2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5

Sharing

Copy URL Twitter E-mail

General

Target
2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5
Size 61KB
Sample260910-ndzagabm6w
SHA256 2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5
MD5 eb80040b2ecb210326d8ac7568024eed
SHA1 10c843675cf64e0d9dc96ba55a6aef567a81a8f7
SHA512 b3993a7a9f7e2f5f5a707f65fe6075edef34c803f6d199745bfb66ec3b33649edc222b5e233066d2c3c6f16155f7d331baf3a47edaeb17cf427588f428a9ac08
SSDEEP 1536:nTSfrpQWgzypG2S4ntHYCZlTIHBD2LyykXC4ll4S6U/bwxLBkRvoD1WGPomPnpze:nTSDp6sS4ntHYCZlTIHBD2LyykXC4ll9
TLSH
T12853F661B70081A7E3DA0E74B6A5AB670A7FB0913BE523C75F9F1D980CB15D36638312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5

File Explorer

2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5

.dll 61KB

2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5

IMPHASH 843aa654304fab46f98a8f0c804e2aef
SHA256 2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5
MD5 eb80040b2ecb210326d8ac7568024eed
SHA1 10c843675cf64e0d9dc96ba55a6aef567a81a8f7
SHA512 b3993a7a9f7e2f5f5a707f65fe6075edef34c803f6d199745bfb66ec3b33649edc222b5e233066d2c3c6f16155f7d331baf3a47edaeb17cf427588f428a9ac08
SSDEEP 1536:nTSfrpQWgzypG2S4ntHYCZlTIHBD2LyykXC4ll4S6U/bwxLBkRvoD1WGPomPnpze:nTSDp6sS4ntHYCZlTIHBD2LyykXC4ll9
TLSH
T12853F661B70081A7E3DA0E74B6A5AB670A7FB0913BE523C75F9F1D980CB15D36638312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\pywin32\pywin32\build\temp.win32-cpython-39\Release\win32evtlog.pdb

advapi32

GetOldestEventLogRecord ReportEventW RegisterEventSourceW NotifyChangeEventLog OpenEventLogW ReadEventLogW CloseEventLog ClearEventLogW OpenBackupEventLogW GetNumberOfEventLogRecords DeregisterEventSource BackupEventLogW

python39

PyErr_NoMemory PyLong_AsUnsignedLong PyErr_Occurred PyLong_FromSsize_t PyObject_GenericGetAttr PyEval_SaveThread PyLong_FromLong PyExc_MemoryError PyLong_FromUnsignedLongLong PyGILState_Release _Py_NoneStruct PyTuple_New PyDict_SetItemString PyLong_FromLongLong PyFloat_FromDouble PyErr_SetString PyExc_ValueError PyLong_FromUnsignedLong PyBool_FromLong _PyArg_ParseTupleAndKeywords_SizeT PyErr_Format _Py_Dealloc PyLong_AsUnsignedLongMask PyModule_GetDict _PyArg_ParseTuple_SizeT PyList_New PyEval_RestoreThread PyObject_Call PyErr_Print PyList_SetItem PyExc_TypeError _Py_NewReference PyGILState_Ensure PyExc_NotImplementedError PyBytes_FromStringAndSize PyModule_Create2 PyMem_Free PyNumber_ToBase PyObject_GenericSetAttr PyList_Append PyErr_Clear PyType_Ready _Py_BuildValue_SizeT

pywintypes39

?PyWinObject_FromSYSTEMTIME@@YAPAU_object@@ABU_SYSTEMTIME@@@Z ?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z ?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z ??1PyHANDLE@@UAE@XZ ??0PyHANDLE@@QAE@PAX@Z ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z ??0PyWinBufferView@@QAE@PAU_object@@_N1@Z ??1PyWinBufferView@@QAE@XZ ?ok@PyWinBufferView@@QAE_NXZ ?ptr@PyWinBufferView@@QAEPAXXZ ?len@PyWinBufferView@@QAEKXZ ?PyWinExc_ApiError@@3PAU_object@@A ?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z ?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z ?PyWinObject_FreeWCHARArray@@YAXPAPA_WK@Z ?PyWinObject_AsWCHARArray@@YAHPAU_object@@PAPAPA_WPAKH@Z ?PyWinObject_FromIID@@YAPAU_object@@ABU_GUID@@@Z ?PyWinObject_FreeWCHAR@@YAXPA_W@Z ?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_WH@Z ?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z ?PyWinObject_FromTimeStamp@@YAPAU_object@@ABT_LARGE_INTEGER@@@Z ?PyWinObject_FromSID@@YAPAU_object@@PAX@Z ?PyWinTimeObject_Fromtime_t@@YAPAU_object@@_J@Z ?PyWinGlobals_Ensure@@YAHXZ ?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z

kernel32

RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetLastError InitializeSListHead IsDebuggerPresent GetStartupInfoW

vcruntime140

__std_exception_copy __std_terminate __CxxFrameHandler3 __std_exception_destroy _CxxThrowException __std_type_info_destroy_list __current_exception __current_exception_context _except_handler4_common memset

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initterm_e _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit terminate _initialize_onexit_table _initterm

Sharing

General

Malware Config

Signatures

File Explorer

2bfc959a138f4cfea080fbd78bfbc83e36a35990045f8b47eae41a70777259a5

advapi32

python39

pywintypes39

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic