FreeMenuF7.exe?ex=670c6a4f&is=670b18cf&hm=708940c07a26aaf3672b4ecc443356a73d7db9284ddace557e866ab656ed23b4&
First submission 2024-10-13 17:37:02
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 7571.16 KB (7752871 bytes) |
| Compile time: | 2024-09-22 12:55:57 |
| MD5: | 1069ade6b99d29bfe4d0526e23ed714d |
| SHA1: | 47fe8ecfe75b239ed1d5eb8b867a1a9f091c510c |
| SHA256: | c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3 |
| Import Hash : | a06f302f71edd380da3d5bf4a6d94ebd |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 5 | import resource debug relocation security |
File features detected
Anti VM
XOR
OSINT Enrichments
| Virus Total: | 45/77 VT report date: 2024-10-12 19:48:16 |
| Malware Type 1 | trojan |
| Threat Type 3 | tedy python pyinstaller |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1292492515546497107/1294642793238499459/FreeMenuF7.exe?ex=670c6a4f&is=670b18cf&hm=708940c07a26aaf3672b4ecc443356a73d7db9284ddace557e866ab656ed23b4&  |
cdn.discordapp.com |
2024-10-13 17:37:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2b110 | 176640 | ea200f32c9b32ca6d80cc06d709db3e6a5557f73 | 55ff5ed922edfe0b0c10734c674f4ee4 | |
| .rdata | 0x2d000 | 0x12842 | 76288 | 12cf0f1482c667d2b07223b5e81c24176f91238f | 56249b92af6fd6fa0d103d9b82bcce17 | |
| .data | 0x40000 | 0x5408 | 3584 | 249cf6b3c95e5782a7f27c661b5f018c45d7745c | aff56347f897785154c53727472c548d | |
| .pdata | 0x46000 | 0x22f8 | 9216 | b5fd13ef0a20267ee6c023bcfed00a928a687dfd | 57f77a295f3be6e2a8e90035dde19ce2 | |
| .rsrc | 0x49000 | 0x948 | 2560 | 86c789a0d468c7bf8e77794fbd693ea1b0c38ba3 | c6bc22c65b6982797e1530776295597c | |
| .reloc | 0x4a000 | 0x768 | 2048 | e599e91a866af587afec0cc6408b4eaba8188703 | 42d6242177dbae8e11ed5d64b87d0d48 |
PE Resources 2
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x490a0 | 920 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x49438 | 1293 |
Meta infos 10
| LegalCopyright: | \xa9 Microsoft Corporation. All rights reserved. |
| OleSelfRegister: | D |
| InternalName: | CTFMON |
| FileVersion: | 10.0.19041.1 (WinBuild.160101.0800) |
| CompanyName: | Microsoft Corporation |
| ProductVersion: | 10.0.19041.1 |
| FileDescription: | CTF Loader |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: | CTFMON.EXE |
| ProductName: | Microsoft\xae Windows\xae Operating System |
Packers detected 2
| Microsoft Visual C++ 8.0 (DLL) |
| Microsoft Visual C++ 8.0 |
Anti debug functions 7
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| 7c376d23b11698129fdaaac7b6b5b8d4 | b2d43454932979d82015c1b8eb8f22393f421099 | 9288 | 7743583 |
Strings analysis - File found
| Compressed |
| base_library.zip |
| bbase_library.zip |
| Library |
| mscoree.dll |
| vcruntime140.dll |
| ADVAPI32.dll |
| bsqlite3.dll |
| KERNEL32.dll |
| 7python311.dll |
| ucrtbase.dll |
| bpython311.dll |
| bVCRUNTIME140.dll |
| blibcrypto-3.dll |
| USER32.dll |
| blibffi-8.dll |
| blibssl-3.dll |
Strings analysis - Possible URLs found 18
| http://s.symcb.com/universal-root.crl0 |
| http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0 |
| http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0 |
| http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0# |
| http://ocsp.comodoca.com0 |
| https://sectigo.com/CPS0 |
| http://ocsp.sectigo.com0$ |
| http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0# |
| http://ocsp.sectigo.com0 |
| http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0( |
| http://ts-ocsp.ws.symantec.com0; |
| https://d.symcb.com/rpa0@ |
| https://d.symcb.com/cps0% |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| https://d.symcb.com/rpa0. |
| http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0 |
| http://s.symcd.com06 |
| http://crl.comodoca.com/AAACertificateServices.crl04 |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| RezWareUpdater.exe?ex=670cae4b&is=670b5ccb&hm=6b7767e2959bba7239b160100573375d95ac04f204f064ca6d9161caf5dd4d0e& | 2024-10-13 18:25:03 | caf83d29d4db7764696f1c225317fe16 |
| oconsole.exe | 2024-10-16 08:19:03 | a6ff47344d0188ec4c26dc435698a477 |