11449948f92ff7db46e05a0688f440a9f772deb99283f02491424b1cde1c418fN

Sharing

Copy URL Twitter E-mail

General

Target

11449948f92ff7db46e05a0688f440a9f772deb99283f02491424b1cde1c418fN
Size

38KB
MD5

cc5c0e4912b2d13cbd94898ebb635ab0
SHA1

746316b8625b4876f4bcd3f1bac0bac2aa655243
SHA256

11449948f92ff7db46e05a0688f440a9f772deb99283f02491424b1cde1c418f
SHA512

2316d06984fe4c7d835c7170531aab1cc1c411a6c399b0bdd529d588a8071dd433fb05451e014e4df0be47e131257b4e6ce90b9e9962b26ea0d6ce838940fe33
SSDEEP

768:jcujH1/dkHAHxjMTXDzhXxLrJy+yGzTP8P:AujHNQiKTXfhJrJyDGzTUP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11449948f92ff7db46e05a0688f440a9f772deb99283f02491424b1cde1c418fN

Files

11449948f92ff7db46e05a0688f440a9f772deb99283f02491424b1cde1c418fN
.dll windows:6 windows x64 arch:x64

4bc7796b0caff24e1eb435a3150aa498

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

O:\src\pywin32\build\temp.win-amd64-3.6\Release\servicemanager.pdb

Imports

user32

PeekMessageW
DispatchMessageW
wsprintfW
LoadStringW

ole32

CoInitializeEx
CoUninitialize

advapi32

ReportEventW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
RegSetValueExW
RegSetValueW
RegQueryValueExW
RegOpenKeyW
DeregisterEventSource
RegisterEventSourceW
RegCloseKey
RegCreateKeyExW

shell32

CommandLineToArgvW

python36

PyExc_MemoryError
_Py_TrueStruct
_Py_FalseStruct
_Py_NoneStruct
PySequence_GetItem
PySequence_Size
PySequence_Check
PyObject_CallObject
PyImport_Import
PySys_SetArgv
PyExc_TypeError
PyEval_InitThreads
PyEval_RestoreThread
PyEval_SaveThread
Py_Initialize
Py_SetProgramName
PyModule_Create2
PyModule_AddIntConstant
Py_BuildValue
PyArg_ParseTuple
PyErr_NewException
PyErr_ExceptionMatches
PyErr_Restore
PyErr_Fetch
PyErr_Clear
PyErr_Occurred
PyExc_ValueError
PyBytes_FromStringAndSize
PyCallable_Check
PyObject_GetAttr
PyObject_GetAttrString
PySys_GetObject
PyErr_SetString
PyGILState_Release
PyGILState_Ensure
PyModule_GetDict
PyDict_SetItemString
PyList_Insert
PyTuple_New
PyLong_AsUnsignedLongMask
PyLong_FromLong
PyBytes_AsString

pywintypes36

?GetPythonTraceback@@YAPEADPEAU_object@@00@Z
?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z
?PyWinLong_FromVoidPtr@@YAPEAU_object@@PEBX@Z
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z
?PyWinGlobals_Ensure@@YAHXZ
?PyWinLong_FromHANDLE@@YAPEAU_object@@PEAX@Z
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z

kernel32

GetModuleFileNameW
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCommandLineW
GetModuleHandleW
IsDebuggerPresent
GetProcAddress
LocalFree
FormatMessageW
LoadLibraryW
MultiByteToWideChar
SetConsoleCtrlHandler
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

vcruntime140

__telemetry_main_invoke_trigger
memset
__CxxFrameHandler3
wcsrchr
__telemetry_main_return_trigger
__C_specific_handler
__std_type_info_destroy_list
__std_exception_copy
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf
__stdio_common_vfprintf
__stdio_common_vswprintf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

_wcsdup
wcsncpy
_wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-filesystem-l1-1-0

_wchdir

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_seh_filter_dll
_initterm
_initterm_e

Exports

Exports

DllMain
PyInit_servicemanager
PythonService_Finalize
PythonService_Initialize
PythonService_PrepareToHostMultiple
PythonService_PrepareToHostSingle
PythonService_StartServiceCtrlDispatcher
PythonService_main

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4bc7796b0caff24e1eb435a3150aa498

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

ole32

advapi32

shell32

python36

pywintypes36

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 52B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 136B

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 52B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 136B