app[.]pyd | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
app.pyd
Size 1.6MB
Sample261013-2d2mgsvsby
SHA256 88d835cf27e667c670ea89df5746ca9429ecd4c0e4d1e2ec58fc5e4a4ae5e476
MD5 2032466bbf8781d09d6c330355a82cf7
SHA1 de582ffb9cfe5bfad0debe5b29be2f46e695c37e
SHA512 be8ed58539e8fa78b4e2a281ef0f26f11bcfe6c2dcd594fe951d72c7306cc6ec24a762e4b2afaf25f187ab759dd86c2e9a286eb2dea26282d8c47416d09d3d04
SSDEEP 24576:R8OGeScK7VIxBjzGM6TgQzHxp9ElmD2rrRiqwXwy1yEhVNekcpFmaUtpkyV:+OycK5QMH39imq8qwXwyhhVN5
TLSH
T1D675F72323B40006FBF595F64D6AE777DEB2B9CA1B5232D700A0DA983783ED656EC144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
app.pyd

File Explorer

app.pyd

.dll 1.6MB

app.pyd

IMPHASH 47e2409fc443c0a0b96a2bd59ce69e10
SHA256 88d835cf27e667c670ea89df5746ca9429ecd4c0e4d1e2ec58fc5e4a4ae5e476
MD5 2032466bbf8781d09d6c330355a82cf7
SHA1 de582ffb9cfe5bfad0debe5b29be2f46e695c37e
SHA512 be8ed58539e8fa78b4e2a281ef0f26f11bcfe6c2dcd594fe951d72c7306cc6ec24a762e4b2afaf25f187ab759dd86c2e9a286eb2dea26282d8c47416d09d3d04
SSDEEP 24576:R8OGeScK7VIxBjzGM6TgQzHxp9ElmD2rrRiqwXwy1yEhVNekcpFmaUtpkyV:+OycK5QMH39imq8qwXwyhhVN5
TLSH
T1D675F72323B40006FBF595F64D6AE777DEB2B9CA1B5232D700A0DA983783ED656EC144
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1504660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

python312

_PyArg_NoKeywords PyLong_AsSsize_t PySlice_Type PyImport_ImportModule PyBytes_AsString PyObject_SelfIter PyEval_GetFuncName PyImport_ExecCodeModuleEx PyUnicode_DecodeUTF8 _PyWeakref_CallableProxyType PyList_Sort PyExc_RuntimeError PyObject_SetAttrString PyNumber_FloorDivide PyUnicode_Concat PyExc_UnboundLocalError _PyErr_WriteUnraisableMsg _PyImport_FixupExtensionObject Py_BuildValue PyComplex_FromDoubles PyObject_GetAttr PyModule_GetName PyUnicode_FromOrdinal PyBytes_FromString PyModule_GetDef _PyObject_GC_Resize PyTuple_New PyLong_FromString _Py_EllipsisObject PyDict_SetItemString PyFrame_Type PyFloat_FromDouble PySet_Add PyUnicode_New PyObject_LengthHint PyUnicode_FromWideChar _PyWeakref_ClearRef PyMarshal_ReadObjectFromString PyExc_ZeroDivisionError PyObject_CallFunction PyIter_Next PyObject_GetIter PyNumber_Add PyIter_Send PyUnicode_InternInPlace PyNumber_InPlaceLshift PyObject_RichCompare PyCoro_Type PyNumber_InPlaceAdd PyFloat_Type PyModule_NewObject PyMethod_Type PyLong_Type PyNumber_Subtract PySys_SetObject PyExc_OverflowError _Py_Dealloc PyObject_Free PyImport_ImportFrozenModule PyErr_ExceptionMatches PyUnicode_FindChar PyObject_GC_Del PyObject_CallFunctionObjArgs PyLong_AsLong PyLong_FromUnicodeObject _PyBytes_Resize PyObject_ClearWeakRefs PyObject_Init PyErr_WarnEx PyUnicode_AsWideCharString PyObject_GetBuffer PyErr_BadArgument PyList_New PyType_Ready PyModule_FromDefAndSpec2 Py_CompileStringExFlags PyList_Append PyObject_RichCompareBool PySet_Type _PyLong_New PyObject_GenericSetAttr PyDict_New _PyDict_MaybeUntrack _PyErr_ChainStackItem PyFrozenSet_New PyByteArray_FromStringAndSize PyModule_ExecDef _PyEval_EvalFrameDefault PyLong_AsLongAndOverflow PyCMethod_New _PySet_NextEntry PyErr_NoMemory PyObject_Realloc _PyRuntime PyDict_GetItemString PyEllipsis_Type PyDict_GetItem PyImport_FrozenModules PyComplex_Type _Py_NotImplementedStruct PyUnstable_Code_NewWithPosOnlyArgs PyExc_StopAsyncIteration PyArg_ParseTupleAndKeywords PyImport_ExecCodeModule _PyWeakref_ProxyType _PyObject_New PyObject_IsTrue PyObject_Str PyExc_NameError _PyByteArray_empty_string PyCallable_Check PyMem_Malloc _PyErr_NormalizeException PyDict_MergeFromSeq2 PyModuleDef_Type PyGen_Type PyObject_CallMethodObjArgs PyArg_UnpackTuple PyModule_GetState _PyWeakref_RefType PyAsyncGen_Type PyErr_Print PyTraceBack_Type _PyTuple_MaybeUntrack PyRange_Type Py_GenericAliasType _PyLong_Copy _PyType_Lookup PyBuffer_Release PyObject_Call PyByteArray_Type PyNumber_Float PyArg_ParseTuple PyEval_RestoreThread PyUnicode_FromStringAndSize PyFloat_FromString PyStructSequence_InitType PyMem_GetAllocator PyOS_snprintf PyCFunction_Type PyObject_SetAttr PyBaseObject_Type PyExc_ImportWarning PyNumber_InPlaceOr PySequence_List PyFrozenSet_Type PyModule_GetFilenameObject _PyAsyncGenWrappedValue_Type PyTuple_Type PyObject_GetItem PyNumber_Negative PyExc_KeyError PyByteArray_FromObject PyEnum_Type PyExc_IOError PyObject_Repr PyObject_IsInstance PyObject_DelItem PyExc_OSError PySet_New PyExc_PermissionError PyExc_ImportError PyNumber_Long PyExc_GeneratorExit PyObject_SetItem PyObject_IsSubclass PyList_Type PyUnicode_FromFormat PyExc_ValueError PyErr_WriteUnraisable PyLong_FromSsize_t PyDict_Type PyType_Type PyBytes_Type PySequence_Contains Py_GenericAlias PyExc_IndexError PyNumber_AsSsize_t PyBool_Type PyUnicode_Substring PyUnicode_GetLength PyUnicode_Find _PyDict_NewPresized PySequence_Tuple PyEval_AcquireThread _PyThreadState_GetCurrent PyExc_SystemError PyModule_Type PyExc_TypeError PyUnicode_Compare PyDict_DelItem PyModuleDef_Init PyExc_StopIteration PyUnicode_Type PySequence_Check PyDict_SetItem PyObject_GetAttrString PyUnicode_AsUTF8 PyModule_GetDict PyImport_GetModuleDict PyUnicode_Join PyType_IsSubtype PySeqIter_Type PyExc_BaseException PyErr_Format PyExc_SystemExit PyExc_AttributeError PyExc_KeyboardInterrupt PyEval_SaveThread PyDict_Update PyErr_PrintEx Py_Exit PyExc_Exception PyThreadState_Get PyFunction_Type Py_MakePendingCalls PyUnicode_FromString _Py_TrueStruct PyCapsule_New _Py_FalseStruct PyStructSequence_New _Py_NoneStruct PySys_GetObject PyCode_Type

kernel32

GetShortPathNameW GetModuleFileNameW SetErrorMode FindResourceA GetModuleHandleExA GetLastError LockResource LoadResource GetProcAddress GetCurrentProcessId GetSystemTimeAsFileTime FormatMessageA LoadLibraryExW QueryPerformanceCounter GetCurrentThreadId DisableThreadLibraryCalls InitializeSListHead

vcruntime140

memset memcpy memcmp __std_type_info_destroy_list strchr strrchr __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_onexit_table _execute_onexit_table _cexit abort _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-stdio-l1-1-0

puts __acrt_iob_func __stdio_common_vsprintf __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_strdup _wcsdup strcmp strcpy strlen strncmp strncpy

api-ms-win-crt-math-l1-1-0

copysign

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char