PyInit_algos
Static task
static1
Behavioral task
behavioral1
Sample
3ef5d6cca5fe80ab7513ec5da38f3cd3f86d376bdcb34bc7cba3608bc0ae8949.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3ef5d6cca5fe80ab7513ec5da38f3cd3f86d376bdcb34bc7cba3608bc0ae8949.dll
Resource
win10v2004-20240802-en
General
-
Target
3ef5d6cca5fe80ab7513ec5da38f3cd3f86d376bdcb34bc7cba3608bc0ae8949
-
Size
1.7MB
-
MD5
0bcaa6d017c8c4b34ce13595ff6dbcbb
-
SHA1
8952c6983eac09c13e72bf21c37e318a14129d35
-
SHA256
3ef5d6cca5fe80ab7513ec5da38f3cd3f86d376bdcb34bc7cba3608bc0ae8949
-
SHA512
5d92d3b7f01f7000f26bec9ba866397749e81431e05cfb28636a95b189b577ae8b20521224aeafa3fa9f5c1b03483e843fbd9f311c9325e98d17326e26fb3f0e
-
SSDEEP
49152:KR6EtS6RjZsXAZhMMY/eSm07On0LxfbcjWHj1QXwV97:5DeR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ef5d6cca5fe80ab7513ec5da38f3cd3f86d376bdcb34bc7cba3608bc0ae8949
Files
-
3ef5d6cca5fe80ab7513ec5da38f3cd3f86d376bdcb34bc7cba3608bc0ae8949.dll windows:6 windows x64 arch:x64
a5ee4e952aaa0b5df55f945fd94fd24b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
python311
PyCode_NewEmpty
PyInterpreterState_GetID
PyThreadState_Get
PyGILState_Ensure
PyGILState_Release
_PyThreadState_UncheckedGet
PyErr_SetObject
PyErr_SetString
PyErr_Occurred
PyErr_Clear
PyErr_Fetch
PyErr_Restore
PyErr_GivenExceptionMatches
PyErr_ExceptionMatches
PyErr_NormalizeException
PyException_SetTraceback
PyException_GetTraceback
PyException_SetCause
PyErr_NoMemory
PyErr_Format
PyErr_WriteUnraisable
PyOS_snprintf
_Py_FatalErrorFunc
PyLong_FromLong
PyLong_FromUnsignedLong
PyLong_FromSsize_t
PyLong_AsLong
PyLong_AsSsize_t
PyLong_AsUnsignedLong
PyLong_FromLongLong
PyLong_FromUnsignedLongLong
PyLong_AsLongLong
PyLong_AsUnsignedLongLong
PyFloat_FromDouble
PyFloat_AsDouble
PyMemoryView_FromObject
PyTuple_New
PyTuple_Size
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_Pack
PyList_New
PyList_Append
PyList_AsTuple
_PyList_Extend
PyDict_New
PyDict_GetItemWithError
PyDict_SetItem
PyDict_DelItem
PyDict_Next
PyDict_Size
PyDict_Contains
PyDict_GetItemString
PyDict_SetItemString
_PyDict_GetItem_KnownHash
_PyDict_SetItem_KnownHash
_PyDict_NewPresized
PyCMethod_New
PyModule_NewObject
PyModule_GetDict
PyModule_GetName
PyModuleDef_Init
PyMethod_New
PyCapsule_New
PyCapsule_GetPointer
PyCapsule_GetName
PyCapsule_IsValid
PyTraceBack_Here
PySlice_New
PyErr_WarnEx
PyErr_WarnFormat
PyThread_allocate_lock
PyThread_free_lock
PyModule_AddObject
PyErr_PrintEx
Py_EnterRecursiveCall
Py_LeaveRecursiveCall
_PyUnicode_FastCopyCharacters
PyEval_RestoreThread
PyImport_GetModuleDict
PyImport_GetModule
PyImport_AddModule
PyImport_ImportModule
PyCode_NewWithPosOnlyArgs
PyObject_Call
PyObject_CallObject
PyObject_Size
PyObject_GetItem
PyObject_SetItem
PyObject_Format
PyObject_GetIter
PyIter_Next
PyNumber_Add
PyNumber_Subtract
PyNumber_Multiply
PyNumber_Remainder
PyNumber_Negative
PyNumber_Invert
PyNumber_Xor
PyIndex_Check
PyNumber_Index
PyNumber_InPlaceAdd
PyNumber_InPlaceMultiply
PySequence_GetSlice
PySequence_Tuple
PySequence_List
PySequence_Contains
PyObject_IsInstance
PyObject_IsSubclass
PyVectorcall_Function
PyObject_VectorcallDict
PyTraceMalloc_Track
PyTraceMalloc_Untrack
PyFrame_New
PyType_Type
PyBaseObject_Type
_Py_NoneStruct
Py_OptimizeFlag
PyByteArray_Type
PyBytes_Type
PyUnicode_Type
PyExc_Exception
PyExc_StopIteration
PyExc_AttributeError
PyExc_BufferError
PyExc_ImportError
PyExc_ModuleNotFoundError
PyExc_IndexError
PyExc_KeyError
PyExc_NameError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_NotImplementedError
PyExc_SystemError
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_ValueError
PyExc_ZeroDivisionError
PyExc_DeprecationWarning
PyExc_RuntimeWarning
PyLong_Type
PyBool_Type
_Py_FalseStruct
_Py_TrueStruct
PyFloat_Type
PyTuple_Type
PyList_Type
PyDict_Type
PyCFunction_Type
PyMethod_Type
PyCapsule_Type
PyTraceBack_Type
PySlice_Type
PyMethodDescr_Type
Py_Version
PyObject_Hash
_PyUnicode_Ready
PyUnicode_New
PyUnicode_Format
PyUnicode_Compare
PyUnicode_Join
PyUnicode_Concat
PyUnicode_Decode
PyUnicode_FromOrdinal
PyUnicode_InternFromString
PyUnicode_FromFormat
PyUnicode_FromString
PyImport_ImportModuleLevelObject
PyUnicode_FromStringAndSize
PyBytes_FromString
PyBytes_FromStringAndSize
PyObject_GC_IsFinalized
PyObject_GC_Del
PyObject_GC_UnTrack
PyObject_GC_Track
_PyObject_GC_New
PyGC_Disable
PyGC_Enable
PyObject_Free
PyObject_Malloc
_PyObject_GenericGetAttrWithDict
PyObject_CallFinalizerFromDealloc
_PyObject_GetDictPtr
_PyType_Lookup
_Py_Dealloc
PyUnicode_AsUTF8
PyObject_ClearWeakRefs
PyObject_IsTrue
PyObject_Not
PyObject_GenericGetAttr
PyObject_SetAttr
PyObject_GetAttr
PyObject_SetAttrString
PyObject_GetAttrString
PyObject_RichCompareBool
PyObject_RichCompare
PyObject_Str
PyType_Modified
PyType_Ready
PyType_IsSubtype
PyBuffer_Release
PyObject_GetBuffer
PyMem_Free
PyMem_Realloc
PyEval_SaveThread
PyMem_Malloc
vcruntime140
strrchr
memcmp
memcpy
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
realloc
api-ms-win-crt-math-l1-1-0
sqrt
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_execute_onexit_table
_cexit
_initterm
kernel32
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Exports
Exports
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ