iodnwqioundoiqk1.ogg

First submission 2023-09-15 20:51:02

File details

File type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 4787.0 KB (4901888 bytes)
Compile time: 2061-11-06 00:51:38
MD5: 401733815427af8ff3e1d882a9a27fd1
SHA1: e6fdfc26ae8f55dbf24ddbab10422d4266fbd424
SHA256: bcae463c6266d8e280a1cd723fafce2b0da9c7d0c6f1a5456e552220ec730c2a
Import Hash : 6ac0494255f289fa08f5348c7771941f
Sections 7 .text .rdata .data .pdata .didat .rsrc .reloc
Directories 6 import export resource debug tls relocation
Virus Total: 4/70 VT report date: 2023-09-15 18:33:06

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1152048825020723336/1152049344418173019/iodnwqioundoiqk1.ogg VirusTotal Report cdn.discordapp.com VirusTotal Report 2023-09-15 20:51:02

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x35117f 3478016 d2a7910d9c294a1f37bc42ae6cd57e972c127800 a88c40894b0c35d4de4b8c911a02d3d7
.rdata 0x353000 0xe82a4 951296 2a6c993c51de46c32b5b28121e94e8b9e133e4a0 a70d97ed45ccec57ff950367da750542
.data 0x43c000 0x13c48 62976 817865e877e99ce2fd4bca991efb9c2547f99eb6 1fa54048a51ebb249a22e0b276b0a861
.pdata 0x450000 0x3b148 242176 8bd1b6796655eceed5470c3cc627fc6c6ea66fe5 db2fb96427bda5bda924834d9fa0c6e6
.didat 0x48c000 0x190 512 e3efe8253a5c52218b9382fcebee9a6a05507522 bdbbcc6572e03cd3a2913417335be192
.rsrc 0x48d000 0x16188 90624 d15203e2600594b0f2138fa06724489f2e5a1a8e 079b03e0319b902454502162d253aef1
.reloc 0x4a4000 0x12548 75264 7690b6814fe2d69f497950dd40dcf647a2dd24ea 96675ff74762f6ef5b5b7171e797ca7d

PE Resources 5

Name Language Sublanguage Offset Size Data
MUI LANG_ENGLISH SUBLANG_ENGLISH_US 0x4a3090 248
WEVT_TEMPLATE LANG_ENGLISH SUBLANG_ENGLISH_US 0x48e270 61026
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0x4a2230 32
RT_MESSAGETABLE LANG_ENGLISH SUBLANG_ENGLISH_US 0x48df68 772
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x48dbf0 884

Meta infos 9

LegalCopyright: \xa9 Microsoft Corporation. All rights reserved.
InternalName: jscript9.dll
FileVersion: 11.00.19041.1266 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductVersion: 11.00.19041.1266
FileDescription: Microsoft \xae JScript
Translation: 0x0409 0x04b0
OriginalFilename: jscript9.dll
ProductName: Internet Explorer

Anti debug functions 6

GetLastError
IsDebuggerPresent
OutputDebugStringW
RaiseException
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 1

VMCheck.dll

Strings analysis - File found

Library
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-winrt-l1-1-0.dll
KERNEL32.dll
jscript9.dll
ntdll.dll
api-ms-win-core-processthreads-l1-1-2.dll
api-ms-win-core-delayload-l1-1-1.dll
api-ms-win-core-winrt-error-l1-1-1.dll
F12\pdm.dll
api-ms-win-ro-typeresolution-l1-1-0.dll
pdm.dll
FaultRep.dll
api-ms-win-eventing-provider-l1-1-0.dll
api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll
yjsIntl.dll
windows.globalization.dll
api-ms-win-core-winrt-string-l1-1-0.dll
ADVAPI32.dll
KernelBase.dll
rpcrt4.dll
OLEAUT32.dll
MSVCRT.dll
ole32.dll
api-ms-win-downlevel-shlwapi-l1-1-0.dll
api-ms-win-downlevel-version-l1-1-0.dll
bcrypt.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
api-ms-win-downlevel-ole32-l1-1-0.dll

Import functions

PE Exports 97 suspicious

Function Address
DllCanUnloadNow 0x1801c7e90
DllGetClassObject 0x18005ffd0
DllRegisterServer 0x1801c7fb0
DllUnregisterServer 0x1801c8070
JsAddRef 0x1801e5b50
JsBoolToBoolean 0x1801e5b90
JsBooleanToBool 0x1801e5bd0
JsCallFunction 0x1801e5c10
JsCollectGarbage 0x1801e5c60
JsConstructObject 0x1801e5c80
JsConvertValueToBoolean 0x1801e5cd0
JsConvertValueToNumber 0x1801e5d10
JsConvertValueToObject 0x1801e5d50
JsConvertValueToString 0x1801e5d90
JsCreateArray 0x1801e5dd0
JsCreateContext 0x1801e5e10
JsCreateError 0x1801e5e50
JsCreateExternalObject 0x1801e5e90
JsCreateExternalType 0x1801e5ed0
JsCreateFunction 0x1801e5f10
JsCreateObject 0x1801e5f50
JsCreateRangeError 0x1801e5f70
JsCreateReferenceError 0x1801e5fb0
JsCreateRuntime 0x1801e5ff0
JsCreateSyntaxError 0x1801e6040
JsCreateTypeError 0x1801e6080
JsCreateTypedExternalObject 0x1801e60c0
JsCreateURIError 0x1801e6100
JsDefineProperty 0x1801e6140
JsDeleteIndexedProperty 0x1801e6190
JsDeleteProperty 0x1801e61d0
JsDisableRuntimeExecution 0x1801e6220
JsDisposeRuntime 0x1801e6280
JsDoubleToNumber 0x1801e62a0
JsEnableRuntimeExecution 0x1801e62e0
JsEnumerateHeap 0x1801e6300
JsEquals 0x1801e6380
JsGetAndClearException 0x1801e63c0
JsGetCurrentContext 0x1801e6490
JsGetDefaultTypeDescription 0x1801e64d0
JsGetExtensionAllowed 0x1801e64f0
JsGetExternalData 0x1801e6530
JsGetExternalType 0x1801e6570
JsGetFalseValue 0x1801e65b0
JsGetGlobalObject 0x1801e65d0
JsGetIndexedProperty 0x1801e65f0
JsGetNullValue 0x1801e6630
JsGetOwnPropertyDescriptor 0x1801e6650
JsGetOwnPropertyNames 0x1801e6690
JsGetProperty 0x1801e66d0
JsGetPropertyIdFromName 0x1801e6710
JsGetPropertyNameFromId 0x1801e6750
JsGetPrototype 0x1801e6790
JsGetRuntime 0x1801e67d0
JsGetRuntimeMemoryLimit 0x1801e6820
JsGetRuntimeMemoryUsage 0x1801e6860
JsGetStringLength 0x1801e68a0
JsGetTrueValue 0x1801e68e0
JsGetUndefinedValue 0x1801e6900
JsGetValueType 0x1801e6920
JsHasException 0x1801e6960
JsHasExternalData 0x1801e6a10
JsHasIndexedProperty 0x1801e6a50
JsHasProperty 0x1801e6a90
JsIdle 0x1801e6ad0
JsIntToNumber 0x1801e6af0
JsIsEnumeratingHeap 0x1801e6b30
JsIsRuntimeExecutionDisabled 0x1801e6b90
JsNumberToDouble 0x1801e6bd0
JsParseScript 0x1801e6c10
JsParseSerializedScript 0x1801e6c50
JsPointerToString 0x1801e6c90
JsPreventExtension 0x1801e6cd0
JsRelease 0x1801e6cf0
JsRunScript 0x1801e6d30
JsRunSerializedScript 0x1801e6d70
JsSerializeScript 0x1801e6db0
JsSetCurrentContext 0x1801e6ea0
JsSetException 0x1801e6ec0
JsSetExternalData 0x1801e6ee0
JsSetIndexedProperty 0x1801e6f20
JsSetProperty 0x1801e6f60
JsSetPrototype 0x1801e6fb0
JsSetRuntimeBeforeCollectCallback 0x1801e6ff0
JsSetRuntimeMemoryAllocationCallback 0x1801e7030
JsSetRuntimeMemoryLimit 0x1801e7070
JsStartDebugging 0x1801e70a0
JsStartProfiling 0x1801e70c0
JsStopProfiling 0x1801e7100
JsStrictEquals 0x1801e7120
JsStringToPointer 0x1801e7160
JsValueToVariant 0x1801e71a0
JsVarAddRef 0x180067f90
JsVarRelease 0x180067e30
JsVarToExtension 0x1800958c0
JsVarToScriptDirect 0x1802001f0
JsVariantToValue 0x1801e71e0