45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29

Sharing

Copy URL Twitter E-mail

General

Target
45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29
Size 7.7MB
Sample260722-qe876sfa97
SHA256 45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29
MD5 c25880aa3e1192004f6d2cb48a294530
SHA1 5e90ad0fcbd7766dbca37cde29eb2f5d7895b73e
SHA512 5bd153687faf631c8134d6f359e89b1a3617c880de036db5af01d606cfe6bd93066d1e4a0bfcebac19190ebe719abc417667a12b21cdd71439822145ff1b73e5
SSDEEP 98304:I0tXyVAgy4CHUAULA2paQgf8ZbvNq0UqHrAV6hDcfc/0ZLh6IjXXY5+gxXstVu2j:acOPJvHj1Dq
TLSH
T112866BA5B6905527FDE9F03872A7AA81E722D0166300D743F07C88BD3FDAA60DD7664C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29

File Explorer

45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29

.exe 7.7MB

45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29

IMPHASH cc2c04a321729a001996e3e57d7ba15e
SHA256 45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29
MD5 c25880aa3e1192004f6d2cb48a294530
SHA1 5e90ad0fcbd7766dbca37cde29eb2f5d7895b73e
SHA512 5bd153687faf631c8134d6f359e89b1a3617c880de036db5af01d606cfe6bd93066d1e4a0bfcebac19190ebe719abc417667a12b21cdd71439822145ff1b73e5
SSDEEP 98304:I0tXyVAgy4CHUAULA2paQgf8ZbvNq0UqHrAV6hDcfc/0ZLh6IjXXY5+gxXstVu2j:acOPJvHj1Dq
TLSH
T112866BA5B6905527FDE9F03872A7AA81E722D0166300D743F07C88BD3FDAA60DD7664C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

858016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

python314

PyArg_ParseTuple PyArg_ParseTupleAndKeywords PyArg_UnpackTuple PyAsyncGen_Type PyBaseObject_Type PyBool_Type PyBuffer_Release PyByteArray_FromObject PyByteArray_FromStringAndSize PyByteArray_Type PyBytes_FromString PyBytes_Type PyCFunction_Type PyCMethod_New PyCallIter_Type PyCallable_Check PyCapsule_New PyCell_New PyCode_Addr2Line PyCode_Type PyComplex_FromDoubles PyComplex_Type PyConfig_SetArgv PyConfig_SetString PyCoro_Type PyDictItems_Type PyDictIterKey_Type PyDictKeys_Type PyDictValues_Type PyDict_Clear PyDict_DelItem PyDict_DelItemString PyDict_GetItem PyDict_GetItemString PyDict_Merge PyDict_MergeFromSeq2 PyDict_New PyDict_SetItem PyDict_SetItemString PyDict_Type PyEllipsis_Type PyEnum_Type PyErr_BadArgument PyErr_ExceptionMatches PyErr_Format PyErr_GivenExceptionMatches PyErr_NoMemory PyErr_Print PyErr_PrintEx PyErr_SetFromErrno PyErr_WarnEx PyErr_WriteUnraisable PyEval_AcquireThread PyEval_EvalCodeEx PyEval_GetFuncName PyEval_RestoreThread PyEval_SaveThread PyExc_AttributeError PyExc_Exception PyExc_GeneratorExit PyExc_ImportError PyExc_ImportWarning PyExc_IndexError PyExc_KeyError PyExc_MemoryError PyExc_NameError PyExc_NotImplementedError PyExc_OSError PyExc_OverflowError PyExc_RecursionError PyExc_RuntimeError PyExc_StopAsyncIteration PyExc_StopIteration PyExc_SystemError PyExc_TypeError PyExc_UnboundLocalError PyExc_ValueError PyExc_ZeroDivisionError PyFloat_FromDouble PyFloat_FromString PyFloat_Type PyFrame_Type PyFrozenSet_New PyFrozenSet_Type PyFunction_Type PyGen_Type PyImport_ExecCodeModule PyImport_ExecCodeModuleEx PyImport_FrozenModules PyImport_GetModuleDict PyImport_ImportFrozenModule PyImport_ImportModule PyInterpreterState_Get PyIter_Next PyIter_Send PyListIter_Type PyList_New PyList_Sort PyList_Type PyLong_AsLong PyLong_AsLongAndOverflow PyLong_AsSsize_t PyLong_FromSsize_t PyLong_FromString PyLong_FromUnicodeObject PyLong_Type PyMapping_Check PyMarshal_ReadObjectFromString PyMem_Free PyMem_GetAllocator PyMem_Malloc PyMethod_Type PyModuleDef_Type PyModule_ExecDef PyModule_FromDefAndSpec2 PyModule_GetDef PyModule_GetDict PyModule_GetFilenameObject PyModule_GetName PyModule_GetState PyModule_NewObject PyModule_Type PyNumber_Add PyNumber_AsSsize_t PyNumber_Float PyNumber_FloorDivide PyNumber_InPlaceAdd PyNumber_InPlaceLshift PyNumber_InPlaceOr PyNumber_Long PyNumber_Negative PyNumber_Subtract PyNumber_ToBase PyOS_snprintf PyObject_Call PyObject_CallFunctionObjArgs PyObject_CallMethodObjArgs PyObject_ClearWeakRefs PyObject_DelItem PyObject_Free PyObject_GC_Del PyObject_GenericSetAttr PyObject_GetAttr PyObject_GetAttrString PyObject_GetBuffer PyObject_GetIter PyObject_Init PyObject_IsInstance PyObject_IsSubclass PyObject_IsTrue PyObject_LengthHint PyObject_Realloc PyObject_Repr PyObject_RichCompare PyObject_RichCompareBool PyObject_SelfIter PyObject_SetAttr PyObject_SetAttrString PyObject_SetItem PyObject_Str PyRange_Type PySeqIter_Type PySequence_Check PySequence_Contains PySequence_InPlaceConcat PySequence_List PySequence_Tuple PySet_Add PySet_Contains PySet_New PySet_Type PySlice_Type PyState_AddModule PyState_FindModule PyStatus_Exception PyStructSequence_InitType PyStructSequence_New PyStructSequence_SetItem PySys_GetObject PySys_SetArgv PySys_SetObject PySys_WriteStderr PyThreadState_Get PyTraceBack_Type PyTupleIter_Type PyTuple_New PyTuple_Type PyType_IsSubtype PyType_Ready PyType_Type PyUnicode_AsUTF8 PyUnicode_AsWideCharString PyUnicode_Concat PyUnicode_DecodeUTF8 PyUnicode_Find PyUnicode_FindChar PyUnicode_Format PyUnicode_FromEncodedObject PyUnicode_FromFormat PyUnicode_FromOrdinal PyUnicode_FromString PyUnicode_FromStringAndSize PyUnicode_FromWideChar PyUnicode_GetLength PyUnicode_Join PyUnicode_Partition PyUnicode_RPartition PyUnicode_RichCompare PyUnicode_Substring PyUnicode_Type PyUnstable_Code_NewWithPosOnlyArgs PyWideStringList_Append Py_BuildValue Py_BytesWarningFlag Py_CompileStringExFlags Py_DebugFlag Py_DontWriteBytecodeFlag Py_Exit Py_ExitStatusException Py_FileSystemDefaultEncoding Py_FrozenFlag Py_GenericAlias Py_GenericAliasType Py_HasFileSystemDefaultEncoding Py_IgnoreEnvironmentFlag Py_InitializeFromConfig Py_InspectFlag Py_InteractiveFlag Py_MakePendingCalls Py_NoSiteFlag Py_NoUserSiteDirectory Py_OptimizeFlag Py_SetProgramName Py_UTF8Mode Py_VerboseFlag _PyArg_NoKeywords _PyByteArray_empty_string _PyBytes_Resize _PyConfig_InitCompatConfig _PyDict_NewPresized _PyErr_Format _PyErr_FormatFromCause _PyErr_SetString _PyEval_EvalFrameDefault _PyIntrinsics_UnaryFunctions _PyLong_Copy _PyLong_New _PyObject_GC_Resize _PyObject_New _PyRuntime _PySet_NextEntry _PyThreadState_GetCurrent _PyType_Lookup _PyUnicode_InternImmortal _Py_Dealloc _Py_EllipsisObject _Py_FalseStruct _Py_FatalErrorFunc _Py_NewReference _Py_NoneStruct _Py_NotImplementedStruct _Py_TrueStruct

api-ms-win-crt-convert-l1-1-0

_wtoi mbstowcs

api-ms-win-crt-filesystem-l1-1-0

_wrename

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-private-l1-1-0

__C_specific_handler strchr strrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit raise signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf fflush fwrite puts

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsicmp iswctype strcat strcmp strcpy strncmp strncpy wcscmp wcslen wcsncmp

kernel32

CloseHandle CopyFileW CreateFileMappingW CreateFileW DeleteCriticalSection DeleteFileW EnterCriticalSection FormatMessageA GetCurrentProcessId GetEnvironmentVariableW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetShortPathNameW GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection LeaveCriticalSection LoadLibraryExW MapViewOfFile QueryPerformanceCounter ReadFile SetDllDirectoryW SetEnvironmentVariableW SetErrorMode SetStdHandle SetUnhandledExceptionFilter Sleep TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WideCharToMultiByte WriteFile

shell32

SHGetFolderPathW

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

886KB

Virtual Size

885KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

45d87b1833a07cd5ac5b3056bada708f0938732087385e9eb6a4ec4eae144a29

python314

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

shell32

api-ms-win-crt-environment-l1-1-0

generic