update.exe

First submission 2024-10-14 23:54:04

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 148.0 KB (151552 bytes)
Compile time: 2024-04-01 05:58:43
MD5: 340efe524c957a5c254f567c30b14b7d
SHA1: 1f5e93a9e1d901c43d10c8f65ec2c98225fc8838
SHA256: 1d8ad7a7f0b07b83f26162edda497eedc59071b880f379d0d382e174ec83c6af
Import Hash : c39234ff2245e05d4a92d8a0891a5638
Sections 3 .text .data .rsrc
Directories 2 import resource

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 49/77 VT report date: 2024-10-14 23:09:37
Malware Type 2 trojan downloader
Threat Type 1 phonzy

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://101.126.11.168/xsh/update.exe VirusTotal Report 101.126.11.168 VirusTotal Report 2024-10-14 23:54:04

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x11b50 73728 596c593958f3f6869deb80e93d481a19a1102424 2b50b9a4a18c83ef66e7237b51d7ed95
.data 0x13000 0xa08 4096 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x14000 0x10b30 69632 e248b93e48bc1119e48b04c43e4f4405c7246d75 5b4eba18a05794012de7b0a9e637d53a

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x14308 67624
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x142f4 20
RT_VERSION LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x140f0 516

Meta infos 7

InternalName: update
FileVersion: 1.00
CompanyName: \x65b0\x751f\x6d3b\x6295\x8d44\x53d1\x5c55
OriginalFilename: update.exe
Translation: 0x0804 0x04b0
ProductVersion: 1.00
ProductName: \x66f4\x65b0\x7a0b\x5e8f

Packers detected 2

Microsoft Visual Basic v5.0 - v6.0
Microsoft Visual Basic v5.0

Strings analysis - File found

Autogen
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Text
\Update.txt
Library
urlmon.dll
WININET.dll
vb6chs.dll
MSVBVM60.DLL
VBA6.DLL

Strings analysis - Possible IPs found 1

101.126.11.168

Strings analysis - Possible URLs found 1

http://101.126.11.168/xsh/xsh.exe

Import functions