d64794e31f341f87c7cc6995d66d77fd6dc5e1601f0faecead6b92190110ba1dN

Sharing

Copy URL

Twitter E-mail

General

Target

d64794e31f341f87c7cc6995d66d77fd6dc5e1601f0faecead6b92190110ba1dN
Size

142KB
MD5

8234b35b498a39cf7439d6ea358a3970
SHA1

5e0730cd7026dee57dbf91a03ff83518d9c56d32
SHA256

d64794e31f341f87c7cc6995d66d77fd6dc5e1601f0faecead6b92190110ba1d
SHA512

1d5cc4c5255ec6d0d432e05f16fce35787e2f7a66b2cfc23b7e0901063254c68c41b8cc7e4c59ffeb9ea2ca914ae9a118e99980d35c914d98f4e891f218e57db
SSDEEP

3072:vQMKdf2cTtMdbPsiZkuomv58OW45mlnMx8DzMZ:vQxf2cTydbPqfmB8O0lMx8Dz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d64794e31f341f87c7cc6995d66d77fd6dc5e1601f0faecead6b92190110ba1dN

Files

d64794e31f341f87c7cc6995d66d77fd6dc5e1601f0faecead6b92190110ba1dN
.dll windows:6 windows x64 arch:x64

9f77950aa74ed0d1082507b5a687f4cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

geode-explicit_brep

?build@BRepExplicitModeler@geode@@QEAA?AV?$tuple@VBRep@geode@@UModelMappings@2@@std@@XZ
?add_brep@BRepExplicitModeler@geode@@QEAAXAEBVBRep@2@@Z
?add_surface@BRepExplicitModeler@geode@@QEAAXAEBV?$Surface@$02@2@@Z
?add_line@BRepExplicitModeler@geode@@QEAAXAEBV?$Line@$02@2@@Z
?add_corner@BRepExplicitModeler@geode@@QEAAXAEBV?$Corner@$02@2@@Z
?add_triangulated_surface@BRepExplicitModeler@geode@@QEAAXAEBV?$TriangulatedSurface@$02@2@@Z
?add_curve@BRepExplicitModeler@geode@@QEAAXAEBV?$EdgedCurve@$02@2@@Z
?add_point_set@BRepExplicitModeler@geode@@QEAAXAEBV?$PointSet@$02@2@@Z
??1BRepExplicitModeler@geode@@QEAA@XZ
??0BRepExplicitModeler@geode@@QEAA@XZ
?build@BRepVolumicInserter@geode@@QEBA?AV?$tuple@VBRep@geode@@UBRepMappings@2@@std@@XZ
?add_scalar_isovalues@BRepVolumicInserter@geode@@QEAAXV?$basic_string_view@DU?$char_traits@D@std@@@std@@V?$Span@$$CBN@absl@@@Z
??1BRepVolumicInserter@geode@@QEAA@XZ
??0BRepVolumicInserter@geode@@QEAA@$$QEAVBRep@1@@Z
??0BRepVolumicInserter@geode@@QEAA@$$QEAV01@@Z
?initialize@ExplicitBRepLibrary@geode@@SAXXZ

python39

PyThreadState_DeleteCurrent
PyExc_TypeError
PyThreadState_Clear
PyCapsule_Type
PyDict_Copy
PyObject_Str
PyUnicode_AsUTF8String
PyList_GetItem
PyFrame_GetBack
PyFrame_GetCode
PyExc_IndexError
PyExc_ImportError
PyCapsule_SetPointer
_Py_TrueStruct
PyExc_SystemError
PyObject_SetItem
PyException_SetCause
PyInterpreterState_Get
PyDict_DelItemString
PyUnicode_FromString
PyEval_AcquireThread
_PyType_Lookup
PyGILState_GetThisThreadState
PyBuffer_Release
PyObject_Repr
PyByteArray_Type
PyNumber_Float
PyType_Type
PySequence_Tuple
_PyObject_GetDictPtr
PyDict_New
PyBytes_Size
PyCapsule_GetName
PyCapsule_New
PyException_SetTraceback
PyThread_tss_get
PyTuple_Size
PyNumber_Check
PyObject_GetAttrString
PyType_Ready
PyModule_Create2
PyList_New
PyUnicode_FromFormat
PyObject_ClearWeakRefs
PyObject_GenericGetDict
PyObject_CallFunctionObjArgs
PyErr_Fetch
PyCapsule_GetPointer
PyTuple_GetItem
_Py_Dealloc
PyExc_OverflowError
PyErr_Restore
PyType_IsSubtype
PyFloat_Type
_Py_FalseStruct
PyThreadState_New
PyDict_Type
PyErr_Format
PyDict_Next
PyExc_ValueError
PyErr_WriteUnraisable
PyErr_SetString
PyByteArray_AsString
PyList_Size
PyDict_Size
PyObject_GenericSetDict
PyTuple_New
_Py_NoneStruct
PyCapsule_SetContext
PyGILState_Ensure
PyBytes_AsStringAndSize
PyByteArray_Size
PyGILState_Release
PyFloat_AsDouble
_Py_NotImplementedStruct
PyProperty_Type
PyFrame_GetLineNumber
PyObject_HasAttrString
PyObject_CallObject
PyThread_tss_set
PyCMethod_New
PyTuple_SetItem
PyMem_Free
PyObject_IsInstance
PyInstanceMethod_New
PyCapsule_GetContext
PyErr_Clear
PyException_SetContext
Py_GetVersion
PyDict_GetItemWithError
PyExc_MemoryError
PyInstanceMethod_Type
PyObject_GC_UnTrack
PyObject_SetAttrString
PyExc_RuntimeError
_PyThreadState_UncheckedGet
PyEval_SaveThread
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyErr_Occurred
PySequence_GetItem
PyErr_NormalizeException
PyBytes_AsString
PyObject_Malloc
PyThreadState_Get
PyWeakref_NewRef
PyCFunction_Type
PyObject_SetAttr
PyExc_BufferError
PyMem_Calloc
PyBaseObject_Type
PyInterpreterState_GetDict
PyUnicode_AsEncodedString
PySequence_Size
PyThread_tss_create
PyModule_Type

opengeode_model

??0BRep@geode@@QEAA@$$QEAV01@@Z
??1BRep@geode@@QEAA@XZ
?clone@BRep@geode@@QEBA?AV12@XZ

msvcp140

?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCompare@@YA_NPEBX0@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_name
__std_type_info_hash
_purecall
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
memchr
strchr
__std_type_info_destroy_list
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memset
memcmp
memcpy
memmove
__std_terminate
__RTDynamicCast

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
malloc
_callnewh
free
_aligned_free

api-ms-win-crt-string-l1-1-0

_strdup
strcmp
strncmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

PyInit_geode_explicit_py_brep

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f77950aa74ed0d1082507b5a687f4cb

Headers

DLL Characteristics

File Characteristics

Imports

geode-explicit_brep

python39

opengeode_model

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 102KB - Virtual size: 101KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 212B

.text
Size: 102KB - Virtual size: 101KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 212B