FULL_OPTION.exe?ex=670cd9df&is=670b885f&hm=f96f5f9cd851186ea91a8a05f51a220521262d9876beec33e33c76c4a2ca748b&

First submission 2024-10-13 17:35:02

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 3871.5 KB (3964416 bytes)
Compile time: 2024-07-26 11:31:28
MD5: 1dcdd77ba8afe481b4af754876f70ee8
SHA1: 322ac691dc8b990ccb94f66f43a1b98f4d1eb299
SHA256: e5f2c31e3b741665821670118a78692cd1f44a349ad20007c0628fa3fb307734
Import Hash : 78bbdb4b113bfc6f56d7405a719a03a2
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 5 import resource debug tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 50/77 VT report date: 2024-10-13 12:53:35
Malware Type 2 trojan pua
Threat Type 3 lazy cryptinject gamehack

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1293129724532625421/1293131838625288265/FULL_OPTION.exe?ex=670cd9df&is=670b885f&hm=f96f5f9cd851186ea91a8a05f51a220521262d9876beec33e33c76c4a2ca748b& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 17:35:02

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x149850 1350144 8522a777364a6d379186b7d8a16cbf7f3279f2da 957f9c5b4ec6251ec87113460d07d590
.rdata 0x14b000 0x55552 349696 82706f0fd427061aa1224bfc7c5393159473acf4 fde6abcd456578e4a81a7ce85ef957a8
.data 0x1a1000 0x215ff0 2173952 b9b7113b1af245839802ab8c61223beb8ffb89e6 14ad1dbc36423f44c2cc2ae01c1646f8
.pdata 0x3b7000 0xd9b0 55808 99613427dedfabf6dbbc856e7b2ee4a036e32b6f feebe98776a84f9c7bcce201f17c0daa
.rsrc 0x3c5000 0x688c 27136 74fa3d81e91c06b3030edd941d721dbebf7fd1c4 07ed8ab80be8bafcc49ab95d53e4cc4a
.reloc 0x3cc000 0x1838 6656 843287ec769d8d07d13a9b7092e6c7b23ced5b11 345b5cad57438f2c3d3bc94dc430de2e

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x3c50e8 26119
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x3cb6f0 20
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x3cb704 392

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)

Anti debug functions 12

CheckRemoteDebuggerPresent
FindWindowA
FindWindowW
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
OutputDebugStringW
Process32FirstW
Process32NextW
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 2

Virtual Box
VMCheck.dll

Strings analysis - File found

Temporary
%s.%s.tmp
Data
*.dat
Text
imgui_log.txt
Library
ntdll.dll
rage-device-five.dll
net.dll
ADVAPI32.dll
rpcrt4.dll
api-ms-win-crt-convert-l1-1-0.dll
VBoxHook.dll
SHELL32.dll
dwmapi.dll
VCRUNTIME140_1.dll
USER32.dll
xinput1_3.dll
KERNEL32.dll
d3d11.dll
vcruntime140.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
secur32.dll
WS2_32.dll
WLDAP32.dll
api-ms-win-crt-locale-l1-1-0.dll
SbieDll.dll
d3dx11_43.dll
xinput1_1.dll
IPHLPAPI.DLL
security.dll
api-ms-win-crt-string-l1-1-0.dll
PSAPI.DLL
xinput9_1_0.dll
api-ms-win-crt-time-l1-1-0.dll
USERENV.dll
api-ms-win-crt-heap-l1-1-0.dll
xinput1_4.dll
api-ms-win-crt-stdio-l1-1-0.dll
COMDLG32.dll
IMM32.dll
D3DCompiler_43.dll
xinput1_2.dll
normaliz.dll
Crypt32.dll
api-ms-win-crt-runtime-l1-1-0.dll
msvcp140.dll

Strings analysis - Possible IPs found 26

127.0.0.1
2.5.4.8
2.5.4.9
2.5.4.6
2.5.4.7
2.5.4.4
2.5.4.5
2.5.4.3
2.5.4.72
2.5.4.10
2.5.4.11
2.5.4.12
2.5.4.13
2.5.4.17
1.3.14.3
2.5.4.45
101.3.4.2
2.5.29.19
2.5.4.65
2.5.29.17
2.5.4.46
2.5.29.18
2.5.4.44
2.5.4.43
2.5.4.42
2.5.4.41

Strings analysis - Possible URLs found 19

https://shyisus.xdnz.xyz/
https://curl.haxx.se/docs/http-cookies.html
http://purl.org/dc/elements/1.1/
ftp://%s:%s@%s
https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad
file://
http://www.apache.org/licenses/LICENSE-2.0
https://discord.gg/YMFPQHEhvY
http://www.w3.org/1999/02/22-rdf-syntax-ns#
file://%s%s%s
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/tiff/1.0/
https://github.com/itfoundry/Poppins)
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
https://scripts.sil.org/OFLThis
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/exif/1.0/

Import functions