31309a088b3a34a08991b3ad889c43a570172a21da7ef5debe9dd50856a34285N

Sharing

Copy URL Twitter E-mail

General

Target

31309a088b3a34a08991b3ad889c43a570172a21da7ef5debe9dd50856a34285N
Size

83KB
MD5

adcca85d029146e94bb5d6bfbb642560
SHA1

1b233ec1370bbff0555a39dc08256185b8ddb37f
SHA256

31309a088b3a34a08991b3ad889c43a570172a21da7ef5debe9dd50856a34285
SHA512

98171733ee3e00a3c84e1c20b0e4fff4f17c0dfa3385e4ea8a8f4855b5d1ce12db30601e734212d786387c3b0ff4152423f50ffbd7704b893b7c939029605a42
SSDEEP

1536:ijcJtvBgB47/v2ln4g28ZGwaCPFsxI/s7aI:qAmIWBBZICPF6I/s7a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31309a088b3a34a08991b3ad889c43a570172a21da7ef5debe9dd50856a34285N

Files

31309a088b3a34a08991b3ad889c43a570172a21da7ef5debe9dd50856a34285N
.dll windows:6 windows x64 arch:x64

6e104ac4742e9a2200af2cb93c91278b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\build\cpython\PCBuild\amd64\_bz2.pdb

Imports

python35

PyEval_RestoreThread
PyBuffer_Release
PyMem_RawFree
PyExc_SystemError
PyMem_Malloc
PyMem_Realloc
PyExc_TypeError
PyErr_NoMemory
PyMem_Free
PyThread_free_lock
PyExc_EOFError
PyType_Ready
PyModule_Create2
_PyBytes_Resize
PyBytes_FromStringAndSize
_PyArg_ParseTuple_SizeT
PyModule_AddObject
PyThread_release_lock
PyExc_OverflowError
PyErr_Format
_PyArg_ParseTupleAndKeywords_SizeT
PyExc_ValueError
PyErr_SetString
PyThread_acquire_lock
_PyArg_NoPositional
PyMem_RawMalloc
PyThread_allocate_lock
PyExc_MemoryError
PyErr_SetNone
PyExc_IOError
PyExc_RuntimeError
PyEval_SaveThread
_PyArg_NoKeywords
PyType_GenericNew
_PyArg_Parse_SizeT

vcruntime140

memcpy
memset
__std_type_info_destroy_list
__C_specific_handler
__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
memmove

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
ferror
fopen
fflush
fclose
fgetc
fwrite
_fileno
ungetc
_setmode
fread
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_crt_atexit
_initterm_e
_crt_at_quick_exit
_cexit
_initialize_narrow_environment
terminate
exit
_initterm

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-math-l1-1-0

_fdopen

kernel32

GetCurrentProcessId
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry

Exports

Exports

PyInit__bz2

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e104ac4742e9a2200af2cb93c91278b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

python35

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 24B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 144B

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 24B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 144B