6408c6ed446a05dffbe6b076aa0fa24aa267795e6ba9602eaa404004a745f140

Sharing

Copy URL Twitter E-mail

General

Target

6408c6ed446a05dffbe6b076aa0fa24aa267795e6ba9602eaa404004a745f140
Size

26KB
MD5

54f4a9eeec9c75f51302c2b54268ecbc
SHA1

74ee445157ef6f395dd3ab95bbfff299e46719e0
SHA256

6408c6ed446a05dffbe6b076aa0fa24aa267795e6ba9602eaa404004a745f140
SHA512

67fbadec06755c1468acea35ed899674705c325a344ddc27c8df76ed37b9303af1ad06c05a6f89062e93900f881ee4c8e474c1461061a903bc3d63ed53d14700
SSDEEP

384:jiqk/1+mXtMCF540HDbJ93d52EyOALtkkvgj:xQZdXXDHDn/bMkNj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6408c6ed446a05dffbe6b076aa0fa24aa267795e6ba9602eaa404004a745f140

Files

6408c6ed446a05dffbe6b076aa0fa24aa267795e6ba9602eaa404004a745f140
.dll windows:6 windows x64 arch:x64

d333384fa682df54a474717020a676ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

unrar

RARSetPassword
RARSetChangeVolProc
RAROpenArchiveEx
RARReadHeaderEx
RARCloseArchive
RARSetProcessDataProc
RARReadHeader
RARGetDllVersion
RARSetCallback
RAROpenArchive
RARProcessFileW
RARProcessFile

python3

PyImport_ImportModule
PyErr_Occurred
PyEval_SaveThread
PyLong_FromLong
_Py_NoneStruct
PyEval_RestoreThread
_Py_Dealloc
PyObject_Free
PyObject_CallMethod
PyLong_FromVoidPtr
PyArg_UnpackTuple
PyObject_Malloc

kernel32

TerminateProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlCaptureContext

vcruntime140

__std_type_info_destroy_list
memset
__C_specific_handler
memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table

Exports

Exports

PyInit__unrarlib
RARCloseArchive
RARGetDllVersion
RAROpenArchive
RAROpenArchiveEx
RARProcessFile
RARProcessFileW
RARReadHeader
RARReadHeaderEx
RARSetCallback
RARSetChangeVolProc
RARSetPassword
RARSetProcessDataProc

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d333384fa682df54a474717020a676ed

Headers

DLL Characteristics

File Characteristics

Imports

unrar

python3

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 660B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 396B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 660B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 396B