Belphegor_crypto.exe

First submission 2023-09-14 23:52:03

File details

File type: PE32 executable (console) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 559.07 KB (572488 bytes)
Compile time: 2023-09-14 09:39:17
MD5: 1ae5e18c3f032578c3e8e1f2dad127ac
SHA1: b8caf307edba082e98ce0186f123496771705315
SHA256: f561a2851020a8f0473104f4c4123c9730710c0fb6faf6cfcdd926694960374d
Import Hash : 0c9c64525522b2a989036b9afc41aa0b
Sections 5 .text .rdata .data .reloc .rsrc
Directories 3 import resource security
Virus Total: 35/71 VT report date: 2023-09-14 18:34:26

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://178.236.247.24/Belphegor_crypto.exe VirusTotal Report 178.236.247.24 VirusTotal Report 2023-09-14 23:52:03

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x106bf 67584 dd1704c4f4680e5c42ea5e063e43d81e9fcc31e1 ddf033150028873744500f1c1b8a72f9
.rdata 0x12000 0x378a 14336 a5a2510806d87e888e714b76019c620ce892cf9e a607557db18291fa0c7a47bd9957c1f1
.data 0x16000 0x1c5c 4608 5a503b735585bd3f1ed1637aa409ea2a74cc106d 32bc81bbc8374c8eb7e0dac4bd69fd4e
.reloc 0x18000 0x4e 512 379c72215c7e15b4d11647f28bb482d5ed2540a5 33577e975840e0058792ebc82ef9ce84
.rsrc 0x19000 0x732b0 472064 9ee3665410a4e0c1f2d71b62a9a0481f0bf841e4 aabc9848c1f4dbc7c4855def5633f6ab

PE Resources 2

Name Language Sublanguage Offset Size Data
RT_RCDATA LANG_ENGLISH SUBLANG_ENGLISH_US 0x194b0 470528
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x190a0 1040

Meta infos 11

LegalCopyright: Copyright \xc2\xa9 Shoulders robins
InternalName: Doorkeepers
FileVersion: 6.35.125.5
CompanyName: Psychedelic
LegalTrademarks: Confessions arsenal hardware reflected
Comments: Shrug gene sewer bookshop heft frill
ProductName: Decompress
ProductVersion: 6.35.125.5
FileDescription: Receding reiterates profession compressions cistern matings
Translation: 0x081a 0x081a
OriginalFilename: Producing

Packers detected 2

Microsoft Visual C++ 8
VC8 -> Microsoft Corporation

Anti debug functions 5

GetLastError
IsDebuggerPresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

File signature

MD5 SHA1 Block size Virtual Address
3a13c3cf08786e2feebdbb2b68ddf2db 8b20283cf5fd138be501710b0454c8fbe8dba596 12360 560128

Strings analysis - File found

Library
KERNEL32.dll
mscoree.dll
COMDLG32.dll
USER32.dll
ole32.dll

Strings analysis - Possible IPs found 1

6.35.125.5

Strings analysis - Possible URLs found 19

http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
http://ocsp.digicert.com0C
https://sectigo.com/CPS0
http://ocsp.digicert.com0A
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
http://ocsp.comodoca.com0
http://crl.comodoca.com/AAACertificateServices.crl06
http://crl.comodo.net/AAACertificateServices.crl0
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
http://ocsp.sectigo.com0
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
http://crl.comodoca.com/AAACertificateServices.crl04
http://ocsp.digicert.com0X

Import functions