tdrp.exe
First submission 2024-10-12 08:02:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 86.0 KB (88064 bytes) |
| Compile time: | 2024-10-09 19:40:49 |
| MD5: | 21b61b3680c5e66f9f7b1f3026327757 |
| SHA1: | fad18744873c0f49daab677b53cea59f808c8097 |
| SHA256: | 8de13f64aab532c0bbd3d38cc821ba6fa67ccfadde9cffd14944cc9d85830f4a |
| Import Hash : | 45a55f64fd35b86e579e491145bcda68 |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 3 | import resource relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 50/77 VT report date: 2024-10-11 16:47:25 |
| Malware Type 3 | trojan downloader banker |
| Threat Type 3 | cliptoshuffler lazy phorpiex |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://twizt.net/tdrp.exe  |
twizt.net |
2024-10-12 08:02:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xcc4 | 3584 | 44874ba5a21f5c66e2a7b3cee4e796d7c1cc5143 | 4ed1d5456c0f8cfd3cc420222d608790 | |
| .rdata | 0x2000 | 0x730 | 2048 | 608ed925d7b945d4265739fd4ec7aa5d0a8b08f5 | 5da0b1b3ed58758731ad288dffb64cfa | |
| .data | 0x3000 | 0x138bc | 79360 | 8e9924ac106fb24fea5bf593858fa87474bcdf19 | b1cd435eb09ff7f76fc9df12b1c349f1 | |
| .rsrc | 0x17000 | 0x2b0 | 1024 | 1a59e0807c8b3185645e70b7543bd6b70c5ae12f | 2e93193bb597dc97157b7420079408b5 | |
| .reloc | 0x18000 | 0x2b0 | 1024 | 4c5abfd996dd1fe905c62ba618ea79ce18d4035c | 44e22485e85c9148fec63fce1e708d7e |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x17058 | 598 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 3
| IsDebuggerPresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Data |
| %s\tbtnds.dat |
| Library |
| USER32.dll |
| MSVCR90.dll |
| KERNEL32.dll |