a294f1b492fe3c916c70a5f9f123df42b2f93ed5c611ef3722eae3e178732a21

Sharing

Copy URL Twitter E-mail

General

Target

a294f1b492fe3c916c70a5f9f123df42b2f93ed5c611ef3722eae3e178732a21
Size

24KB
MD5

3d8d719d1dba0df880157adda02d9dca
SHA1

a812a4b9238f20999cd70504fac4f72be87e9055
SHA256

a294f1b492fe3c916c70a5f9f123df42b2f93ed5c611ef3722eae3e178732a21
SHA512

82ad8d8715a1ffff2f020ede8538eaba3a116adb7be6965e15173090c77cef3515fa067fbdb726664c1ab62cc4f5883a35360568e0765bc197de62be2690f73e
SSDEEP

768:ulA3nBMF3G99FwifVvSx2M8EeeamyWzuiXx:ul6Go9FwiNvGFyWzuiXx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a294f1b492fe3c916c70a5f9f123df42b2f93ed5c611ef3722eae3e178732a21

Files

a294f1b492fe3c916c70a5f9f123df42b2f93ed5c611ef3722eae3e178732a21
.dll windows:6 windows x86 arch:x86

0fffb0d2bb5ad1ccb749dde0a75450a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\src\pywin32\build\temp.win32-3.5\Release\win32ras.pdb

Imports

rasapi32

RasGetEntryDialParamsW
RasSetEntryDialParamsW
RasEditPhonebookEntryW
RasCreatePhonebookEntryW
RasHangUpW
RasGetErrorStringW
RasGetConnectStatusW
RasEnumEntriesW
RasEnumConnectionsW
RasDialW

user32

IsWindow

python35

PyObject_GenericGetAttr
PyObject_GenericSetAttr
PyCallable_Check
PyUnicode_AsUTF8
PyLong_FromLong
PyLong_AsLong
PyLong_FromVoidPtr
PyBool_FromLong
PyExc_ValueError
PyExc_TypeError
PyExc_RuntimeError
PyExc_MemoryError
PyExc_AttributeError
_Py_NoneStruct
PyMapping_HasKey
PySequence_Tuple
PyEval_InitThreads
PyEval_RestoreThread
PyEval_SaveThread
PyEval_CallObjectWithKeywords
PyErr_Print
PyModule_Create2
PyModule_AddIntConstant
Py_BuildValue
PyArg_ParseTuple
PyTuple_New
PyErr_NoMemory
PyErr_Clear
PyErr_Occurred
PyErr_SetString
PyErr_SetObject
PyGILState_Release
PyGILState_Ensure
PyModule_GetDict
PyDict_SetItemString
PyErr_Format
PyDict_DelItem
PyDict_SetItem
PyDict_GetItem
PyDict_New
PyList_New
PyType_Ready

pywintypes35

?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z
?PyWinExc_ApiError@@3PAU_object@@A
?PyWinGlobals_Ensure@@YAHXZ
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z
?PyWinObject_FreeWCHAR@@YAXPA_W@Z

kernel32

GetLastError
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
FormatMessageW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_type_info_destroy_list
__telemetry_main_invoke_trigger
memset
__CxxFrameHandler3
__std_terminate
__telemetry_main_return_trigger
_except_handler4_common

api-ms-win-crt-string-l1-1-0

wcsncpy

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_initialize_narrow_environment
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_seh_filter_dll
_execute_onexit_table
_initterm
_initterm_e

Exports

Exports

PyInit_win32ras
ReturnRasError

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0fffb0d2bb5ad1ccb749dde0a75450a3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rasapi32

user32

python35

pywintypes35

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 76B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 76B

.reloc
Size: 1KB - Virtual size: 1KB