HideProcess.rar
First submission 2024-10-14 23:39:03
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 563.5 KB (577024 bytes) |
| Compile time: | 2024-10-05 13:43:25 |
| MD5: | 41e61cb95f84406c83a0512557800a11 |
| SHA1: | e20e0bb7e073204bc0db0f5ec6dfe9e07468943e |
| SHA256: | 3b77275d167df06f11fc1faef1faf6b76dd4bb3cf161caec0c8fa520cbaf6bed |
| Import Hash : | daadb1d4525610d94c4189217e22d1f1 |
| Sections 11 | .textbss .text .rdata .data .pdata .idata .msvcjmc .tls .00cfg .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 16/76 VT report date: 2024-10-09 10:49:20 |
| Malware Type 1 | trojan |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://45.141.26.180/HideProcess.rar  |
45.141.26.180 |
2024-10-14 23:39:03 |
PE Sections 5 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .textbss | 0x1000 | 0x2fc97 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .text | 0x31000 | 0x69083 | 430592 | 555c8e1164cccce974673638e3bcb750e86defbb | 97c4291bbe2e92bab5055e79f65bf69c | |
| .rdata | 0x9b000 | 0x18cd9 | 101888 | 0da8ff1514960c1ebf024edb3e0b8d36b1b749b1 | 8222afcae4bda79dcb042a403eae82a1 | |
| .data | 0xb4000 | 0xda0 | 1536 | 7bd95586b2c49e5f744aebc4b9ba4c56229ef753 | 1b2f7ddd49e67ee73dd37ac447a07d4a | |
| .pdata | 0xb5000 | 0x648c | 26112 | e411297f77a8e399757d9944e0b280586ac22121 | 10578cec2589e4ce70a1118b1c0726c7 | |
| .idata | 0xbc000 | 0x212d | 8704 | 66c49d46cb5a4a2ee91cc871498334d78f6b2d20 | fee526402305cc28dac4feb0241a3fba | |
| .msvcjmc | 0xbf000 | 0x25a | 1024 | b567439cb63cbeca257d7bddb0dbbfcb81a713b7 | eba413e4c0e8762f942936ba82b28021 | |
| .tls | 0xc0000 | 0x309 | 1024 | 04a0b9fde89c71864acaf5e74689fe4c269bd7a8 | c573bd7cea296a9c5d230ca6b5aee1a6 | |
| .00cfg | 0xc1000 | 0x175 | 512 | 1301f3415541a48b1488dae10844f2f4b57c7445 | 92a905403092809229d47c705890e067 | |
| .rsrc | 0xc2000 | 0x446 | 1536 | 499fa38c64bddd4c7679d8d6588f66b30e933a78 | 1987a105d20fc03ff78e4bb46690896c | |
| .reloc | 0xc3000 | 0xb09 | 3072 | d901d8fbc510813b52f5a07bab920cbb2b3303ce | a7cbbea7c8b30dc4fcc8309986104753 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc2170 | 392 |
Packers detected 1
| Microsoft Visual C++ 8.0 |
Anti debug functions 9
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| Process32First |
| Process32Next |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Text |
| C:\Windows\debug\path.txt |
| Library |
| api-ms-win-core-registry-l1-1-0.dll |
| ADVAPI32.dll |
| bin\amd64\MSPDB140.DLL |
| VCRUNTIME140D.dll |
| urlmon.dll |
| ntdll.dll |
| ole32.dll |
| USER32.dll |
| SHELL32.dll |
| MSVCP140D.dll |
| KERNEL32.dll |
| ucrtbased.dll |
| VCRUNTIME140_1D.dll |
Strings analysis - Possible URLs found 2
| http://phat-atc.site/ProcessHider.rar |
| http://phat-atc.site/phAtAntiCheat/1111.rar |