win64help.dll?ex=670c3661&is=670ae4e1&hm=34e9d9802f25be6669092bd636fdec89da344d630c1feed0501755a57d63d928&
First submission 2024-10-13 18:33:02
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 333.17 KB (341168 bytes) |
| Compile time: | 2024-10-12 02:55:47 |
| MD5: | 3fe8eb38f23d00e1045c26084724785e |
| SHA1: | 94e0d3db024a69c57914f10a00303ec2b4a40b2e |
| SHA256: | 313565edbc274cf11332be23cb1c6af341281a969acd9c5f4b4e951c059739c0 |
| Import Hash : | 3254359579f23afe607e1d61dde58b23 |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 6 | import resource debug tls relocation security |
File features detected
Anti VM
XOR
OSINT Enrichments
| Virus Total: | 8/77 VT report date: 2024-10-13 17:12:56 |
| Malware Type 1 | trojan |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1294417693801189386/1294768227334885457/win64help.dll?ex=670c3661&is=670ae4e1&hm=34e9d9802f25be6669092bd636fdec89da344d630c1feed0501755a57d63d928&  |
cdn.discordapp.com |
2024-10-13 18:33:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x3effb | 258048 | a284209a45ee0fb3441f4f1070f82e595d361493 | e5b30f03c385e9496cb7f415587d6841 | |
| .rdata | 0x40000 | 0xeb5c | 60416 | 608a6a9656bac2fd93134fe48054b04b12cc1153 | 4a8b8352afec621a3ee78deba453fb28 | |
| .data | 0x4f000 | 0x1e08 | 2560 | 0d09b4693f6537dc79e04e38c4d9f72ac252f7f4 | b4438c0d30de02275d9a4bf4b89e8a6b | |
| .pdata | 0x51000 | 0x2c4c | 11776 | 81aff6a2723b49c8d7268c12b50a04ef062b840a | 8c3c2c61aafe2885eb3951d312a8f393 | |
| .rsrc | 0x54000 | 0xf8 | 512 | 6bbc15a0367b83368d6ac205d6d53848301792ab | 7c139771cc4b97d7f468254be5d2679a | |
| .reloc | 0x55000 | 0x148 | 512 | e2c72d2de20e89a94352c9ea9825ab193068aad8 | 4dc9b1e2cecb0a6d7bf3095fe687757c |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x54060 | 145 |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| 7e04e15785463d741366b602ef6d9f12 | ce40ca758995b5be09c61ee19bad97b2a0271cab | 6320 | 334848 |
Strings analysis - File found
| Log |
| \FortniteGame\Saved\Logs\FortniteGame.log |
| Text |
| imgui_log.txt |
| Library |
| api-ms-win-core-registry-l1-1-0.dll |
| DiscordHook64.dll |
| ADVAPI32.dll |
| bin\amd64\MSPDB140.DLL |
| api-ms-win-crt-utility-l1-1-0.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| msvcp140.dll |
| api-ms-win-crt-stdio-l1-1-0.dll |
| WS2_32.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| api-ms-win-crt-convert-l1-1-0.dll |
| vcruntime140.dll |
| api-ms-win-crt-filesystem-l1-1-0.dll |
| VCRUNTIME140_1.dll |
| d3dcompiler_47.dll |
| IMM32.dll |
| xinput1_4.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| api-ms-win-crt-math-l1-1-0.dll |
| api-ms-win-crt-environment-l1-1-0.dll |
| USER32.dll |
| KERNEL32.dll |
Strings analysis - Possible URLs found 12
| https://www.verisign.com/cps0 |
| http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0 |
| https://d.symcb.com/cps0% |
| http://sf.symcb.com/sf.crt0 |
| http://ocsp.verisign.com0 |
| https://www.verisign.com/rpa |
| http://sf.symcb.com/sf.crl0f |
| http://crl.verisign.com/pca3-g5.crl04 |
| https://www.verisign.com/rpa0 |
| http://logo.verisign.com/vslogo.gif04 |
| http://sf.symcd.com0& |
| https://d.symcb.com/rpa0 |
Import functions
api-ms-win-crt-environment-l1-1-0.dll 1
api-ms-win-crt-filesystem-l1-1-0.dll 2
VCRUNTIME140.dll 17
XINPUT1_4.dll 2
MSVCP140.dll 43
api-ms-win-crt-convert-l1-1-0.dll 3
api-ms-win-crt-string-l1-1-0.dll 6
VCRUNTIME140_1.dll 1
api-ms-win-crt-runtime-l1-1-0.dll 15
KERNEL32.dll 56
api-ms-win-crt-math-l1-1-0.dll 6
api-ms-win-crt-utility-l1-1-0.dll 1
D3DCOMPILER_47.dll 1
api-ms-win-crt-stdio-l1-1-0.dll 16
WS2_32.dll 2
api-ms-win-crt-heap-l1-1-0.dll 4
USER32.dll 22
IMM32.dll 3
| Name | Latest seen | MD5 |
|---|---|---|
| CompPkgSup.dll?ex=670ef1f2&is=670da072&hm=0ef149bf8000f5d08bd27446ab0651cfc3038bd4f627014443f6e0056b60f8df | 2024-10-15 19:54:02 | f0fa6871cb996242a649dd629a0591f1 |