1174180.exe
First submission 2024-10-15 21:47:13
File details
| File type: | PE32+ executable (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 7448.03 KB (7626784 bytes) |
| Compile time: | 2024-10-08 12:56:51 |
| MD5: | 110a014684ddaaf25e6b81d798d7ae8f |
| SHA1: | 2a7516f83872d15862448b9da8f72ceeadb2ec82 |
| SHA256: | 5df0c8a02789c6833a07bfbbff5a02b161201c1e55e9b00af59e7f1684e193b9 |
| Import Hash : | 12b2bc20d7737a83639913d36501fd39 |
| Sections 5 | .text .sedata .idata .rsrc .sedata |
| Directories 4 | import resource debug security |
File features detected
Anti VM
XOR
OSINT Enrichments
| Virus Total: | 41/77 VT report date: 2024-10-15 20:52:59 |
| Malware Type 1 | trojan |
| Threat Type 3 | rootkit dangeroussig ecpsx |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://by.haory.cn/f/f89/1174180.exe  |
by.haory.cn |
2024-10-15 21:47:13 |
PE Sections 3 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x59000 | 149504 | 0f1c234622439f51ed470970eec61a27495f3f9d | 6291e5150b96eadaf1ad499da499b885 | |
| .sedata | 0x5a000 | 0x15a000 | 1414656 | 736df004fffee37e6a47613fac74fdaa81548047 | bbf03b16d612bfad893bafc60e12d2ad | |
| .idata | 0x1b4000 | 0x1000 | 1024 | 755d9c69668c2c3673df11bdb0a8fbf3dfa766f1 | 014ea69c5c9ea2b9112132445b879bd2 | |
| .rsrc | 0x1b5000 | 0x12000 | 72704 | 8d53e32bbbec74d64e411c02e78ab3a80c021ad6 | f2ffff57b7abf9aa51de27473328572d | |
| .sedata | 0x1c7000 | 0x1000 | 4096 | 5fb5e0e7396db8c0bc1b3ec72ef2e201fd9c2749 | 658c539f00d58b68d39a2e54866b43cd |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1c5fd8 | 1128 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1c6440 | 188 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1c64fc | 1293 |
Packers detected 1
| Safeguard 1.03 -> Simonzh |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| a055c00166cb00a00f863a90daf56512 | 91009eb844799991fd8c9084397f321a91395e4e | 4888 | 7621896 |
Strings analysis - File found
| Executable |
| ee.so |
| Backup |
| h.oLd |
| Compressed |
| bbase_library.zip |
| Library |
| ADVAPI32.dll |
| MSVCRT.dll |
| mscorwks.dll |
| SHELL32.dll |
| IPHLPAPI.DLL |
| KERNEL32.dll |
| ntdll.dll |
| mscoree.dll |
| COMCTL32.dll |
| blibffi-7.dll |
| PSAPI.DLL |
| 4python38.dll |
| 6msvcrt.dll |
| bpython3.dll |
| bVCRUNTIME140.dll |
| blibssl-1_1.dll |
| clr.dll |
| diasymreader.dll |
| bpython38.dll |
| KernelBase.dll |
| hid.dll |
| SESDKDummy64.dll |
| USER32.dll |
| mscoreei.dll |
| GDI32.dll |
| mscorsvr.dll |
| blibcrypto-1_1.dll |
| Duser32.dll |
Strings analysis - Possible URLs found 11
| https://www.verisign.com/cps0 |
| http://ocsp.verisign.com0 |
| https://www.verisign.com/rpa |
| http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D |
| http://crl.verisign.com/pca3.crl0 |
| http://crl.verisign.com/pca3-g5.crl04 |
| https://www.verisign.com/rpa0 |
| http://logo.verisign.com/vslogo.gif04 |
| http://csc3-2010-aia.verisign.com/CSC3-2010.cer0 |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| http://ocsp.verisign.com0; |