167.exe
First submission 2023-09-16 11:34:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 268.5 KB (274944 bytes) |
| Compile time: | 2023-01-18 19:20:24 |
| MD5: | 29df412b9bddce9b6080d7fe66610868 |
| SHA1: | 500fc57fe1af43a9a13878ff08a2ce6a2969dfbc |
| SHA256: | a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844 |
| Import Hash : | be971270bdc2a8fd4ff1ab41bb993dd1 |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
| Virus Total: | 33/71 VT report date: 2023-09-15 21:48:39 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://h170703.srv22.test-hf.su/167.exe  |
h170703.srv22.test-hf.su |
2023-09-16 11:34:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1ecb8 | 126464 | 701789b37d4ce4305ddb28e6276f79664456b825 | 2564ea597fcd5a22208bf2adf53149dd | |
| .data | 0x20000 | 0x2e2dcc | 92160 | 948e9a89fd5c3204296f866f886b853b37eb40ed | 00bf0273259e796adfcd49552fc9c504 | |
| .rsrc | 0x303000 | 0xd770 | 55296 | e5b412dc21d57c11cd7aa082152bd308e3ca26e5 | 4e81654c14be88fea5a8ca8bc88aa9b1 |
PE Resources 6
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x30f338 | 2216 | |
| RT_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x30ee58 | 1128 | |
| RT_STRING | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x3102b0 | 1216 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x30fbe0 | 20 | |
| RT_GROUP_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x308aa0 | 90 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x30fbf8 | 644 |
Meta infos 8
| InternalName: | Cascader.exe |
| FileVersions: | 49.51.44.114 |
| LegalCopyrights: | Challangers bottle |
| CompanyName: | Phunderstuck |
| ProductVersion: | 17.25.64.30 |
| FileDescriptions: | Anybodies |
| Translation: | 0x124e 0x03fe |
| ProductName: | Bonni |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| WINHTTP.dll |
| USER32.dll |
| ole32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 2
| 49.51.44.114 |
| 17.25.64.30 |