dfe25e88e8d2eb9413ae1a22e26c59475b35147762224255a4d57fd5e792ff72N

Sharing

Copy URL Twitter E-mail

General

Target

dfe25e88e8d2eb9413ae1a22e26c59475b35147762224255a4d57fd5e792ff72N
Size

25KB
MD5

24a5b53ff675cd4de4f7f551a7565360
SHA1

739d967fd4754a2eba712e7f592369e38806e798
SHA256

dfe25e88e8d2eb9413ae1a22e26c59475b35147762224255a4d57fd5e792ff72
SHA512

9fc039723207c34f060f88618dbd5cb6152c02f67659379994381ab2464fe8e6e996f3abb8fccec1064d1bfc9d0c69f17644bd41d75122fc1506bdeae5b234c8
SSDEEP

384:q7Xd1noBTnxuw2jKmARUJsCl7xd5rp38+5YVOpX:qE7o7tS+5Ye

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfe25e88e8d2eb9413ae1a22e26c59475b35147762224255a4d57fd5e792ff72N

Files

dfe25e88e8d2eb9413ae1a22e26c59475b35147762224255a4d57fd5e792ff72N
.dll windows:6 windows x64 arch:x64

962655a0d69003c9e3fd65592391931b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

O:\src\pywin32\build\temp.win-amd64-3.5\Release\perfmon.pdb

Imports

python35

PyErr_SetString
PyArg_ParseTuple
PyObject_GenericSetAttr
PyExc_TypeError
PyModule_Create2
PyModule_GetDict
PyType_Ready
PyExc_RuntimeError
PyObject_GenericGetAttr
PyLong_FromLong
PyExc_ValueError
PyExc_MemoryError
_Py_NoneStruct
PySequence_GetItem
PySequence_Size

pywintypes35

?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z
?PyWinGlobals_Ensure@@YAHXZ
?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z

kernel32

RtlVirtualUnwind
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
FreeLibrary
UnmapViewOfFile
MapViewOfFile
CloseHandle
GetVersionExW
CreateFileMappingW

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
memset
__CxxFrameHandler3
__std_terminate
__C_specific_handler

api-ms-win-crt-string-l1-1-0

wcsncpy

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_register_onexit_function
terminate
_seh_filter_dll
_initialize_onexit_table
_initterm_e
_initterm
_cexit
_initialize_narrow_environment

Exports

Exports

PyInit_perfmon

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

962655a0d69003c9e3fd65592391931b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

python35

pywintypes35

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 52B

.reloc Size: 512B - Virtual size: 156B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 52B

.reloc
Size: 512B - Virtual size: 156B