index.php
First submission 2023-09-17 14:53:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 254.0 KB (260096 bytes) |
| Compile time: | 2022-12-21 06:01:59 |
| MD5: | 34d7fa01ef6b0957c927b23a165be578 |
| SHA1: | 94d4c1fc45b8b49b8f7b8bad492b6ae1fc9b7e00 |
| SHA256: | 3d590dced909090620ef7c09e5bac071e45ed9e814a6bc6e1038648929ee1474 |
| Import Hash : | 0247adcd329847ea0db225ff728b6ec9 |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
| Virus Total: |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://www.cotomac.com/tmp/index.php  |
www.cotomac.com |
2023-09-17 14:53:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x30b02 | 199680 | f652a338c82610fa8064b53499a549470709eb3f | a9c412a31619da8fca1c710f726b64d5 | |
| .data | 0x32000 | 0x2d05a8 | 16384 | 07f1ef89f5edb245211b77e558a220d6bb2e21b4 | 3fcdbe62553e0acbad69e5c6a3a4eb61 | |
| .rsrc | 0x303000 | 0xa610 | 43008 | d250c9df9de6832bbbec5d13d2b2c80e4102e508 | c7daa9bfa9bcb83ded13ded543e54f8f |
PE Resources 4
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x30c620 | 1128 | |
| RT_STRING | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x30d168 | 1188 | |
| RT_GROUP_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x30ca88 | 118 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x30cb00 | 520 |
Meta infos 6
| FileVersions: | 8.8.87.89 |
| InternalName: | Electricity.exe |
| ProductVersion: | 2.70.47.63 |
| Translation: | 0x124f 0x03fc |
| OriginalFilename: | Hungle.exe |
| ProductName: | HumbleOpinion |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| SHELL32.dll |
| WINHTTP.dll |
| USER32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 2
| 8.8.87.89 |
| 2.70.47.63 |