s1.exe
First submission 2023-09-14 23:51:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 297.5 KB (304640 bytes) |
| Compile time: | 2023-01-17 17:50:38 |
| MD5: | 1d6a742534494f66081d5b70f44f6695 |
| SHA1: | 1bf8a9547ab90cdf0b22b6dd92b3e2abfd6ff2c2 |
| SHA256: | 9e89c31df9863bff75a294fdf1700a0a18607a0ddbf1bab54426a834c758e592 |
| Import Hash : | 85f93ec750e6f7137bb7fe5a5261ac14 |
| Sections 4 | .text .data .rsrc .reloc |
| Directories 4 | import resource debug relocation |
| Virus Total: | 29/71 VT report date: 2023-09-14 21:23:41 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://5.42.64.2/api/files/software/s1.exe  |
5.42.64.2 |
2023-09-14 23:51:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x3c5f6 | 247296 | 83aa76869460d14b6e028fd016ff4248d891caca | d8fa042b21833dbf85e3ec8c8f8ede6f | |
| .data | 0x3e000 | 0x50408 | 12800 | 531ff606888be429907d1fe5b8ed1ee0bddec97c | 121824430571e5d7024efbdb8a53107c | |
| .rsrc | 0x8f000 | 0x86b0 | 34816 | 58bbdbe72354dcb1119850dd3a50c7931141d049 | 2088815cfe78c4cd4ec05bb863021008 | |
| .reloc | 0x98000 | 0x211e | 8704 | fcccb1e66b743dd505038b0089394a2d6c479f3b | 1897458b43c7bea6a34e74e801b5108e |
PE Resources 8
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x92700 | 14 | |
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x95d50 | 1384 | |
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x921f0 | 1128 | |
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x97190 | 1310 | |
| RT_ACCELERATOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x926d0 | 48 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x962b8 | 48 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x92658 | 48 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x962e8 | 624 |
Meta infos 7
| LegalCopyright: | Copyright (C) 2022, Uniqum |
| ProductionVersion: | 82.27.62.16 |
| FileDescription: | Silvuple |
| Translation: | 0x08bf 0x0ad5 |
| ProductsVersion: | 29.510.12.19 |
| OriginalFilename: | betshop.exe |
| ProductName: | Kuihmfghi |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| mscoree.dll |
| USER32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 1
| 82.27.62.16 |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| timeSync.exe | 2023-09-15 00:31:02 | 8816dec1704461c24f7575c00f7f86d4 |