index1.php
First submission 2023-09-13 10:53:03
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 298.0 KB (305152 bytes) |
| Compile time: | 2023-02-15 06:15:30 |
| MD5: | 2f8224fe21584d4780a10e6d3f4dd367 |
| SHA1: | 974f8cfce4a1c02225b4f715878d058c1f1883ae |
| SHA256: | 185191bcf9c8b49ddc40877f9b3638e01cebfc2b5ba3fea77098913df72bc5eb |
| Import Hash : | 6fba566ba00d06ca347aab1a29fbe8be |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
| Virus Total: | 30/70 VT report date: 2023-09-13 08:49:25 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://login-sofi.4dq.com/tmp/index1.php  |
login-sofi.4dq.com |
2023-09-13 10:53:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x20182 | 131584 | 5ca0ef479139844ffeac800904acfc5dff8c0a5e | 67766be8237fbe57865d28eba4311f88 | |
| .data | 0x22000 | 0x1ebbc6c | 91648 | 7aa322cc1d76ac9d8cf991d1dc02b3c49f58d4e2 | e8fb9f943cef0d212d3bc69f150e012a | |
| .rsrc | 0x1ede000 | 0x13b58 | 80896 | 6fc4e557f29a520285b5a914960542ebd4f22f84 | afcee0cfb47848e0e3d8698d4d6b3f95 |
PE Resources 6
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1ef0468 | 2216 | |
| RT_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x1eeff98 | 1128 | |
| RT_STRING | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x1ef1958 | 512 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1ef0d10 | 20 | |
| RT_GROUP_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x1ef0400 | 104 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1ef0d28 | 632 |
Meta infos 8
| InternalName: | Superior.exe |
| FileVersions: | 42.51.49 |
| LegalCopyrights: | Challangers bojala |
| CompanyName: | Thunderstuck |
| ProductVersion: | 27.5.34.0 |
| FileDescriptions: | Anybodies |
| Translation: | 0x124e 0x043a |
| ProductName: | Bonni |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| USER32.dll |
| GDI32.dll |