9dce1034305919acb8a30a4f797ac0c78b5879fe71b2d536d5cd03c0e7169f9fN

Sharing

Copy URL Twitter E-mail

General

Target

9dce1034305919acb8a30a4f797ac0c78b5879fe71b2d536d5cd03c0e7169f9fN
Size

88KB
MD5

4c9a39bd1ec08906a278aee75be825a0
SHA1

39bac1f630d9f4c7df2b5403a27896746ee8e6b7
SHA256

9dce1034305919acb8a30a4f797ac0c78b5879fe71b2d536d5cd03c0e7169f9f
SHA512

c8691c46cfe378367555b8a63297ad19a9c4aeb65dbbc23ec8bb93027b21b4a497b2b2c958dbf175ca830aabd901ddccf2b4241b0967fd36871a0ec828f36063
SSDEEP

1536:VP8dkxbey2J5BPeqEnuaDH7dO95NHBwS9a9/mWc:FgyK5BPeqEnuCH7kHBwwE/mWc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9dce1034305919acb8a30a4f797ac0c78b5879fe71b2d536d5cd03c0e7169f9fN

Files

9dce1034305919acb8a30a4f797ac0c78b5879fe71b2d536d5cd03c0e7169f9fN
.dll windows:6 windows x64 arch:x64

c546fb690129c65dca42c79fb329c718

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

O:\src\pywin32\build\temp.win-amd64-3.6\Release\adsi.pdb

Imports

activeds

ord4
ord9
ord13
ord15
ord3

advapi32

GetSecurityDescriptorLength

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

python36

PyModule_GetDict
PyErr_SetString
PyArg_ParseTuple
Py_BuildValue
PyModule_Create2
PyEval_SaveThread
PyEval_RestoreThread
_Py_NoneStruct
PyExc_MemoryError
PyBytes_AsString
PyObject_GenericGetAttr
PyLong_FromLong
PyObject_GenericSetAttr
PyBytes_FromString
PyUnicode_AsUTF8
PyLong_AsLong
PyDict_SetItemString
PyErr_WarnEx
PyErr_NoMemory
PyErr_Format
PySequence_Check
PySequence_Size
PySequence_GetItem
_Py_FalseStruct
_Py_TrueStruct
PyExc_TypeError
PyExc_ValueError
PyExc_RuntimeWarning
PyErr_Occurred
PyErr_Clear
PyType_Ready
PyExc_AttributeError
PyExc_IndexError
PyTuple_New
PyList_Append
PyTuple_Size
PyList_New

pywintypes36

?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z
?PyWinExc_COMError@@3PEAU_object@@EA
?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_FromSECURITY_DESCRIPTOR@@YAPEAU_object@@PEAX@Z
?PyWinTime_Check@@YAHPEAU_object@@@Z
?PyWinObject_AsSYSTEMTIME@@YAHPEAU_object@@PEAU_SYSTEMTIME@@@Z
?PyWinObject_FromSYSTEMTIME@@YAPEAU_object@@AEBU_SYSTEMTIME@@@Z
?PyWinObject_FromLARGE_INTEGER@@YAPEAU_object@@AEAT_LARGE_INTEGER@@@Z
?PyWinObject_AsLARGE_INTEGER@@YAHPEAU_object@@PEAT_LARGE_INTEGER@@@Z
?PyWinObject_AsWriteBuffer@@YAHPEAU_object@@PEAPEAXPEAKH@Z
?PyBuffer_New@@YAPEAU_object@@_J@Z
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z
?PyWinObject_AsWCHARArray@@YAHPEAU_object@@PEAPEAPEA_WPEAKH@Z
?PyWinObject_FreeWCHARArray@@YAXPEAPEA_WK@Z
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z

pythoncom36

PyCom_PyObjectFromVariant
?MakeBstrToObj@@YAPEAU_object@@QEA_W@Z
?PyCom_BuildPyExceptionFromEXCEPINFO@@YAPEAU_object@@JPEAUtagEXCEPINFO@@I@Z
?type@PyIUnknown@@2VPyComTypeObject@@A
??1PyIUnknown@@MEAA@XZ
?GetI@PyIUnknown@@SAPEAUIUnknown@@PEAU_object@@@Z
?getattro@PyIBase@@SAPEAU_object@@PEAU2@0@Z
?type@PyIDispatch@@2VPyComTypeObject@@A
?setattr@PyIBase@@UEAAHPEADPEAU_object@@@Z
?repr@PyIUnknown@@UEAAPEAU_object@@XZ
?iternext@PyIBase@@UEAAPEAU_object@@XZ
?iter@PyIBase@@UEAAPEAU_object@@XZ
?getattr@PyIBase@@UEAAPEAU_object@@PEAD@Z
?compare@PyIUnknown@@UEAAHPEAU_object@@@Z
??1PyIDispatch@@MEAA@XZ
??0PyIDispatch@@IEAA@PEAUIUnknown@@@Z
?GetI@PyIDispatch@@SAPEAUIDispatch@@PEAU_object@@@Z
PyCom_VariantFromPyObject
??1PyComTypeObject@@QEAA@XZ
??0PyComTypeObject@@QEAA@PEBDPEAV0@HPEAUPyMethodDef@@P6APEAVPyIUnknown@@PEAUIUnknown@@@Z@Z
?PyCom_RegisterClientType@@YAHPEAU_typeobject@@PEBU_GUID@@@Z
?PyObConstruct@PyIEnumVARIANT@@SAPEAVPyIUnknown@@PEAUIUnknown@@@Z
?PyCom_BuildPyException@@YAPEAU_object@@JPEAUIUnknown@@AEBU_GUID@@@Z
PyCom_PyObjectFromIUnknown
?PyCom_InterfaceFromPyInstanceOrObject@@YAHPEAU_object@@AEBU_GUID@@PEAPEAXH@Z
??0PyIUnknown@@IEAA@PEAUIUnknown@@@Z

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
RtlCaptureContext

vcruntime140

__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
__C_specific_handler
__std_terminate
memcpy
__CxxFrameHandler3
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

wcsncpy
strcmp

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_cexit
_initterm
_crt_at_quick_exit
terminate
_crt_atexit
_initialize_narrow_environment
_execute_onexit_table
_register_onexit_function
_initterm_e
_initialize_onexit_table
_seh_filter_dll

Exports

Exports

PyInit_adsi

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c546fb690129c65dca42c79fb329c718

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

activeds

advapi32

oleaut32

python36

pywintypes36

pythoncom36

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 6KB - Virtual size: 8KB

.pdata Size: 4KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 52B

.rsrc Size: 1024B - Virtual size: 836B

.reloc Size: 1024B - Virtual size: 596B

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 6KB - Virtual size: 8KB

.pdata
Size: 4KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 52B

.rsrc
Size: 1024B - Virtual size: 836B

.reloc
Size: 1024B - Virtual size: 596B