9196efd7661743582481a14bf3418d99b39ce81740d39d0bcec36f0ab7f490c1N

Sharing

Copy URL Twitter E-mail

General

Target

9196efd7661743582481a14bf3418d99b39ce81740d39d0bcec36f0ab7f490c1N
Size

248KB
MD5

7341f1c3cd304009c8fd5b4261a54b10
SHA1

32600f71b132bd2ea3827866372e731f653000e5
SHA256

9196efd7661743582481a14bf3418d99b39ce81740d39d0bcec36f0ab7f490c1
SHA512

e21156d7b0060ae365a6a5955d82738a6615a985e568a32361832fecc8f76f9b79e274641f417101e0322f0776424e5b6df735483601ef890ea825f24d1a2845
SSDEEP

6144:L/3QmKGA8wYDdXba8LqLSywaumdkYTJj:D3QmK+LZLuDumf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9196efd7661743582481a14bf3418d99b39ce81740d39d0bcec36f0ab7f490c1N

Files

9196efd7661743582481a14bf3418d99b39ce81740d39d0bcec36f0ab7f490c1N
.dll windows:6 windows x64 arch:x64

89ea237fa7636018021b4f00d8cbc7ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python35

PyDict_Next
PyErr_Format
PyObject_RichCompare
PyTuple_Type
_Py_FalseStruct
PyNumber_InPlaceAdd
PyMethod_Type
PyLong_Type
PyErr_Restore
PyExc_OverflowError
PyImport_GetModuleDict
PyModule_GetDict
PyErr_ExceptionMatches
PyErr_Fetch
PyLong_AsLong
PyObject_Not
PyUnicode_FromFormat
PyList_New
PyModule_Create2
PyImport_AddModule
PyType_Ready
PyErr_Clear
PyList_Append
PyBytes_Type
PyObject_RichCompareBool
PyUnicode_Decode
PyCode_New
PyException_SetTraceback
PyCapsule_New
PyDict_SetItem
PyDict_New
PyUnicode_Type
PyObject_CallFinalizerFromDealloc
_PyDict_GetItem_KnownHash
PyNumber_Index
PyExc_AttributeError
PyList_Type
PyErr_NoMemory
PyDict_GetItemString
PyObject_GetItem
PyBytes_FromStringAndSize
PyDict_DelItem
PyUnicode_Compare
PyExc_TypeError
PyMem_Realloc
PyCFunction_NewEx
PyObject_IsTrue
PyExc_NameError
PyUnicode_AsUTF8String
PyTuple_Pack
_PyUnicode_Ready
PyMem_Malloc
PyExc_IndexError
_Py_TrueStruct
PyExc_SystemError
PyObject_SetItem
PyType_Modified
PyEval_EvalFrameEx
PyUnicode_FromString
PyLong_FromSize_t
_PyType_Lookup
PyUnicode_Format
PyObject_Size
PyObject_Call
PyUnicode_FromStringAndSize
_PyObject_GetDictPtr
PyDict_Size
PyDict_SetItemString
PySequence_Contains
PyTuple_New
_Py_NoneStruct
PyObject_GetAttr
Py_GetVersion
PyExc_UnboundLocalError
PyObject_Hash
PyObject_GC_UnTrack
PyLong_FromLong
PyObject_SetAttrString
PyExc_RuntimeError
PyTraceBack_Here
PyObject_GenericGetAttr
PyUnicode_DecodeUTF8
PyLong_FromSsize_t
PyErr_Occurred
PyUnicode_AsUnicode
PyErr_NormalizeException
PyImport_ImportModuleLevelObject
PyExc_DeprecationWarning
_Py_CheckRecursiveCall
PyExc_ValueError
PyEval_EvalCodeEx
PyErr_WarnFormat
PyLong_AsSsize_t
PyFrame_New
PyFunction_Type
PyErr_WarnEx
PyErr_GivenExceptionMatches
PyErr_SetObject
_Py_CheckRecursionLimit
PyThreadState_Get
PyOS_snprintf
PyCFunction_Type
PyUnicode_InternFromString
PyObject_GetIter
PyObject_SetAttr
PyExc_ImportError
PyErr_SetString
PyExc_StopIteration
PyBaseObject_Type

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

vcruntime140

__C_specific_handler
memset
memcpy
memmove
strchr
__std_type_info_destroy_list
memcmp

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free

api-ms-win-crt-string-l1-1-0

strncmp
_strdup

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initterm_e
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initialize_onexit_table

Exports

Exports

PyInit__yaml

Sections

.text
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89ea237fa7636018021b4f00d8cbc7ff

Headers

DLL Characteristics

File Characteristics

Imports

python35

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 202KB - Virtual size: 201KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 15KB - Virtual size: 19KB

.pdata Size: 6KB - Virtual size: 5KB

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 692B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 202KB - Virtual size: 201KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 15KB - Virtual size: 19KB

.pdata
Size: 6KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 692B

.reloc
Size: 1KB - Virtual size: 1KB