cryptedBB.exe
First submission 2023-09-13 15:12:02
File details
| File type: | PE32 executable (console) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 461.0 KB (472064 bytes) |
| Compile time: | 2023-09-13 11:58:50 |
| MD5: | 3dd01710d9d6f58e5588ad656f0441a1 |
| SHA1: | 6dfce0ad42f9d4049d3ee01d3f626428fdfab928 |
| SHA256: | 1c15a59b56b5298f4b02671994f7d19a28dca5e4dbe176204385ee95ddae174b |
| Import Hash : | 29c8b785823d6c11cf3aae5ebbb5f0e6 |
| Sections 6 | .text .rdata .data .bsp .rsrc .reloc |
| Directories 6 | import export resource debug tls relocation |
| Virus Total: | 35/71 VT report date: 2023-09-13 12:56:24 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://77.91.68.78/lend/cryptedBB.exe  |
77.91.68.78 |
2023-09-13 15:12:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2967c | 169984 | 150fd79635f2fcb1aef2b658f730c036b3e795f1 | 9110c9ee2bbca100a2f7fdc3f3f38399 | |
| .rdata | 0x2b000 | 0xefa4 | 61440 | e3ad3518daa59803d414185cd028acfd30ec310c | 947122df64e19e7640a474183aec84dd | |
| .data | 0x3a000 | 0x2b10 | 7168 | fefb6b70c80057e7f8b64544dd1869073489b200 | ed3356dfdf856ccbae026cf6e70449f8 | |
| .bsp | 0x3d000 | 0x36490 | 222720 | 8c1bf1a323995d3e46dabecd9cb3dc303d0698d9 | 84f554e552f068d959435e1f02e87aac | |
| .rsrc | 0x74000 | 0x1e0 | 512 | 7d530214e42990380ee62dd8472b14986e869190 | feaa43704ad9535a5a7d034df50280d5 | |
| .reloc | 0x75000 | 0x22f0 | 9216 | b57e57b00951340d352041d0cc869352c0912658 | 01495ca0fc6e847b45e9d282bfa20579 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x74060 | 381 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| mscoree.dll |
| KERNEL32.dll |
| USER32.dll |
| ole32.dll |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| _jbxjgbguyw3@4 | 0x405420 |
| Name | Latest seen | MD5 |
|---|---|---|
| fotod445.exe | 2023-09-12 20:11:03 | 4f125016bafd01db0f30a335c199497c |
| vur.exe | 2023-09-12 21:51:02 | 73a427553c9c3d8b5f5377630c5d9c61 |
| foto5445.exe | 2023-09-13 10:55:03 | 3ee86d1734ad1891b99c7fdeb5382960 |