1654365431.exe
First submission 2024-10-11 17:15:05
File details
File type: | PE32+ executable (GUI) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 5522.0 KB (5654528 bytes) |
Compile time: | 2024-10-07 18:42:57 |
MD5: | 31d649663149dabd99c51b71e60a4a91 |
SHA1: | f5f515e1818388c9360bde15a7dfcb265e86a812 |
SHA256: | 2acb9052db5b304a822f8cd1169e31327e967e06ff78064997ea8a5003e783ec |
Import Hash : | bf7e94a88b651f53cc57bdb23fcd2c2f |
Sections 11 | .text .data .bss .idata .didata .edata .tls .rdata .reloc .pdata .rsrc |
Directories 5 | import export resource tls relocation |
File features detected
URLs, FQDN and IP indicators 1
PE Sections 2 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x43c5c0 | 4441600 | c1e9989fa6871c129dca986527e20f49711e3136 | 4dc050f2b4f53a64168d2d2b3bb04cf6 | |
.data | 0x43e000 | 0x5ee38 | 389120 | b6c47aaccd3441efb0814211e5ea778a5cac4186 | c96c0455df11a9306f23138f836838b1 | |
.bss | 0x49d000 | 0xaab4 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.idata | 0x4a8000 | 0x48de | 18944 | a63978c1dbd5852d7f8440a7c8a0923b2cbc394e | 586f243f7059a7c5e3cc1599e712e400 | |
.didata | 0x4ad000 | 0xe3c | 4096 | 2cd176d1087c5f2d24ae869ceea1f7ea3a561c35 | cffac5f732be0532b2a4d072e873b001 | |
.edata | 0x4ae000 | 0x97 | 512 | 39cbec0acee0ae91ebc3262af2381d38edc31130 | 32e00411291ba873b0de75e561276889 | |
.tls | 0x4af000 | 0x1e4 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.rdata | 0x4b0000 | 0x6d | 512 | fbe9568208cd0dde56ac107f3756d9149ea428c7 | cb0aedb4d69d2e7d3f915611730f186c | |
.reloc | 0x4b1000 | 0x39178 | 233984 | b1d682f2e0943750475bcce3b7bb74f04d111871 | 3895bdffdd7a3e7f1d857eb7488e8413 | |
.pdata | 0x4eb000 | 0x3e9c4 | 256512 | ebb582e762a7a7b600ddd6800d3dd5aa0df691b1 | 6086c296052ff020a33a7ba75c81e109 | |
.rsrc | 0x52a000 | 0x4b400 | 308224 | b41782880359d21b7f3e912c87072a4d840fc0e7 | 7cd7c843107b0c985a216d5520dc5729 |
PE Resources 7
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x52b3e0 | 308 | |
RT_ICON | LANG_CZECH | SUBLANG_ARABIC_MOROCCO | 0x53081c | 1128 | |
RT_STRING | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x538368 | 844 | |
RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x574df4 | 337 | |
RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x574fc0 | 20 | |
RT_GROUP_ICON | LANG_CZECH | SUBLANG_ARABIC_MOROCCO | 0x574fd4 | 90 | |
RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x575030 | 872 |
Meta infos 10
LegalCopyright: | Copyright (C) Laplink Software, Inc. 2007 |
InternalName: | LLW |
FileVersion: | 17.500.01700.0 |
CompanyName: | Laplink Software, Inc. |
OriginalFilename: | LAPLINK.EXE |
ProductVersion: | 14.01.0017.00 |
FileDescription: | Laplink Gold Component |
Translation: | 0x0409 0x04b0 |
Comments: | Laplink Gold Component |
ProductName: | Laplink Gold |
Anti debug functions 7
FindWindowExW |
FindWindowW |
GetLastError |
GetWindowThreadProcessId |
IsDebuggerPresent |
RaiseException |
UnhandledExceptionFilter |
Strings analysis - File found
Database |
Data.DB |
Query DB |
Dbx.SQL |
Library |
USER32.dll |
dbxint.dll |
gds32.dll |
KERNEL32.dll |
ibtogo.dll |
UxTheme.dll |
ibtogo64.dll |
MSWSOCK.DLL |
IPHLPAPI.DLL |
dbxadapter.dll |
normaliz.dll |
Fwpuclnt.dll |
IdnDL.dll |
COMCTL32.dll |
wship6.dll |
ole32.dll |
IMM32.dll |
ibclient64.dll |
OLEAUT32.dll |
WS2_32.dll |
MSIMG32.dll |
ADVAPI32.dll |
GDI32.dll |
dwmapi.dll |
WTSAPI32.dll |
WindowsCodecs.dll |
SHELL32.dll |
VERSION.dll |
Strings analysis - Possible IPs found 1
127.0.0.1 |
Import functions
PE Exports 3 suspicious
Function | Address |
---|---|
TMethodImplementationIntercept | 0x4991b0 |
__dbk_fcall_wrapper | 0x417300 |
dbkFCallWrapperAddr | 0x8a1f58 |