a9622458ff125b996f6af66e1d8b7381618c6a5fa2e307696d596031c91a0f2c

Sharing

Copy URL Twitter E-mail

General

Target

a9622458ff125b996f6af66e1d8b7381618c6a5fa2e307696d596031c91a0f2c
Size

49KB
MD5

b3e3764d318362d38248c1984b323c09
SHA1

fda1ec1b8b2b1cc98e2688900df93aa033e60695
SHA256

a9622458ff125b996f6af66e1d8b7381618c6a5fa2e307696d596031c91a0f2c
SHA512

c49f3952a602e166703cf277e4f9239a9fb37b578baeb9aa12b411446b8e6d0e886b416021b4098aba907c15b045feb4e63719bf7a91de0f209cbdf4542d1d4f
SSDEEP

768:1ILgp9h4Vh2EeEV2cUu27QZTO5VS7EQW/n/YmLsUdobkZ2nhk5gWMHy1X:1F2VEEeEV2cUu2cfIQAbsznhkvMK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9622458ff125b996f6af66e1d8b7381618c6a5fa2e307696d596031c91a0f2c

Files

a9622458ff125b996f6af66e1d8b7381618c6a5fa2e307696d596031c91a0f2c
.dll windows:6 windows x86 arch:x86

a112e1b775fb6091391d5f4589250b62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\src\pywin32\build\temp.win32-3.5\Release\PyISAPI_loader.pdb

Imports

advapi32

RegisterEventSourceW
ReportEventA
RegCloseKey
RegCreateKeyExW
RegSetValueExW
DeregisterEventSource

python35

PySys_GetObject
PyEval_InitThreads
Py_IsInitialized
Py_Initialize
PyErr_Print
_Py_VaBuildValue_SizeT
PyErr_ExceptionMatches
PyErr_Occurred
PyList_Insert
PyList_GetItem
PyList_Size
PyTuple_New
PyObject_RichCompare
PyBytes_Size
PyExc_ValueError
PyExc_TypeError
PyExc_RuntimeError
PyExc_AttributeError
_Py_NoneStruct
PyObject_Call
PyImport_ImportModule
PyEval_RestoreThread
PyEval_SaveThread
PySys_SetObject
_PyArg_ParseTuple_SizeT
PyErr_Format
PyErr_NoMemory
PyErr_Clear
PyErr_SetString
PyErr_SetObject
PyGILState_Release
PySys_WriteStderr
PyImport_ReloadModule
PyGILState_Ensure
PyDict_DelItem
PyDict_SetItem
_PyObject_CallMethod_SizeT
PyDict_GetItem
PyDict_New
PyTuple_Size
PyBytes_AsString
PyBool_FromLong
PyLong_FromVoidPtr
PyLong_AsLong
PyLong_FromLong
PyUnicode_FromWideChar
PyUnicode_AsUnicode
PyBytes_FromString
PyBytes_FromStringAndSize
PyCallable_Check
PyObject_GenericSetAttr
PyObject_GenericGetAttr
_Py_BuildValue_SizeT
PyObject_GetAttrString
PyType_Ready
_Py_TrueStruct
PyUnicode_AsUTF8String

kernel32

OutputDebugStringW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
GetModuleFileNameW
FormatMessageA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
GetLastError

vcruntime140

_CxxThrowException
__std_exception_copy
__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
__std_terminate
memset
__CxxFrameHandler3
_except_handler4_common
__std_type_info_destroy_list
__std_exception_destroy

api-ms-win-crt-string-l1-1-0

_stricmp
wcsncmp
strncpy
strncmp

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_callnewh

api-ms-win-crt-filesystem-l1-1-0

_splitpath
_wsplitpath

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_initterm
_initterm_e
terminate
_initialize_narrow_environment
_seh_filter_dll
_execute_onexit_table

Exports

Exports

GetExtensionVersion
GetFilterVersion
HttpExtensionProc
HttpFilterProc
PyISAPISetOptions
TerminateExtension
TerminateFilter
WriteEventLogMessage

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a112e1b775fb6091391d5f4589250b62

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

python35

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 3KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 76B

.rsrc Size: 1024B - Virtual size: 704B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 1024B - Virtual size: 704B

.reloc
Size: 3KB - Virtual size: 2KB