distribution.exe

First submission 2024-10-14 12:45:31

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 477.58 KB (489047 bytes)
Compile time: 2024-08-22 08:49:04
MD5: 2cf67f645897af37ea483ed1aa3b2790
SHA1: 729c4b36a2fd05b48df50d699bd0e79bf3264113
SHA256: e883610cabd818980e40effcc3ae5c47771d4ccdf93d48d7a597fdbb4ab60aee
Import Hash : 72c4e339b7af8ab1ed2eb3821c98713a
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://117.72.70.169/distribution.exe VirusTotal Report 117.72.70.169 VirusTotal Report 2024-10-14 12:45:31

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x29f00 172032 2d9a342b9cea10af36a9defffc2a2fd763e338be a6c3b829cc8eaabb1a474c227e90407f
.rdata 0x2b000 0x12a50 76800 1a7d093b6c5af884dfd82e12e79d1bb8e71fd6ed 63568a09bf6a8f9c0c87dd554e343b43
.data 0x3e000 0x53f8 3584 069fd3959f91e690643115a296bf21044144de01 dba0caeecab624a0ccc0d577241601d1
.pdata 0x44000 0x2250 9216 09c2a6d5404bc19e11f7eddad07a164b42b01ee6 181312260a85d10a1454ba38901c499b
.rsrc 0x47000 0x10e34 69632 569a56c4e70b7120d128b89a683f6754cde7b5c5 e033defec470b9ce6e057b3370ac2783
.reloc 0x58000 0x764 2048 d73caf6099972c4407ac22954a7454e922084dc0 816c68eeb419ee2c08656c31c06a0fff

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x470e8 67624
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x57910 20
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x57924 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Compressed
base_library.zip
Library
mscoree.dll
vcruntime140.dll
USER32.dll
ADVAPI32.dll
COMCTL32.dll
ucrtbase.dll
GDI32.dll
KERNEL32.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
discordnitrogen.exe 2024-08-26 11:31:14 2db515aa4c8ba2b4e6878e7e0b550c8f
tac.exe 2024-09-23 16:57:06 8a35be4e0576e642603dc78f07f32a93
Software.exe 2024-09-24 15:24:04 66c1d33fa2373f9f734336b87f123e31
st3amBYluxy.exe?ex=670cd923&is=670b87a3&hm=9d7dba21c2a8ad22d47f3edba77c4617ddfb3d025ff473df74bdf2b60f0c68d1& 2024-10-13 17:33:03 23f733d217275847ffb11bf97827dae8
freenitro.exe?ex=670c1355&is=670ac1d5&hm=fe431b2f20f8cc958563e6e904e1c828290ba1470a54a6f82725608fa4784485& 2024-10-13 19:34:02 8c9efd9a2d9d55aad11203cc4e3c816d
nitrobuyer.exe?ex=670c445a&is=670af2da&hm=1f281fd80c98af4f9fd87d76a7cd35a3e597b77693d1a804430d0000615d585a& 2024-10-13 19:38:03 32554d2f5dcd9927b21b43dda85359c2
mullakka.exe?ex=670c4027&is=670aeea7&hm=c37458cb8f8dc2985499fcc5dd86600a1dda5f7a724709109a97ae24970f4d65& 2024-10-13 20:17:02 136c7ac634c84ad86c1c7340c9262116
FreakyBrowse.exe?ex=670c18f3&is=670ac773&hm=3a26c3c7751649dfe642708c7308021483cb3a3e840a9d7ffd5fdf0ed02746be& 2024-10-13 20:39:02 a2728dfccca75072dd2f6c6a02617ee6
Wahiy_swapper.exe?ex=670e299f&is=670cd81f&hm=d668cc4432184523e29c1a622634c90477a431b1b18691a624773cd7989420a9& 2024-10-14 16:52:04 8e77547b14323977331594025634d90a
worker.exe 2024-10-14 23:10:06 5f08961671234960517cefb9df7a8c41
Rv2_Nuker.exe?ex=670f7931&is=670e27b1&hm=22265025fa8bb5baf986ff9795b8348e2c4fa24d4f6cced287e52fcfb45bf1e7& 2024-10-15 20:10:02 b459e3a71f72a9ac8a725144d56d1168
hydra.exe?ex=670ef165&is=670d9fe5&hm=d1114b65b18c8fc6ac378cf57169ad9d4f23499ced8ea6fe3b1fe96461e38a98& 2024-10-15 20:12:05 d446fa000d260aa78513d383874d82e5
Exela.exe 2024-10-15 21:10:21 83154f0731104f82b198eb13465dfa57