NOScript_V1.35_Optimization_Program.exe?ex=670cea11&is=670b9891&hm=ef0c18bb613bbf2531ff91f08d378787965d64e2e6c1999a8028027b37a26526&

First submission 2024-10-13 18:32:02

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 156.0 KB (159744 bytes)
Compile time: 2062-07-25 14:18:00
MD5: 00a66870b86ad2c0c9a723dbe3d587d0
SHA1: 0755b0f6ab3126db87eb7dcb00e4a92f59c28b9d
SHA256: 8c9c001f07cef1112f13614744182c86157302bebf98343204d60a885c369313
Import Hash : 4cea7ae85c87ddc7295d39ff9cda31d1
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1094623651388735512/1294961168217014325/NOScript_V1.35_Optimization_Program.exe?ex=670cea11&is=670b9891&hm=ef0c18bb613bbf2531ff91f08d378787965d64e2e6c1999a8028027b37a26526& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 18:32:02

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x7b80 31744 06e63be17d4a58c8b55b36c7342e541d00d61a93 60800deac1fde21b98089f2241ee6168
.rdata 0x9000 0x22c8 9216 3b5f897036bf0d72ebd732362c8f60d2e1f1a5cf 59d15cdf89780817c3d48dd588a6a129
.data 0xc000 0x1f00 1024 7f0ee10c956d86fef4e6351c3ee77dd00350a9c9 9d1580dccaf8e787a43caf4bba48a079
.pdata 0xe000 0x408 1536 ad44ea7406ea6c51a0ab1ea04598f448ce47d593 15cd12257317071f28e4f7b728f8825e
.rsrc 0xf000 0x1c000 114688 f67e8c7efacec8ad7fa3f4ac521e59f24c31d767 227c6ddd5ccff91dbfeaac5d5cfdf590
.reloc 0x2b000 0x20 512 4d5087ba3cb6a051543140baca75212fa7ac8e34 637787151ee546a94902de9694a58fd6

PE Resources 8

Name Language Sublanguage Offset Size Data
AVI LANG_ENGLISH SUBLANG_ENGLISH_US 0xf9f8 11802
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x271a0 1128
RT_DIALOG LANG_ENGLISH SUBLANG_ENGLISH_US 0x27f04 288
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0x29498 974
RT_RCDATA LANG_ENGLISH SUBLANG_ENGLISH_US 0x2a188 19
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x2a19c 188
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x2a258 1032
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x2a660 2022

Meta infos 9

LegalCopyright: \xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract
FileVersion: 11.00.19041.1 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductVersion: 11.00.19041.1
FileDescription: Win32 Cabinet Self-Extractor
Translation: 0x0409 0x04b0
OriginalFilename: WEXTRACT.EXE .MUI
ProductName: Internet Explorer

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)

Anti debug functions 3

GetLastError
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Temporary
TMP4351$.TMP
IXP%03d.TMP
msdownld.tmp
Library
KERNEL32.dll
ADVAPI32.dll
SETUPAPI.dll
advpack.dll
USER32.dll
VERSION.dll
MSVCRT.dll
setupx.dll
COMCTL32.dll
cabinet.dll
SHELL32.dll
GDI32.dll

Import functions

Name Latest seen MD5
wam.exe 2022-08-29 08:31:03 9b8464cd768802d3d49b80a8ef78d7a1
netnvm64.exe 2022-09-27 08:04:05 4c2cdb900536961dfdcda8be0be11574
Galaxy.exe 2022-10-07 18:49:02 26984bb9bcbde9866faca7f20717f587
new.exe 2022-10-11 10:52:03 762d276b402209a5ce78d9a9258f1bd3
movie.exe 2022-10-22 01:12:02 4cf7cc220ac7067fb426f142abbc9468
well.exe 2022-10-22 07:14:02 1736d5e66964722a2d5301c515f17496
civiltechnological.exe 2022-10-26 18:52:05 6715b8072392e3643ef086fc986ec25f
becomeproblem.exe 2022-10-28 20:47:06 d6e9e86e003086022805cd59d1a406bd
securitytitle.exe 2022-10-31 07:21:03 284f809cd813f041b06e903f33841601
understanddecline.exe 2022-11-16 18:50:09 fbbf2ce201380bfd14cbe5a31d2b17de
server5.EXE 2022-12-20 14:22:06 a383534669ff5ef9786e6aa9dc78ca66
ransom.EXE 2022-12-20 14:41:31 f75bbc3a02c7ae376c6e21bb58d70224
krnl_connect.exe 2022-12-21 02:38:04 d2e78f6663b47a7ec04a4d014cab5ff1
prettyremote.exe 2022-12-24 16:45:05 6628fb4f54815e0907c1760315b78983
activitycoordinate.exe 2022-12-28 21:43:02 95a9c9387e52c3dd853429264fe35564
25.exe 2023-01-04 09:50:02 5f2e9cf31a58bf42d6059f472649ef2f
xx.exe 2023-01-05 18:51:02 f4974a20ba2cd22cb9069aac0d337136
Installerr.exe 2023-02-25 18:50:02 720cef5d7d31d20d9ce66ff8fccaa0dc
aliacesz.exe 2023-03-06 07:09:03 9b34a1a535c29e31915e4b8993d9bb5e
setup.EXE 2023-06-04 20:24:04 426937c153dd506951c7f40a94094c48
djlw_zip.exe 2023-06-16 13:33:01 90c4d8c8f396f66d9b556ab05344a8cd
leadiadequatepro.exe 2024-06-28 09:22:03 b149f82964b1e269ade2686612a9e777
easyengineeringpro.exe 2024-06-28 10:18:02 51d6c3f850923398dda928c4a71d6187
cultureeyestrainpro.exe 2024-06-28 10:26:05 db527e671b1947fdb99b9a5a64f2742f
propertysitepro.exe 2024-07-29 08:06:03 a7221cf05ec4add1d531b242c1faace7
Solara.exe 2024-09-26 01:43:02 51c009abf871216f8d9e40cdd785ce6c
file.exe 2024-10-05 10:13:02 7300cad585fefa6a6f67c78ac264b128
vclib.exe 2024-10-08 00:11:03 52c1acdcbb715dd099648b26b98254e8
6706e721f2c06.exe 2024-10-15 21:54:02 9d26cee91cd86b11808a161681be9f85