wmp9.exe

First submission 2024-10-16 20:09:03

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Mime type: application/x-dosexec
File size: 12789.13 KB (13096072 bytes)
Compile time: 2001-08-18 03:42:57
MD5: 10529c0d8a84161a1f806fad4d58e40f
SHA1: bebf458e7c473f4f7a80f04196570a3ddead1075
SHA256: 0118a308c8713dcc7b23cad9018e76ba08aa45f9bce7d7299a90006ec8d91502
Import Hash : 1494de9b53e05fc1f40cb92afbdd6ce4
Sections 3 .text .data .rsrc
Directories 4 import resource debug security

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://www.neklatek.com/indirmeler/wmp9.exe VirusTotal Report www.neklatek.com VirusTotal Report 2024-10-16 20:09:03

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x861a 34816 03418ebc42b91a08a6b42629c02703d9d905e7a2 43984be5cb414e4634db17caa4d1c30b
.data 0xa000 0x1be4 1024 8d38660485ad9cbae834e4aa747167ff99f25bae 730893b14fc930a187215e7fb53bc0a5
.rsrc 0xc000 0xc73000 13052416 271cb0988cbf2cef83a1c2af186f1a52b9aca9ae 1b7016823d5039624b9a915d2323bd6f

PE Resources 7

Name Language Sublanguage Offset Size Data
AVI LANG_TURKISH SUBLANG_DEFAULT 0xc7e0 11802
RT_ICON LANG_TURKISH SUBLANG_DEFAULT 0xf8e4 296
RT_DIALOG LANG_TURKISH SUBLANG_DEFAULT 0x10320 284
RT_STRING LANG_TURKISH SUBLANG_DEFAULT 0x11914 818
RT_RCDATA LANG_ENGLISH SUBLANG_ENGLISH_US 0xc7e390 394
RT_GROUP_ICON LANG_TURKISH SUBLANG_DEFAULT 0xc7e51c 34
RT_VERSION LANG_TURKISH SUBLANG_DEFAULT 0xc7e540 968

Meta infos 9

LegalCopyright: (C) Microsoft Corporation. All rights reserved.
InternalName: Wextract
FileVersion: 9.00.00.2980
CompanyName: Microsoft Corporation
ProductVersion: 9.00.00.2980
FileDescription: Windows Media Component Setup Application
Translation: 0x041f 0x04b0
OriginalFilename: WEXTRACT.EXE
ProductName: Windows Media Component Setup Application

Packers detected 2

Borland Delphi 3.0 (???)
Microsoft Visual C++ v6.0

Anti debug functions 1

GetLastError

File signature

MD5 SHA1 Block size Virtual Address
8e4b9dcad1a66fdb67fea8b72b5aae3b 9e78c1a51fe8281ace34a33bf11469a0bbe730cc 6792 13089280

Strings analysis - File found

Temporary
IXP%03d.TMP
msdownld.tmp
TMP4351$.TMP
Object
wmp.ocx
Archive Java
wmpns.jar
Compressed
npdrmv2.zip
XML
control.xml
Text
eula.txt
Library
SHELL32.dll
wmpdxm.dll
wmpband.dll
wmp.dll
WMDMPS.dll
blackbox.dll
mpg4dmod.dll
migrate.dll
wmpcd.dll
wmpasf.dll
wmerror.dll
9xmigrat.dll
wmidx.dll
setupx.dll
dwintl.dll
WMVDMOD.DLL
npdrmv2.dll
WMADMOD.DLL
mpvis.DLL
msoobci.dll
wmpcore.dll
WMDMLOG.dll
WMNetMgr.dll
MEDIAPLAYERV2.DLL
MsPMSP.dll
WMASF.DLL
custsat.dll
WMSDMOE2.DLL
CDENGINE.DLL
wmpui.dll
rsl.dll
drmstor.dll
W95INF32.DLL
CDDATAPS.DLL
SETUPAPI.dll
NPWMSDrm.dll
LAPRXY.DLL
pidgen.dll
WMPNS.dll
GDI32.dll
drmv2clt.dll
MP43DMOD.DLL
ADVAPI32.dll
#S\KERNEL32.DLL
ISO9660.DLL
unicows.dll
KERNEL32.dll
WMADMOE.DLL
wmvcore.dll
COMCTL32.dll
qasf.dll
DRMClien.dll
msscp.dll
MsPMSNSv.dll
asferror.dll
JOLIET.DLL
WMVDMOE2.DLL
wmpshell.dll
MSWMDM.dll
msnetobj.dll
advpack.dll
USER32.dll
msdmo.dll
VERSION.dll
WMSPDMOD.DLL
WMSDMOD.DLL
W95INF16.DLL
MP4SDMOD.DLL
WMSPDMOE.DLL
CEWMDM.dll
wmploc.DLL

Strings analysis - Possible URLs found 5

https://www.verisign.com/rpa
https://www.verisign.com/rpa0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0
http://www.microsoft.com/windows/windowsmedia
http://ocsp.verisign.com/ocsp/status0

Import functions