c5a1c93ab43f8e0adefde556e8f353d6454a3c2853058536f8064b5aad57fae8N

Sharing

Copy URL Twitter E-mail

General

Target

c5a1c93ab43f8e0adefde556e8f353d6454a3c2853058536f8064b5aad57fae8N
Size

69KB
MD5

b2e7bd07e9b197f505f9d36f7c369360
SHA1

763dc188e6b69a02b3e1bea580a686712be70d34
SHA256

c5a1c93ab43f8e0adefde556e8f353d6454a3c2853058536f8064b5aad57fae8
SHA512

f252a6b91b6cf9369c01e0dadd294ec39a1ade950a7437bffda7106f4e68ef245a974407fcb4aec817a665cfef2acf926589925ec87f974785d684ef79fe9bbd
SSDEEP

1536:Z/hJoyefrLcGi9fUiCS885/LP5Vdo9ABZOlBP3fuByEUFFTGEy8BEEqoniiJ6B8y:Z0B3Oc9ABZOlBP3fuByEwFTGEyiE/oip

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5a1c93ab43f8e0adefde556e8f353d6454a3c2853058536f8064b5aad57fae8N

Files

c5a1c93ab43f8e0adefde556e8f353d6454a3c2853058536f8064b5aad57fae8N
.dll windows:6 windows x64 arch:x64

ea2ea30c1e6ca81f3deedb3a11fda742

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

xsigmawrappingpythoncore3.12-1b53242e2172011cbefcc96726840eae

??0?$Array@N@xsigmaPythonArgs@@QEAA@_K@Z
??0xsigmaPythonArgs@@QEAA@PEAU_object@@0PEBD@Z
??0xsigmaPythonArgs@@QEAA@PEAU_object@@PEBD@Z
??1?$Array@N@xsigmaPythonArgs@@QEAA@XZ
?AddModule@xsigmaPythonUtil@@SAXPEBD@Z
?ArgCountError@xsigmaPythonArgs@@IEAA_N_J0@Z
?ArgCountError@xsigmaPythonArgs@@SA_N_JPEBD@Z
?BuildNone@xsigmaPythonArgs@@SAPEAU_object@@XZ
?BuildTuple@xsigmaPythonArgs@@SAPEAU_object@@PEBN_K@Z
?FindConversionMethod@xsigmaPythonOverload@@SAPEAUPyMethodDef@@PEAU2@PEAU_object@@@Z
?GetArgAsEnum@xsigmaPythonArgs@@IEAAHPEBDAEA_N@Z
?GetArgCount@xsigmaPythonArgs@@SAHPEAU_object@@@Z
?GetArgSize@xsigmaPythonArgs@@QEAA_KH@Z
?GetArray@xsigmaPythonArgs@@QEAA_NPEAN_K@Z
?GetSelfFromFirstArg@xsigmaPythonArgs@@KAPEAU_object@@PEAU2@0@Z
?GetValue@xsigmaPythonArgs@@QEAA_NAEAH@Z
?GetValue@xsigmaPythonArgs@@QEAA_NAEAN@Z
?GetValue@xsigmaPythonArgs@@QEAA_NAEA_K@Z
?GetValue@xsigmaPythonArgs@@QEAA_NAEA_N@Z
?ImportModule@xsigmaPythonUtil@@SA_NPEBDPEAU_object@@@Z
?IsInitialized@xsigmaPythonUtil@@SA_NXZ
?RefineArgTypeError@xsigmaPythonArgs@@IEAA_N_JPEBD@Z
?SetArray@xsigmaPythonArgs@@QEAA_NHPEBN_K@Z
?SetContents@xsigmaPythonArgs@@QEAA_NHPEAU_object@@@Z
?StripModule@xsigmaPythonUtil@@SAPEBDPEBD@Z
?getInfo@xsigmaPythonUtil@@SAPEAVPyXSIGMASpecialType@@PEBD@Z
PyXSIGMAEnum_Add
PyXSIGMAEnum_New
PyXSIGMAObject_Repr_impl
PyXSIGMAObject_find
PyXSIGMASpecialType_Add

python312

PyBool_FromLong
PyDict_New
PyDict_SetItemString
PyDict_Size
PyErr_Clear
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_Occurred
PyErr_SetString
PyExc_ImportError
PyExc_TypeError
PyFloat_FromDouble
PyLong_Type
PyModule_Create2
PyModule_GetDict
PyObject_Free
PyObject_GenericGetAttr
PyObject_GenericSetAttr
PyObject_HashNotImplemented
PyTuple_New
PyType_GetFlags
PyType_IsSubtype
PyType_Ready
PyType_Type
_PyObject_New
_Py_Dealloc
_Py_FatalErrorFunc

math-f9fed480e4893b628e506dab960a26cf

??0laplace_inverter_gaver_stehfest@xsigma@@QEAA@_KN@Z
??0lm_parameters@xsigma@@QEAA@_K00@Z
?cdf@inverse_gaussian_distribution@xsigma@@SANNN@Z
?cdf@normal_distribution@xsigma@@SANN@Z
?cdf_over_density@normal_distribution@xsigma@@SANN@Z
?cheyette_density@hartman_watson_distribution@xsigma@@SAXAEAV?$vector@N@2@0NAEBV32@111@Z
?density@inverse_gaussian_distribution@xsigma@@SANNN@Z
?density@normal_distribution@xsigma@@SANN@Z
?distribution@hartman_watson_distribution@xsigma@@SAXAEAV?$vector@N@2@NAEBV32@11W4hartman_watson_distribution_type@2@N@Z
?distribution_numerical@hartman_watson_distribution@xsigma@@SANNNAEBV?$vector@N@2@0@Z
?gamma@gamma_distribution@xsigma@@SANN@Z
?gauss_hermite_coefficients@gaussian_quadrature@xsigma@@SAX_KAEAV?$vector@N@2@1_NN0@Z
?gauss_kronrod@gaussian_quadrature@xsigma@@SAX_KAEAV?$vector@N@2@11N0@Z
?gauss_laguerre_coefficients@gaussian_quadrature@xsigma@@SAXN_KAEAV?$vector@N@2@1N0@Z
?gauss_legendre_coefficients@gaussian_quadrature@xsigma@@SAX_KAEAV?$vector@N@2@1N@Z
?inv_cdf@normal_distribution@xsigma@@SANN@Z
?inv_cdf@normal_distribution@xsigma@@SAX_KPEBNPEAN@Z
?inv_cdf_fast@normal_distribution@xsigma@@SANN@Z
?lgamma@gamma_distribution@xsigma@@SANN@Z
?log_distribution_asymptotique@hartman_watson_distribution@xsigma@@SANNN@Z
?solve@ceres_solver_algorithms@xsigma@@QEAA_NAEAV?$vector@NV?$allocator@N@std@@@std@@H@Z

core-c278014ab1abb2053857e26ae4330d6e

?check_fail@details@xsigma@@YAXPEBD0HAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

msvcp140-e6779840cfaa5e7215d08812d831e17d

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1ios_base@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
memcmp
memcpy
memmove
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-crt-string-l1-1-0

strlen

Exports

Exports

PyInit_Math
PyXSIGMAAddFile_ceres_solver_algorithms
PyXSIGMAAddFile_gamma_distribution
PyXSIGMAAddFile_gaussian_quadrature
PyXSIGMAAddFile_hartman_watson_distribution
PyXSIGMAAddFile_inverse_gaussian_distribution
PyXSIGMAAddFile_laplace_inverter_gaver_stehfest
PyXSIGMAAddFile_lbfgs
PyXSIGMAAddFile_levenberg_marquardt
PyXSIGMAAddFile_nlopt_algorithms
PyXSIGMAAddFile_normal_distribution
PyXSIGMAAddFile_optimization_algorithm_output
PyXSIGMAAddFile_root_finding_algorithms
real_initMath

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea2ea30c1e6ca81f3deedb3a11fda742

Headers

DLL Characteristics

File Characteristics

Imports

xsigmawrappingpythoncore3.12-1b53242e2172011cbefcc96726840eae

python312

math-f9fed480e4893b628e506dab960a26cf

core-c278014ab1abb2053857e26ae4330d6e

msvcp140-e6779840cfaa5e7215d08812d831e17d

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 8KB

.pdata Size: 3KB - Virtual size: 2KB

.00cfg Size: 512B - Virtual size: 56B

.rsrc Size: 512B - Virtual size: 424B

.reloc Size: 512B - Virtual size: 404B

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 8KB

.pdata
Size: 3KB - Virtual size: 2KB

.00cfg
Size: 512B - Virtual size: 56B

.rsrc
Size: 512B - Virtual size: 424B

.reloc
Size: 512B - Virtual size: 404B