foto5445.exe
First submission 2023-09-13 10:55:03
File details
| File type: | PE32 executable (console) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1014.5 KB (1038848 bytes) |
| Compile time: | 2023-09-13 10:54:39 |
| MD5: | 3ee86d1734ad1891b99c7fdeb5382960 |
| SHA1: | 5c1885eec4b79d73c45c48d0358cc5938cede4b3 |
| SHA256: | 72fc33e337d34f54fc45bfa285846aa269cf1be05acb6e56a9b380d7817b20c8 |
| Import Hash : | 29c8b785823d6c11cf3aae5ebbb5f0e6 |
| Sections 6 | .text .rdata .data .bsp .rsrc .reloc |
| Directories 6 | import export resource debug tls relocation |
| Virus Total: |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://77.91.124.231/new/foto5445.exe  |
77.91.124.231 |
2023-09-13 10:55:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2967c | 169984 | 70bdd60e877377bf34f67183764c88c4e8db201a | 6862aa8edef409e1bcc54c52d2679669 | |
| .rdata | 0x2b000 | 0xefa4 | 61440 | be07a10b0c116ee2c2829df7f402efca44b1a977 | 7d2e936512896b3d50bc8f28502c1172 | |
| .data | 0x3a000 | 0x2b10 | 7168 | fefb6b70c80057e7f8b64544dd1869073489b200 | ed3356dfdf856ccbae026cf6e70449f8 | |
| .bsp | 0x3d000 | 0xc0a90 | 789504 | 7e3eeca8ee31943a6fe5c629f60d04ac790fc2eb | 07eecc6933eb6cbc2aaab2faf5d9e737 | |
| .rsrc | 0xfe000 | 0x1e0 | 512 | 60619c2dde1cbb012c2bdc1b307141af77c7c005 | 59dc56be5fc815710ac16425abbe8583 | |
| .reloc | 0xff000 | 0x22f0 | 9216 | da2c82382ea48281c99469408c7451386ce94b6b | 7b2f50f4561f7994a8a87fcd061a3525 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xfe060 | 381 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| mscoree.dll |
| KERNEL32.dll |
| ole32.dll |
| USER32.dll |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| _jbxjgbguyw3@4 | 0x405420 |
| Name | Latest seen | MD5 |
|---|---|---|
| fotod445.exe | 2023-09-12 20:11:03 | 4f125016bafd01db0f30a335c199497c |
| vur.exe | 2023-09-12 21:51:02 | 73a427553c9c3d8b5f5377630c5d9c61 |
| cryptedBB.exe | 2023-09-13 15:12:02 | 3dd01710d9d6f58e5588ad656f0441a1 |