2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99

General

Target
2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99
Size 105KB
Sample260916-3ln7ssgp7w
SHA256 2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99
MD5 b59c3c9fbf76f127400b959a7762c35d
SHA1 6cd2d60c5845dd4afdb5e5ab7dc0b0698d20c836
SHA512 ff4606d74e7e9871cdcddfc7a655ce929e2a9c0258518b712b11bb85c4160116eec942b5ff70db92cba8148c3befc279b067887f352222e2197078734639bf77
SSDEEP 1536:0I9yNiLFU1DYftpHndfdz5eB9Aow2J94bY73ORTc/Wm5Uymkwx:0I9yNkUSftpHdfdABm4OJWU9kwx
TLSH
T172B3E60672D1009BEE9390748C37282BE7B2B0522721638F4654D6C92F53BDB7FAD796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99

File Explorer

2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99

.dll 105KB

2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99

IMPHASH 25b249629b04fecfe986cf7119d76ba5
SHA256 2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99
MD5 b59c3c9fbf76f127400b959a7762c35d
SHA1 6cd2d60c5845dd4afdb5e5ab7dc0b0698d20c836
SHA512 ff4606d74e7e9871cdcddfc7a655ce929e2a9c0258518b712b11bb85c4160116eec942b5ff70db92cba8148c3befc279b067887f352222e2197078734639bf77
SSDEEP 1536:0I9yNiLFU1DYftpHndfdz5eB9Aow2J94bY73ORTc/Wm5Uymkwx:0I9yNkUSftpHdfdABm4OJWU9kwx
TLSH
T172B3E60672D1009BEE9390748C37282BE7B2B0522721638F4654D6C92F53BDB7FAD796
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

79892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

python313

PyObject_Hash PyUnicode_Concat PyExc_UnboundLocalError PyErr_SetNone PyInterpreterState_GetID PyObject_GetAttr PyModule_GetName _Py_NoneStruct PyTuple_New PySequence_Contains PyObject_GenericSetDict PyObject_VisitManagedDict PyDict_SetItemString PyDict_Size PyDict_SetDefaultRef PyGC_Disable PyExc_AttributeError PyTuple_GetSlice PyUnicode_New PyNumber_Multiply PyErr_SetString PyObject_CallFunction PyErr_WriteUnraisable PyObject_GetIter PyNumber_Add PyExc_ValueError PyUnicode_InternInPlace PyDict_Next PyErr_Format PyDict_Type PyThreadState_GetUnchecked PyObject_RichCompare PyTuple_Type _Py_FalseStruct PyImport_GetModule PyFloat_Type PyModule_NewObject PyMethod_Type PyLong_Type PyType_IsSubtype PyExc_OverflowError _Py_Dealloc PyTuple_GetItem PyImport_GetModuleDict PyModule_GetDict PyObject_Format PyErr_ExceptionMatches PyObject_ClearManagedDict PyUnicode_FindChar PyObject_GC_Del PyObject_CallFunctionObjArgs PyObject_GenericGetDict PyObject_ClearWeakRefs PyObject_Init PyObject_Vectorcall PyUnicode_FromFormat Py_Version PyObject_GC_UnTrack PyObject_GC_IsFinalized PyType_Ready PyObject_GetAttrString PyErr_Clear PyList_Append PyObject_RichCompareBool PyException_SetTraceback PyObject_VectorcallDict PyDict_SetItem PyDict_New PyUnicode_Type PyObject_CallFinalizerFromDealloc _PyDict_GetItem_KnownHash PyObject_VectorcallMethod PyObject_IsInstance PyMem_Free PyExc_StopIteration PyObject_GetOptionalAttr PyList_Type PyErr_NoMemory PyDict_GetItemString PyObject_GetItem PyModuleDef_Init PyObject_GC_Track PyBytes_FromStringAndSize PyNumber_Long PyUnstable_Code_NewWithPosOnlyArgs PyDict_GetItemRef PyObject_IsSubclass PyExc_TypeError PyMem_Realloc PyType_FromMetaclass PyObject_IsTrue PyExc_NameError PyTuple_Pack PyMem_Malloc PyList_AsTuple Py_EnterRecursiveCall PyExc_ImportError _Py_TrueStruct PyArg_UnpackTuple PyMemoryView_FromMemory PyExc_SystemError PyObject_SetItem _PyObject_GC_New PyException_SetCause PyTraceBack_Type PyExc_GeneratorExit PyUnicode_FromString PyObject_Size PyObject_Call PyObject_Repr PyType_Type PySequence_Tuple PyUnicode_Substring PyUnicode_FromStringAndSize PyIter_Check PyLong_FromLong PyObject_SetAttrString PyMethod_New PyExc_RuntimeError PyList_SetSlice PyTraceBack_Here PyObject_GenericGetAttr PyUnicode_DecodeUTF8 PyLong_FromSsize_t PyArg_ValidateKeywordArguments PyErr_Occurred PyObject_SelfIter PyErr_NormalizeException PyImport_ImportModuleLevelObject PyBytes_AsString PyImport_ImportModule PyImport_AddModuleRef Py_LeaveRecursiveCall PyExc_KeyError PyFrame_New PyThreadState_GetFrame PyExc_RuntimeWarning PyErr_WarnEx PyErr_GivenExceptionMatches PyObject_HasAttrWithError PyCode_NewEmpty PyDict_SetDefault PyErr_SetObject PyException_GetTraceback PyThreadState_Get PyOS_snprintf PyCFunction_Type PyUnicode_InternFromString PyObject_SetAttr PyGC_Enable _PyDict_NewPresized PyBaseObject_Type PySequence_List PyList_New PyUnicode_CopyCharacters

kernel32

DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

vcruntime140

__C_specific_handler strrchr strchr __std_type_info_destroy_list memset memcpy memcmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _initterm _execute_onexit_table _cexit

Sharing

General

Malware Config

Signatures

File Explorer

2de8a3a317b32022a0bb0bb06a9abb179a2a027f800738a683237d7a97c57e99

python313

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

generic