErr_WriteUnraisable
PyExc_NotImplementedError
PyExc_TypeError
PyExc_ValueError
PyType_GetSlot
_Py_NoneStruct
_Py_Dealloc
PyCapsule_New
PyCapsule_GetName
PyExc_IOError
PyObject_GetIter
PyExc_IndexError
PyException_GetCause

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
memmove
memcpy
__CxxFrameHandler3
memset
memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

ceil
floor
log2

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_cexit
_execute_onexit_table

api-ms-win-crt-heap-l1-1-0

free

Exports

Exports

PyInit__rust

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61a0a0d01687bd9381cc6617c781c5ac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

python3

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 229KB - Virtual size: 228KB

.reloc Size: 111KB - Virtual size: 110KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 229KB - Virtual size: 228KB

.reloc
Size: 111KB - Virtual size: 110KB