2c7a80a1c185fe4894a423aa8c131f71b4b644e89aacb2b43b88f9f86577e8ef

Sharing

Copy URL Twitter E-mail

General

Target

2c7a80a1c185fe4894a423aa8c131f71b4b644e89aacb2b43b88f9f86577e8ef
Size

96KB
MD5

a888e39ea89adbedf67ab36c6b560837
SHA1

21add45f6117f678d6565deae347eb890dddad1c
SHA256

2c7a80a1c185fe4894a423aa8c131f71b4b644e89aacb2b43b88f9f86577e8ef
SHA512

39d0287478ebd05bcc30353783bf5ec54c82ca3acf191bbd685684391417effd16125fc108ca49b70409c6e3f5db88f4b43a7071b8d8d7235ace618f5b125de6
SSDEEP

1536:T9uIjLtsHpDuLT3pod+cqtQE5+3TqEnMKAAYoXbm5/TRNTdEQ:0h0T3mccqtQEWqEnMKAAYcy5/Tb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c7a80a1c185fe4894a423aa8c131f71b4b644e89aacb2b43b88f9f86577e8ef

Files

2c7a80a1c185fe4894a423aa8c131f71b4b644e89aacb2b43b88f9f86577e8ef
.dll windows:6 windows x64 arch:x64

9ae2e579eeda316606ec0d4d68b58980

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\adsi.pdb

Imports

activeds

ord15
ord4
ord9
ord3
ord13

advapi32

GetSecurityDescriptorLength

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

python312

PySequence_GetItem
PyExc_RuntimeWarning
PyErr_WarnEx
PyObject_GenericGetAttr
PyLong_FromLong
Py_BuildValue
PyBytes_FromString
_Py_NoneStruct
PyTuple_New
PyErr_SetString
PyExc_ValueError
PyErr_Format
PySequence_Size
_Py_FalseStruct
PyExc_TypeError
_Py_TrueStruct
PyArg_ParseTuple
_Py_BuildValue_SizeT
PyBytes_AsString
PyErr_Occurred
PyExc_AttributeError
_PyArg_ParseTuple_SizeT
PyErr_Clear
PyExc_IndexError
PyEval_SaveThread
PyEval_RestoreThread
PyList_Append
PyLong_FromSsize_t
PyExc_MemoryError
PyDict_SetItemString
PyModule_GetDict
PyModule_Create2
PyType_Ready
PyErr_NoMemory
_Py_NewReference
PySequence_Check
PyObject_GenericSetAttr
PyTuple_Size
PyList_New
_Py_Dealloc
PyLong_AsLong
PyUnicode_AsUTF8

pywintypes312

?PyWinObject_FromSECURITY_DESCRIPTOR@@YAPEAU_object@@PEAX@Z
?PyWinObject_FromLARGE_INTEGER@@YAPEAU_object@@AEBT_LARGE_INTEGER@@@Z
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z
?PyWinObject_FromSYSTEMTIME@@YAPEAU_object@@AEBU_SYSTEMTIME@@@Z
?PyWinObject_AsSYSTEMTIME@@YAHPEAU_object@@PEAU_SYSTEMTIME@@@Z
?PyWinObject_AsLARGE_INTEGER@@YAHPEAU_object@@PEAT_LARGE_INTEGER@@@Z
?PyWinExc_COMError@@3PEAU_object@@EA
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z
?PyWinObject_FreeWCHARArray@@YAXPEAPEA_WK@Z
?PyWinObject_AsWCHARArray@@YAHPEAU_object@@PEAPEAPEA_WPEAKH@Z
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z
?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z
??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z
??1PyWinBufferView@@QEAA@XZ
?ok@PyWinBufferView@@QEAA_NXZ
?ptr@PyWinBufferView@@QEAAPEAXXZ
?PyBuffer_New@@YAPEAU_object@@_J@Z
?PyWinTime_Check@@YAHPEAU_object@@@Z

pythoncom312

?PyCom_RegisterClientType@@YAHPEAU_typeobject@@PEBU_GUID@@@Z
?PyCom_BuildPyException@@YAPEAU_object@@JPEAUIUnknown@@AEBU_GUID@@@Z
?GetI@PyIUnknown@@SAPEAUIUnknown@@PEAU_object@@@Z
??1PyIUnknown@@MEAA@XZ
?PyCom_InterfaceFromPyInstanceOrObject@@YAHPEAU_object@@AEBU_GUID@@PEAPEAXH@Z
?PyObConstruct@PyIEnumVARIANT@@SAPEAVPyIUnknown@@PEAUIUnknown@@@Z
?type@PyIUnknown@@2VPyComTypeObject@@A
PyCom_PyObjectFromIUnknown
?iter@PyIBase@@UEAAPEAU_object@@XZ
?iternext@PyIBase@@UEAAPEAU_object@@XZ
?repr@PyIUnknown@@UEAAPEAU_object@@XZ
?compare@PyIUnknown@@UEAAHPEAU_object@@@Z
PyCom_VariantFromPyObject
??0PyComTypeObject@@QEAA@PEBDPEAV0@_JPEAUPyMethodDef@@P6APEAVPyIUnknown@@PEAUIUnknown@@@Z@Z
??1PyComTypeObject@@QEAA@XZ
?GetI@PyIDispatch@@SAPEAUIDispatch@@PEAU_object@@@Z
??0PyIDispatch@@IEAA@PEAUIUnknown@@@Z
??1PyIDispatch@@MEAA@XZ
?type@PyIDispatch@@2VPyComTypeObject@@A
?getattr@PyIBase@@UEAAPEAU_object@@PEAD@Z
?setattr@PyIBase@@UEAAHPEADPEAU_object@@@Z
?getattro@PyIBase@@SAPEAU_object@@PEAU2@0@Z
?MakeBstrToObj@@YAPEAU_object@@QEA_W@Z
PyCom_PyObjectFromVariant
?PyCom_BuildPyExceptionFromEXCEPINFO@@YAPEAU_object@@JPEAUtagEXCEPINFO@@I@Z
??0PyIUnknown@@IEAA@PEAUIUnknown@@@Z

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
RtlCaptureContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
__C_specific_handler
memcpy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memset
__current_exception_context
__current_exception
__std_terminate

api-ms-win-crt-string-l1-1-0

wcsncpy
strcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_register_onexit_function
_initterm
_initterm_e
terminate
_crt_at_quick_exit
_crt_atexit
_initialize_onexit_table
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_cexit

Exports

Exports

PyInit_adsi

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ae2e579eeda316606ec0d4d68b58980

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

activeds

advapi32

oleaut32

python312

pywintypes312

pythoncom312

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 616B

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 616B