8fbe403222f92f1f4f8ace19be0d1bca64d01f8d78e65136e133537a747a60e1

Sharing

Copy URL Twitter E-mail

General

Target

8fbe403222f92f1f4f8ace19be0d1bca64d01f8d78e65136e133537a747a60e1
Size

1.9MB
MD5

2ef2ca3abef2de498fe81ae1d3a8cac8
SHA1

d745ba1ec222ee563a2f6603b02ada867a6da08d
SHA256

8fbe403222f92f1f4f8ace19be0d1bca64d01f8d78e65136e133537a747a60e1
SHA512

69fa17dd51aea93aac15b7a825abd83f663fd086e83a3aa799ee14a45790dc8f4ba03554f1889bb706aace659a3ddf85fdca53e40263789e50f8bb840b66847d
SSDEEP

49152:tbGtlqLVwASORpIU6iFwhJ8IofsTirfZOh5PQPT3FIH5dPUVH7Psu:FO+ChBuNxFM+VHH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8fbe403222f92f1f4f8ace19be0d1bca64d01f8d78e65136e133537a747a60e1

Files

8fbe403222f92f1f4f8ace19be0d1bca64d01f8d78e65136e133537a747a60e1
.dll windows:6 windows x64 arch:x64

723c448305606c2540f852c3cb7b2233

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

python312

PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyEval_SaveThread
PyObject_SetAttrString
PyObject_GC_UnTrack
PyInstanceMethod_Type
PyExc_MemoryError
PyDict_GetItemWithError
Py_GetVersion
PyCapsule_GetContext
PyFrame_GetLineNumber
PyGILState_Release
PyBytes_AsStringAndSize
_Py_NoneStruct
PyTuple_New
PyObject_GenericSetDict
PyDict_Size
PyList_Size
PyByteArray_AsString
PyErr_SetString
PyErr_WriteUnraisable
PyExc_ValueError
PyErr_Format
PyDict_Type
PyThreadState_New
_Py_FalseStruct
PyType_IsSubtype
PyErr_Restore
PyExc_OverflowError
_Py_Dealloc
PyTuple_GetItem
PyCapsule_GetPointer
PyErr_Fetch
PyObject_CallFunctionObjArgs
PyObject_GenericGetDict
PyObject_ClearWeakRefs
PyUnicode_FromFormat
PyList_New
PyModule_Create2
PyType_Ready
PyObject_GetAttrString
PyErr_Clear
PyTuple_Size
PyThread_tss_get
PyException_SetTraceback
PyCapsule_New
PyCapsule_GetName
PyBytes_Size
PyDict_New
PyList_GetItem
PyException_SetContext
PyInstanceMethod_New
PyObject_IsInstance
PyMem_Free
PyTuple_SetItem
PyCMethod_New
PyThread_tss_set
PyObject_CallObject
PyObject_HasAttrString
PyProperty_Type
_Py_NotImplementedStruct
PyByteArray_Size
PyGILState_Ensure
PyCapsule_SetContext
PyThreadState_DeleteCurrent
PyExc_TypeError
PyThreadState_Clear
PyCapsule_Type
PyDict_Copy
PyObject_Str
PyUnicode_AsUTF8String
PyModule_Type
PyFrame_GetBack
PyFrame_GetCode
PyExc_IndexError
PyExc_ImportError
PyCapsule_SetPointer
_Py_TrueStruct
PyExc_SystemError
PyObject_SetItem
PyException_SetCause
PyInterpreterState_Get
PyDict_DelItemString
PyUnicode_FromString
PyEval_AcquireThread
_PyType_Lookup
PyGILState_GetThisThreadState
PyBuffer_Release
PyObject_Repr
PyByteArray_Type
PyType_Type
PySequence_Tuple
_PyObject_GetDictPtr
PyUnicode_AsEncodedString
PyDict_Next
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyErr_Occurred
PyErr_NormalizeException
PyBytes_AsString
PyObject_Malloc
PyThreadState_Get
PyWeakref_NewRef
PyCFunction_Type
PyObject_SetAttr
PyExc_BufferError
PyMem_Calloc
PyBaseObject_Type
PyInterpreterState_GetDict
PyThread_tss_create

opengeode_basic

?lock@Singleton@geode@@CAAEAVmutex@std@@XZ
?set_instance@Singleton@geode@@CAXAEBVtype_info@@PEAV12@@Z
?instance@Singleton@geode@@CAPEAV12@AEBVtype_info@@@Z
?call_initialize@Library@geode@@IEAAXPEBD@Z
??1Library@geode@@UEAA@XZ
??0Library@geode@@IEAA@XZ

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext

ws2_32

closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

kernel32

LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetModuleHandleExW
GetSystemTimeAsFileTime
ConvertFiberToThread
RtlVirtualUnwind
CloseHandle
FreeLibrary
LoadLibraryA
WriteFile
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
GetCurrentThreadId
TlsAlloc
TlsGetValue
GetFileType
InitializeCriticalSectionAndSpinCount
TlsFree
GetStdHandle
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
QueryPerformanceCounter
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
DisableThreadLibraryCalls
IsDebuggerPresent
DeleteFiber
MultiByteToWideChar
GetCurrentProcessId
GetProcAddress
TlsSetValue
DeleteCriticalSection
LoadLibraryW
GetModuleHandleW

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

advapi32

CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

msvcp140

_Mtx_unlock
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCompare@@YA_NPEBX0@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy
__std_exception_copy
__std_type_info_compare
_purecall
__std_type_info_hash
__std_type_info_name
__std_terminate
strchr
_CxxThrowException
memcpy
memmove
memchr
memcmp
memset
wcsstr
strrchr
strstr
__std_type_info_destroy_list
__current_exception
__current_exception_context
__C_specific_handler
__RTDynamicCast

api-ms-win-crt-string-l1-1-0

isspace
strncmp
_strdup
strncpy
_strnicmp
strcmp
_stricmp
strspn
strcspn

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_callnewh
_aligned_free
_aligned_malloc

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
signal
_seh_filter_dll
_initterm_e
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
terminate
_initialize_narrow_environment
_errno
_execute_onexit_table
_crt_atexit
_exit
raise
strerror_s
_initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
fflush
feof
fgets
_fileno
fread
__stdio_common_vsscanf
fwrite
ferror
fseek
ftell
_setmode
fclose
_wfopen
fopen
fputs

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64

api-ms-win-crt-utility-l1-1-0

qsort

Exports

Exports

PyInit_geode_common_py_core

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

723c448305606c2540f852c3cb7b2233

Headers

DLL Characteristics

File Characteristics

Imports

python312

opengeode_basic

crypt32

ws2_32

kernel32

user32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 482KB - Virtual size: 481KB

.data Size: 9KB - Virtual size: 22KB

.pdata Size: 53KB - Virtual size: 52KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 482KB - Virtual size: 481KB

.data
Size: 9KB - Virtual size: 22KB

.pdata
Size: 53KB - Virtual size: 52KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 19KB - Virtual size: 18KB