ax.exe
First submission 2024-10-16 20:08:10
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 2065.03 KB (2114587 bytes) |
| Compile time: | 2017-02-28 07:00:26 |
| MD5: | 431c75b491aa7535b92c5d9c00e23675 |
| SHA1: | 08f45830bc988aa234db210881c3e6a10c92cd5a |
| SHA256: | 66efd841fe3f48cba194688551284c8b7b775d8dd7401b813fd879bf7b366e7f |
| Import Hash : | bb9d495821e6e730a7a07045d899c977 |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 65/77 VT report date: 2024-09-18 02:58:14 |
| Malware Type 2 | trojan dropper |
| Threat Type 3 | farfli flystudio lyquj |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://212.64.10.223:90/ax.exe  |
212.64.10.223 |
2024-10-16 20:08:11 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x7bab6 | 507904 | c10380bd4594226626a79d8dfb8d4e1c5660c103 | bb85b1384ad637932508d3a97ac8d370 | |
| .rdata | 0x7d000 | 0x12c52 | 77824 | 5c5e0d0e2c41b404e6bb75a8e041ea1706d9962f | 9052c91fbd3b4aea65ce1c3b70c5c622 | |
| .data | 0x90000 | 0x279a8 | 73728 | 97f83166735496de21052485ceadbf177448163d | f0077e4df5de8e191daacf03272aef99 | |
| .rsrc | 0xb8000 | 0x2c4e8 | 184320 | 7c9924e8e659bbb3530574d4825f3c6628088e95 | 6b4da7c4a6917ec77b7be3c4b74346b6 |
PE Resources 10
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| TEXTINCLUDE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xb8db8 | 337 | |
| RT_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xb92a8 | 180 | |
| RT_BITMAP | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xba9b0 | 324 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xe2104 | 1128 | |
| RT_MENU | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xe2578 | 644 | |
| RT_DIALOG | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xe37c0 | 396 | |
| RT_STRING | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xe4208 | 36 | |
| RT_GROUP_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xe4254 | 34 | |
| RT_GROUP_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xe4304 | 20 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xe4318 | 461 |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 4
| GetLastError |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 2
| VMware trick |
| VMCheck.dll |
Strings analysis - File found
| Library |
| ntdll.dll |
| ADVAPI32.dll |
| mscoree.dll |
| USER32.dll |
| WININET.dll |
| KERNEL32.dll |
| SHELL32.dll |
| hid.dll |
| OLEAUT32.dll |
| SHLWAPI.dll |
| mscoreei.dll |
| DINPUT8.dll |
| GDI32.dll |
| MPR.dll |
| _USER32.dll |
| MSVCRT.dll |
| WS2_32.dll |
| COMCTL32.dll |
| <kernel32.dll |
| NETAPI32.dll |
| ole32.dll |
| clr.dll |
| mscorwks.dll |
| 7PSAPI.DLL |
| PSAPI.DLL |
| diasymreader.dll |
| WINMM.dll |
| mscorsvr.dll |
| IPHLPAPI.DLL |
| COMDLG32.dll |
| KernelBase.dll |
Strings analysis - Possible IPs found 1
| 127.0.0.1 |