96af7dd03d69087505a2c63e30e3629aefbc2feccac07ad4bc8309f53a865b10N

Sharing

Copy URL Twitter E-mail

General

Target

96af7dd03d69087505a2c63e30e3629aefbc2feccac07ad4bc8309f53a865b10N
Size

1.0MB
MD5

e08756629bde3965efc7b8e6037a5a60
SHA1

bd304dfa96ab7be61f50bf921594867cd95bb49d
SHA256

96af7dd03d69087505a2c63e30e3629aefbc2feccac07ad4bc8309f53a865b10
SHA512

b6a999ca889cb3e4696d0313013e24a02316c8f9297a32781bcc4044c1aadf40fae490b844209de4f79805a7361719fdb4528838869c64e66a39c0da639097c4
SSDEEP

24576:tUjEMR2dqSShgauYc7J6edCxKbO+uezB1tP/hih2SY1xFdJ:VC2dqyJqKa+jV1tPps2SYPFdJ

Score

1^/10

Malware Config

Signatures

Files

96af7dd03d69087505a2c63e30e3629aefbc2feccac07ad4bc8309f53a865b10N
.dll windows:6 windows x86 arch:x86

7af74aefa512f0e510f2d37e412d7257

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

21:17:79:30:b7:23:fb:ff:fc:98:3e:90:de:e5:4e:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2014, 00:00

Not After

03/07/2017, 23:59

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro Falls,ST=New Hampshire,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:cd:13:67:d8:f1:05:56:2b:ff:1a:85:dc:e0:9d:14:c8:78:84:ba
Signer

Actual PE Digest

f1:cd:13:67:d8:f1:05:56:2b:ff:1a:85:dc:e0:9d:14:c8:78:84:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\cpython\PCBuild\win32\_hashlib.pdb

Imports

api-ms-win-crt-string-l1-1-0

strncpy
_strnicmp
isupper
strcpy_s
tolower
strncmp
_stricmp
isalnum
isdigit
strcmp
isxdigit
isspace

api-ms-win-crt-runtime-l1-1-0

abort
_errno
signal
_initterm
_initterm_e
_exit
_seh_filter_dll
raise
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_crt_atexit
strerror
_crt_at_quick_exit
terminate
_register_onexit_function
_cexit

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

feof
ferror
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vsscanf
fopen
fflush
fputs
fclose
__stdio_common_vfprintf
fseek
_setmode
fgets
_fileno
fwrite
ftell
fread
__stdio_common_vsprintf_s
_wfopen

api-ms-win-crt-convert-l1-1-0

atol
strtoul
strtol
atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
_gmtime64

api-ms-win-crt-heap-l1-1-0

_free_base
free
malloc
realloc
_malloc_base
_calloc_base

api-ms-win-crt-conio-l1-1-0

_getch

kernel32

FlushConsoleInputBuffer
SetLastError
EnterCriticalSection
LoadLibraryExW
LeaveCriticalSection
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
GetCurrentProcessId
CloseHandle
LoadLibraryA
GetFileType
GetProcAddress
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleA
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentThreadId
GetModuleFileNameW
WriteFile
InterlockedPushEntrySList
GetStdHandle
DeleteCriticalSection
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
RtlUnwind

user32

GetProcessWindowStation
MessageBoxA
ReleaseDC
GetDC
GetUserObjectInformationW

gdi32

CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
DeleteObject
GetObjectA

advapi32

DeregisterEventSource
ReportEventA
RegisterEventSourceA
SystemFunction036

python35

PyType_Type
PyBuffer_Release
_Py_strhex
PyUnicode_FromString
PyExc_TypeError
_PyObject_New
PyBytes_FromStringAndSize
PyFrozenSet_New
PyThread_free_lock
PyType_Ready
PyModule_Create2
PyObject_GetBuffer
PyUnicode_FromFormat
PyLong_AsLong
_PyArg_ParseTuple_SizeT
PyEval_RestoreThread
PyThread_release_lock
PyObject_Free
PyExc_OverflowError
PyErr_Format
_PyArg_ParseTupleAndKeywords_SizeT
PyExc_ValueError
PyErr_SetString
PySet_Add
PyThread_acquire_lock
_Py_NoneStruct
PyThread_allocate_lock
PyLong_FromLong
PyEval_SaveThread
PyErr_Occurred
PyExc_BufferError
PyModule_AddObject
_PyArg_Parse_SizeT

Exports

Exports

PyInit__hashlib

Sections

.text
Size: 779KB - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7af74aefa512f0e510f2d37e412d7257

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

21:17:79:30:b7:23:fb:ff:fc:98:3e:90:de:e5:4e:3fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f1:cd:13:67:d8:f1:05:56:2b:ff:1a:85:dc:e0:9d:14:c8:78:84:baSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-conio-l1-1-0

kernel32

user32

gdi32

advapi32

python35

Exports

Exports

Sections

.text Size: 779KB - Virtual size: 778KB

.rdata Size: 202KB - Virtual size: 201KB

.data Size: 21KB - Virtual size: 33KB

.reloc Size: 42KB - Virtual size: 42KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

21:17:79:30:b7:23:fb:ff:fc:98:3e:90:de:e5:4e:3f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f1:cd:13:67:d8:f1:05:56:2b:ff:1a:85:dc:e0:9d:14:c8:78:84:ba
Signer

.text
Size: 779KB - Virtual size: 778KB

.rdata
Size: 202KB - Virtual size: 201KB

.data
Size: 21KB - Virtual size: 33KB

.reloc
Size: 42KB - Virtual size: 42KB