1654365431.exe

First submission 2024-10-11 17:15:05

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 5522.0 KB (5654528 bytes)
Compile time: 2024-10-07 18:42:57
MD5: 31d649663149dabd99c51b71e60a4a91
SHA1: f5f515e1818388c9360bde15a7dfcb265e86a812
SHA256: 2acb9052db5b304a822f8cd1169e31327e967e06ff78064997ea8a5003e783ec
Import Hash : bf7e94a88b651f53cc57bdb23fcd2c2f
Sections 11 .text .data .bss .idata .didata .edata .tls .rdata .reloc .pdata .rsrc
Directories 5 import export resource tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://146.70.24.213/do/1654365431.exe VirusTotal Report 146.70.24.213 VirusTotal Report 2024-10-11 17:15:05

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x43c5c0 4441600 c1e9989fa6871c129dca986527e20f49711e3136 4dc050f2b4f53a64168d2d2b3bb04cf6
.data 0x43e000 0x5ee38 389120 b6c47aaccd3441efb0814211e5ea778a5cac4186 c96c0455df11a9306f23138f836838b1
.bss 0x49d000 0xaab4 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0x4a8000 0x48de 18944 a63978c1dbd5852d7f8440a7c8a0923b2cbc394e 586f243f7059a7c5e3cc1599e712e400
.didata 0x4ad000 0xe3c 4096 2cd176d1087c5f2d24ae869ceea1f7ea3a561c35 cffac5f732be0532b2a4d072e873b001
.edata 0x4ae000 0x97 512 39cbec0acee0ae91ebc3262af2381d38edc31130 32e00411291ba873b0de75e561276889
.tls 0x4af000 0x1e4 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x4b0000 0x6d 512 fbe9568208cd0dde56ac107f3756d9149ea428c7 cb0aedb4d69d2e7d3f915611730f186c
.reloc 0x4b1000 0x39178 233984 b1d682f2e0943750475bcce3b7bb74f04d111871 3895bdffdd7a3e7f1d857eb7488e8413
.pdata 0x4eb000 0x3e9c4 256512 ebb582e762a7a7b600ddd6800d3dd5aa0df691b1 6086c296052ff020a33a7ba75c81e109
.rsrc 0x52a000 0x4b400 308224 b41782880359d21b7f3e912c87072a4d840fc0e7 7cd7c843107b0c985a216d5520dc5729

PE Resources 7

Name Language Sublanguage Offset Size Data
RT_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x52b3e0 308
RT_ICON LANG_CZECH SUBLANG_ARABIC_MOROCCO 0x53081c 1128
RT_STRING LANG_NEUTRAL SUBLANG_NEUTRAL 0x538368 844
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0x574df4 337
RT_GROUP_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x574fc0 20
RT_GROUP_ICON LANG_CZECH SUBLANG_ARABIC_MOROCCO 0x574fd4 90
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x575030 872

Meta infos 10

LegalCopyright: Copyright (C) Laplink Software, Inc. 2007
InternalName: LLW
FileVersion: 17.500.01700.0
CompanyName: Laplink Software, Inc.
OriginalFilename: LAPLINK.EXE
ProductVersion: 14.01.0017.00
FileDescription: Laplink Gold Component
Translation: 0x0409 0x04b0
Comments: Laplink Gold Component
ProductName: Laplink Gold

Anti debug functions 7

FindWindowExW
FindWindowW
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
RaiseException
UnhandledExceptionFilter

Strings analysis - File found

Database
Data.DB
Query DB
Dbx.SQL
Library
USER32.dll
dbxint.dll
gds32.dll
KERNEL32.dll
ibtogo.dll
UxTheme.dll
ibtogo64.dll
MSWSOCK.DLL
IPHLPAPI.DLL
dbxadapter.dll
normaliz.dll
Fwpuclnt.dll
IdnDL.dll
COMCTL32.dll
wship6.dll
ole32.dll
IMM32.dll
ibclient64.dll
OLEAUT32.dll
WS2_32.dll
MSIMG32.dll
ADVAPI32.dll
GDI32.dll
dwmapi.dll
WTSAPI32.dll
WindowsCodecs.dll
SHELL32.dll
VERSION.dll

Strings analysis - Possible IPs found 1

127.0.0.1

Import functions

PE Exports 3 suspicious

Function Address
TMethodImplementationIntercept 0x4991b0
__dbk_fcall_wrapper 0x417300
dbkFCallWrapperAddr 0x8a1f58