rundl.exe
First submission 2024-10-16 17:36:03
Last sumbission 2024-10-16 17:37:05
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 470.5 KB (481792 bytes) |
| Compile time: | 2022-11-16 20:11:43 |
| MD5: | 0bc532538aea8f63c70ed009d4290c73 |
| SHA1: | 9ef7d7b4174618bd053df4b86453102709804eb7 |
| SHA256: | fc074a5ed883b127fe005d14e1e0b870a93318ed1840fd94e9771458a19a229e |
| Import Hash : | 658143f158f14e9bff661e164dfff376 |
| Sections 7 | .text .rdata .data .tls .gfids .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 60/77 VT report date: 2024-08-25 18:32:02 |
| Malware Type 1 | trojan |
| Threat Type 3 | remcos rescoms ratx |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://blaconmachine.com/wrdl/rundl.exe  |
blaconmachine.com |
2024-10-16 17:36:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x544db | 345600 | da327576cf53b8d82e8ffe587c4740e9d6e660fc | 3b313dd7e0b88bc4f20b027608872bb4 | |
| .rdata | 0x56000 | 0x1749c | 95744 | 95ccc53a34e649ac5c80fc3a436f296782c2ef67 | ee53e60b1edc667785b9d9a9b066e70a | |
| .data | 0x6e000 | 0x5c2c | 3584 | 83bd7dd6fcad1d6db972c3655746e854604ac23f | a4f9cb337e6b61f2cfff51c01b633917 | |
| .tls | 0x74000 | 0x9 | 512 | aa0d33a0c854e073439067876e932688b65cb6a9 | 1f354d76203061bfdd5a53dae48d5435 | |
| .gfids | 0x75000 | 0x230 | 1024 | 545d0d24902e034ccbf85f77d48719f3ffd0cdba | 24ce52767f7213e77eec2ab2a4e6e7be | |
| .rsrc | 0x76000 | 0x4b28 | 19456 | 1981f98ada7e92ee6776fc4ca5af9de1ff508aa6 | bbb1c13546db0e26532dc09d056f3be2 | |
| .reloc | 0x7b000 | 0x39b4 | 14848 | a016d710e5b3a73660cfede9f1d3086c8894f046 | 75a063302dfdd9fb0dcfea0c10ae3f1f |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x78024 | 9640 | |
| RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x7a5cc | 1306 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x7aae8 | 62 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 9
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Database |
| \key3.db |
| Text |
| \sysinfo.txt |
| license_code.txt |
| Library |
| mscoree.dll |
| KERNEL32.dll |
| SHLWAPI.dll |
| WINMM.dll |
| ADVAPI32.dll |
| ntdll.dll |
| USER32.dll |
| PSAPI.DLL |
| WININET.dll |
| SHELL32.dll |
| Powrprof.dll |
| gdiplus.dll |
| urlmon.dll |
| WS2_32.dll |
| GDI32.dll |
Strings analysis - Possible URLs found 1
| http://geoplugin.net/json.gp |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| vhad.exe | 2022-12-09 18:44:02 | ec8e41469c87d52dc8238ba282f613b6 |