build.exe
First submission 2023-09-14 12:51:03
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 315.0 KB (322560 bytes) |
| Compile time: | 2023-09-13 20:50:00 |
| MD5: | 2edc8c65202a68d10cb4d775ba91ed1b |
| SHA1: | 5cee7ed20e4d49778c8a7ec88f9b24c395fd7f97 |
| SHA256: | e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b |
| Import Hash : | f2222f0f215a06acc111aee4e181dfd8 |
| Sections 4 | .text .rdata .data .reloc |
| Directories 2 | import relocation |
| Virus Total: | 33/71 VT report date: 2023-09-14 10:34:11 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://mx1.gnarquitectos.online/build.exe  |
mx1.gnarquitectos.online |
2023-09-14 12:51:03 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x37b73 | 228352 | 80ee5dc8c3dd44d3171cdce3c7a36401bcf0f564 | 6fad80c4bb621e41e60e09949886bf35 | |
| .rdata | 0x39000 | 0xf8fe | 64000 | d5c276488641fa3180ff0394e0961bec2f10a9fb | c751c1d7755a2e14e53a1f0f7bd6872c | |
| .data | 0x49000 | 0x15284 | 7168 | 10fdfc776025f6d181447c893fa4ae6b63fb4eb7 | 7b9207dfdf9a812831dadd5e6e507c65 | |
| .reloc | 0x5f000 | 0x552e | 22016 | f1a2fb4c33ff2caad8e0e507b8b5369991bf44b3 | 7369bbac710872699fd6d9b4e4b19862 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Compressed |
| htdocs.zip |
| update.zip |
| Linker File |
| *.lnk |
| Text |
| \Downloads\%s_%s.txt |
| \CC\%s_%s.txt |
| \Autofill\%s_%s.txt |
| \History\%s_%s.txt |
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| freebl3.dll |
| OLEAUT32.dll |
| msvcp140.dll |
| nss3.dll |
| mozglue.dll |
| ole32.dll |
| RstrtMgr.dll |
| softokn3.dll |
| vcruntime140.dll |
Strings analysis - Possible URLs found 4
| https://t.me/bonoboaz |
| https://steamcommunity.com/profiles/76561199550790047 |
| http:// |
| https:// |