app[.]pyd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
app.pyd.exe
Size 1.8MB
Sample260924-wfac5assds
SHA256 d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e
MD5 ca1666b335b285fa80e5759a1908ad6c
SHA1 230896fb9d2892cf08e46d9d85a937a32a925e60
SHA512 a4430a6714f0f5f278bf95d1dd2ec3e2d9ce33a12521a2e06926908e568f4626839a0e257e30bee1342715a540f427bd0b013567f22c8e0fdd53c0e6365301ec
SSDEEP 24576:as1eI/R4pxl7ekJFfBupIFfrVw5eQKAx+gUpVpIgQjGHyCNyCvaz9a:aKeoR4d7ekJFpupIFekpZVyZwm9
TLSH
T18E85191323B40046F6F6D5F74EAA9B23DDB2F9CE1B2232D704A4EA592B83DD256DC144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
app.pyd.exe

File Explorer

app.pyd.exe

.dll 1.8MB

app.pyd.exe

IMPHASH 50f9fe8df2dc9541a8395ddfc3bf57be
SHA256 d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e
MD5 ca1666b335b285fa80e5759a1908ad6c
SHA1 230896fb9d2892cf08e46d9d85a937a32a925e60
SHA512 a4430a6714f0f5f278bf95d1dd2ec3e2d9ce33a12521a2e06926908e568f4626839a0e257e30bee1342715a540f427bd0b013567f22c8e0fdd53c0e6365301ec
SSDEEP 24576:as1eI/R4pxl7ekJFfBupIFfrVw5eQKAx+gUpVpIgQjGHyCNyCvaz9a:aKeoR4d7ekJFpupIFekpZVyZwm9
TLSH
T18E85191323B40046F6F6D5F74EAA9B23DDB2F9CE1B2232D704A4EA592B83DD256DC144
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1515476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

python312

_PyArg_NoKeywords PyLong_AsSsize_t PyDictKeys_Type PySlice_Type PyImport_ImportModule PyBytes_AsString PyObject_SelfIter PyEval_GetFuncName PyImport_ExecCodeModuleEx PyUnicode_DecodeUTF8 _PyWeakref_CallableProxyType PyList_Sort PyExc_RuntimeError PyObject_SetAttrString PyNumber_FloorDivide PyUnicode_Concat PyExc_UnboundLocalError _PyErr_WriteUnraisableMsg _PyImport_FixupExtensionObject Py_BuildValue PyComplex_FromDoubles PyObject_GetAttr PyModule_GetName PyBytes_FromString PyModule_GetDef _PyObject_GC_Resize PyTuple_New PyLong_FromString _Py_EllipsisObject PyDict_SetItemString PyFrame_Type PyFloat_FromDouble PyDictValues_Type PyUnicode_New PyObject_LengthHint PyUnicode_FromWideChar _PyWeakref_ClearRef PyMarshal_ReadObjectFromString PyExc_ZeroDivisionError PyObject_CallFunction PyIter_Next PyObject_GetIter PyNumber_Add PyIter_Send PyUnicode_InternInPlace PyNumber_InPlaceLshift PyObject_RichCompare PyCoro_Type PyNumber_InPlaceAdd PyFloat_Type PyModule_NewObject PyMethod_Type PyNumber_Subtract PySys_SetObject PyExc_OverflowError _Py_Dealloc PyObject_Free PyImport_ImportFrozenModule PyErr_ExceptionMatches PyUnicode_FindChar PyObject_GC_Del PyObject_CallFunctionObjArgs PyLong_AsLong PyLong_FromUnicodeObject PyObject_ClearWeakRefs PyObject_Init PyCode_Type PyUnicode_AsWideCharString PyErr_WarnEx PyList_New PyType_Ready PyModule_FromDefAndSpec2 Py_CompileStringExFlags PyList_Append PyObject_RichCompareBool PySet_Type _PyLong_New PyObject_GenericSetAttr PyDict_New _PyDict_MaybeUntrack _PyErr_ChainStackItem PyFrozenSet_New PyByteArray_FromStringAndSize PyModule_ExecDef _PyEval_EvalFrameDefault PyLong_AsLongAndOverflow PyCMethod_New _PySet_NextEntry PyErr_NoMemory PyObject_Realloc _PyRuntime PyDict_GetItemString PyEllipsis_Type PyDict_GetItem PyImport_FrozenModules PyComplex_Type _Py_NotImplementedStruct PyUnstable_Code_NewWithPosOnlyArgs PyExc_StopAsyncIteration PyArg_ParseTupleAndKeywords PyImport_ExecCodeModule _PyWeakref_ProxyType _PyObject_New PyObject_IsTrue PyObject_Str PyExc_NameError _PyByteArray_empty_string PyCallable_Check PyMem_Malloc _PyErr_NormalizeException PyDict_MergeFromSeq2 PyModuleDef_Type PyGen_Type PyObject_CallMethodObjArgs PyArg_UnpackTuple PyModule_GetState _PyWeakref_RefType PyAsyncGen_Type PyErr_Print PyTraceBack_Type _PyTuple_MaybeUntrack PyRange_Type Py_GenericAliasType _PyLong_Copy _PyType_Lookup PyObject_Call PyObject_Repr PyByteArray_Type PyArg_ParseTuple PyEval_RestoreThread PyUnicode_FromStringAndSize PyStructSequence_InitType PyDictItems_Type PyMem_GetAllocator PyOS_snprintf PyCFunction_Type PyObject_SetAttr PyBaseObject_Type PyExc_ImportWarning PyNumber_InPlaceOr PySequence_List PyByteArray_FromObject PyFrozenSet_Type PyModule_GetFilenameObject _PyAsyncGenWrappedValue_Type PyExc_WindowsError PyObject_GetItem PyLong_Type PyExc_OSError PySet_Contains PyNumber_Negative PyObject_SetItem PyExc_FileNotFoundError PyExc_ImportError PyLong_FromSsize_t PyObject_IsInstance PyTuple_Type PyExc_KeyError Py_Exit PyExc_GeneratorExit PyObject_IsSubclass PyErr_WriteUnraisable PyBytes_Type PyUnicode_Substring PyUnicode_GetLength PyUnicode_Find PyExc_SystemExit PySequence_Tuple PyType_Type PyEval_AcquireThread _PyThreadState_GetCurrent PyExc_SystemError PyExc_IndexError PyModule_Type PyExc_TypeError PyNumber_AsSsize_t PyUnicode_Compare PyNumber_Long PyDict_DelItem PyModuleDef_Init PyList_Type PyExc_StopIteration PyUnicode_Type PySequence_Check PyDict_SetItem PyObject_GetAttrString PySet_New PyUnicode_FromFormat PyUnicode_AsUTF8 PyEnum_Type PyModule_GetDict PyImport_GetModuleDict PyUnicode_Join PyType_IsSubtype PySeqIter_Type PyBool_Type PyExc_BaseException PyDict_Type PyErr_Format PyExc_ValueError PyExc_AttributeError PySet_Add PySequence_Contains PyEval_SaveThread PyDict_Update PyErr_PrintEx PyExc_Exception PyThreadState_Get Py_MakePendingCalls _PyDict_NewPresized PyFunction_Type Py_GenericAlias PyUnicode_FromString _Py_TrueStruct PyCapsule_New _Py_FalseStruct PyStructSequence_New _Py_NoneStruct PySys_GetObject PyErr_BadArgument

kernel32

GetShortPathNameW GetModuleFileNameW SetErrorMode FindResourceA GetModuleHandleExA GetLastError LockResource LoadResource GetProcAddress GetCurrentProcessId GetSystemTimeAsFileTime FormatMessageA LoadLibraryExW QueryPerformanceCounter GetCurrentThreadId DisableThreadLibraryCalls InitializeSListHead

vcruntime140

memset memcpy memcmp __std_type_info_destroy_list strchr strrchr __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_onexit_table _execute_onexit_table _cexit abort _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-stdio-l1-1-0

puts __acrt_iob_func __stdio_common_vsprintf __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_strdup _wcsdup strcmp strcpy strlen strncmp strncpy

api-ms-win-crt-math-l1-1-0

copysign

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char