457739a201017dbe593f46b8e132dfce0d46b048049fe3be02acc36de238525e

Sharing

Copy URL Twitter E-mail

General

Target

457739a201017dbe593f46b8e132dfce0d46b048049fe3be02acc36de238525e
Size

19KB
MD5

477cd80f3ace6b02407f32bab5c0ee58
SHA1

e74aead2aa5e3de24b5adb916012e81b79dabdcb
SHA256

457739a201017dbe593f46b8e132dfce0d46b048049fe3be02acc36de238525e
SHA512

d6e01cc7801bf89b0e17dff807f9d6ebbc4b990bfcc9cdc11d74b53f1e57df410c260f3c4411ecde0f17af5301bcfdaaf0e55ac27b1c0f3795a68cf552e8829a
SSDEEP

384:/yELLWoLLozHO7xlAz/w6Li5650zs420Nu1kdHvmd94dXY4w0LeA:/yKVvozHO7xlqI6LLwNMkdC94dXby

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
457739a201017dbe593f46b8e132dfce0d46b048049fe3be02acc36de238525e

Files

457739a201017dbe593f46b8e132dfce0d46b048049fe3be02acc36de238525e
.dll windows:6 windows x86 arch:x86

6342d372f9343143ceef030fc2380b89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\src\pywin32\build\temp.win32-3.5\Release\win32trace.pdb

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

python35

PyObject_Free
PyObject_GenericGetAttr
PyObject_GetAttrString
PyType_Ready
_PyObject_New
PyUnicode_DecodeLatin1
PyDict_SetItemString
PyModule_GetDict
PyErr_SetObject
PyErr_SetString
PyArg_ParseTuple
Py_BuildValue
PyModule_Create2
PyEval_SaveThread
PyEval_RestoreThread
PySys_GetObject
PySys_SetObject
PyObject_CallObject
_Py_NoneStruct
PyExc_MemoryError
PyExc_ValueError
PyMem_Free

pywintypes35

?PyWinGlobals_Ensure@@YAHXZ
?PyWinExc_ApiError@@3PAU_object@@A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z

kernel32

TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LocalAlloc
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersionExW
CreateEventW
CreateMutexW
WaitForSingleObject
ReleaseMutex
SetEvent
GetLastError
CloseHandle

vcruntime140

wcschr
memset
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__std_type_info_destroy_list
_except_handler4_common
memcpy

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-runtime-l1-1-0

_initterm
_initialize_onexit_table
_seh_filter_dll
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
terminate
_initialize_narrow_environment
_initterm_e
_crt_at_quick_exit

Exports

Exports

PyInit_win32trace

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6342d372f9343143ceef030fc2380b89

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

python35

pywintypes35

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 28B

.rsrc Size: 1024B - Virtual size: 860B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 28B

.rsrc
Size: 1024B - Virtual size: 860B

.reloc
Size: 1KB - Virtual size: 1KB