Doc.exe
First submission 2024-10-01 12:10:03
Last sumbission 2024-10-15 18:34:03
| File type: |
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows |
| Mime type: |
application/x-dosexec |
| File size: |
15503.5 KB (15875584 bytes) |
| Compile time: |
1970-01-01 01:00:00 |
| MD5: |
2746a7120bce30e9230a2e71a9ad909f |
| SHA1: |
506c97a2e62a2c962dbd283b2344e73cac4f8271 |
| SHA256: |
4480d314657f84b2f829fb85fe6603c288bd9262e00e752e475c2a315dd2013f |
| Import Hash : |
f0ea7b7844bbc5bfa9bb32efdcea957c |
| Sections 6 |
.text
.rdata
.data
.idata
.reloc
.symtab
|
| Directories 2 |
import
relocation
|
URLs, FQDN and IP indicators 1
| URL |
Host (FQDN/IP) |
Date Added |
hXXp://ns1.smlms.mr/Doc.exe  |
ns1.smlms.mr |
2024-10-15 18:34:08 |
| Name |
VAddress |
VSize |
Size |
SHA1 |
MD5 |
Suspicious |
| .text |
0x1000 |
0x942dfd |
9711104 |
b0bba13b3b878b0f7cbd088a0557238cc163a8d3 |
24cfd1142cf5ef1cde557551d4e6c91b |
|
| .rdata |
0x944000 |
0x578158 |
5734912 |
987762ad544aec29d4b2198f9c007bd85fe78510 |
c6f09c58d59d65f22427926bde3132aa |
|
| .data |
0xebd000 |
0xaf350 |
266752 |
8196b3bb6e0d899c9d7eb5f717ae8d6bae04193b |
05d8eb8b115b53897dd83f07f2f22bc9 |
|
| .idata |
0xf6d000 |
0x490 |
1536 |
c5b74efbfff762d6808765b294f8cdb2524c0143 |
894ab5241150f06ca87878224acaf6bf |
|
| .reloc |
0xf6e000 |
0x26c52 |
159232 |
fd6a57d3159a2c1a9d69e94f5f1786db9e2cc533 |
e427021ec6a780efd307ada8663fb660 |
|
| .symtab |
0xf95000 |
0x4 |
512 |
943ae54f4818e52409fbbaf60ffd71318d966b0d |
07b5472d347d42780469fb2654b7fc54 |
|
Strings analysis - File found
| Log |
| bFI3Oz.(*LCwbRyx).Log |
| Library |
| _32.dll |
| rof.dll |
| KERNEL32.dll |
| L32.DLL |
| i32.dll |
Strings analysis - Possible IPs found 3
| 5.4.52.5 |
| 72.5.4.82 |
| 4.62.5.4 |
Strings analysis - Possible URLs found 1
| http://invalidkpasswdlookup |
Related files by ImpHash 13 f0ea7b7844bbc5bfa9bb32efdcea957c