Hellion.exe?ex=670cea30&is=670b98b0&hm=4f7665cca7ce690d93371e135e7a55f274a942371cf86079ab5759d8c334f6dc&

First submission 2024-10-13 18:17:04

File details

File type: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Mime type: application/x-dosexec
File size: 39456.5 KB (40403456 bytes)
Compile time: 2024-10-12 17:51:46
MD5: 25328964e86c43023c38d23c0fe59e00
SHA1: 7d045947ad7a7e7efd29dc65285bdf7bcd070801
SHA256: a65131b4a2afa0bbc3d7fa3db1c4a58fd3b8498a7b289013852d2979f40818d4
Import Hash : ae21233514eb2e47a60a61ce2f15abb9
Sections 12 .text .data .rdata .eh_fram .pdata .xdata .bss .idata .CRT .tls .rsrc .reloc
Directories 4 import resource tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 37/77 VT report date: 2024-10-13 12:03:29
Malware Type 1 trojan
Threat Type 1 python

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1294960192546406511/1294961297720606760/Hellion.exe?ex=670cea30&is=670b98b0&hm=4f7665cca7ce690d93371e135e7a55f274a942371cf86079ab5759d8c334f6dc& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 18:17:04

PE Sections 3 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x1b088 111104 60ca639a51018b44c0276f92649a05b20c4e85dc eae1b6dbaa9874d4b2234e722f358830
.data 0x1d000 0x110 512 ac058993ad0da4c10952eecdcf890e15948b4807 b2714f3e967610598d6d022358e00546
.rdata 0x1e000 0x2b50 11264 7f9f8a4f4f2c4bc45693b321b4d47035bf0def7f 2ebdf5c61b793992cf63f1ccf4c1ceb6
.eh_fram 0x21000 0x4 512 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 bf619eac0cdf3f68d496ea9344137e8b
.pdata 0x22000 0x828 2560 8fa9f175b1b316eb66ef7a24e43806d800989456 9ba3ee9ac8343a3cd1ba0093318d504f
.xdata 0x23000 0x9f8 2560 e54a2fd701bd53b1578e7c604b1c9636d988bf90 ed71e5a4998d0461509a1536991a200f
.bss 0x24000 0x23c90 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0x48000 0xe58 4096 9c5879252352ee28fc2358c9cc617d96c70af0a1 e60ac6aba1d4f2e35c703d8ac5d7e857
.CRT 0x49000 0x60 512 92ab3db0bd62d5ebe1570015fbd07bc46728fd40 d06a0e90c0df1e6566e580db544adb30
.tls 0x4a000 0x10 512 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 bf619eac0cdf3f68d496ea9344137e8b
.rsrc 0x4b000 0x2667028 40268288 bb53ca0e4f6d6da86d4bc4df356ee4d234cb50a7 9fb6401fe4c6e4f39184a23da465a2fd
.reloc 0x26b3000 0x94 512 6762e4f2b1bbcca26c3be0a83d7c61517577a703 9bb4bcbf39f8279a4c9ccfa7c30d99f4

PE Resources 2

Name Language Sublanguage Offset Size Data
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0x4b0a0 40266640
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x26b1c30 1016

Anti debug functions 2

GetLastError
TerminateProcess

Anti debug functions 2

VMCheck.dll
VirtualPc trick

Strings analysis - File found

Cabinet
f.CaB
Database
RJ.db
Library
libgcc_s_dw2-1.dll
MSVCRT.dll
SHELL32.dll
KERNEL32.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
zzzz1.exe 2024-08-27 22:41:03 a5c740eb48fafb9b25d06c22b6f4a7e9