O:\src\pywin32\build\temp.win-amd64-3.7\Release\perfmon.pdb
Static task
static1
Behavioral task
behavioral1
Sample
37b2de0474ba2a4c6a1899d161b1d9629b3b7989a1572975ba06b60ed5d12a56.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
37b2de0474ba2a4c6a1899d161b1d9629b3b7989a1572975ba06b60ed5d12a56.dll
Resource
win10v2004-20241007-en
General
-
Target
37b2de0474ba2a4c6a1899d161b1d9629b3b7989a1572975ba06b60ed5d12a56
-
Size
26KB
-
MD5
1df1e6c72f0753ee2e208d746704a237
-
SHA1
0d950fd76c8b000c7c1733c7076f5625dbc2559f
-
SHA256
37b2de0474ba2a4c6a1899d161b1d9629b3b7989a1572975ba06b60ed5d12a56
-
SHA512
b08d0aa74ef364c0e0611dece76c90c60947a01c41f5a07c924172a802ecdc82953d7be566539c2c871b1578b5f3683efab6b46b9355a0fb8dfd8d100166fb9d
-
SSDEEP
384:TLJp1noBwfZuw2jKmARUJpj5r7QB55d38+pYVOpXxi:3y2Y7Ku+pYexi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37b2de0474ba2a4c6a1899d161b1d9629b3b7989a1572975ba06b60ed5d12a56
Files
-
37b2de0474ba2a4c6a1899d161b1d9629b3b7989a1572975ba06b60ed5d12a56.dll windows:6 windows x64 arch:x64
02b89064c4d04acdc8703975473706a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
python37
PyErr_SetString
PyArg_ParseTuple
PyObject_GenericSetAttr
PyExc_TypeError
PyModule_Create2
PyModule_GetDict
PyType_Ready
PyExc_RuntimeError
PyObject_GenericGetAttr
PyLong_FromLong
PyExc_ValueError
PyExc_MemoryError
_Py_NoneStruct
PySequence_GetItem
PySequence_Size
pywintypes37
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z
?PyWinGlobals_Ensure@@YAHXZ
?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z
kernel32
RtlVirtualUnwind
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
FreeLibrary
UnmapViewOfFile
MapViewOfFile
CloseHandle
GetVersionExW
CreateFileMappingW
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
memset
__CxxFrameHandler3
__std_terminate
__C_specific_handler
api-ms-win-crt-string-l1-1-0
wcsncpy
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_register_onexit_function
terminate
_seh_filter_dll
_initialize_onexit_table
_initterm_e
_initterm
_cexit
_initialize_narrow_environment
Exports
Exports
PyInit_perfmon
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ