WUDFHost.exe

First submission 2023-09-11 11:51:04

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 219.5 KB (224768 bytes)
Compile time: 2022-10-16 00:26:51
MD5: 43d6aa62427fda7e63d503d069c22f63
SHA1: 2cae45a0d2723b7cb3b9a9eb89f26bfe3776c034
SHA256: 74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60
Import Hash : f815858bb8146375fb6d659cf6f7de7c
Sections 4 .text .data .rsrc .reloc
Directories 4 import resource debug relocation
Virus Total: 38/70 VT report date: 2023-09-11 09:41:01

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://103.250.79.174/220/WUDFHost.exe VirusTotal Report 103.250.79.174 VirusTotal Report 2023-09-11 11:51:04

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x21368 136192 8690318bdc4826cbfa54f2e026821d40300be71d f4db1966c458b2526cd82dc5bf3b9f91
.data 0x23000 0x201df04 10752 375f331ba2a1d21dfeaeedaa2273c072c572d348 313a60394749f1fc3c0513bbd85031c0
.rsrc 0x2041000 0xaca0 44544 f7805f339b0700343ef943c63b6a23cc19be8f1a 9407ed2a82d907f456faa11aa80d3d76
.reloc 0x204c000 0x7cbc 32256 15b0fee564da7eaabbe9241c656cc7389f3a38ab 5a42ae6039bdbd1a3f9c8281d9deed26

PE Resources 6

Name Language Sublanguage Offset Size Data
RT_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x204a568 176
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x2049f68 1128
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0x204b7d0 1230
RT_GROUP_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x204a618 34
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x2044568 48
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x204a640 620

Meta infos 7

LegalCopyright: Copyright (C) 2022, Uniqum
ProductionVersion: 82.67.62.16
FileDescription: Silvuple
Translation: 0x05bf 0x0ad4
ProductsVersion: 9.50.11.69
OriginalFilename: petshop.exe
ProductName: Junfsiol

Packers detected 2

Microsoft Visual C++ 8
VC8 -> Microsoft Corporation

Anti debug functions 5

GetLastError
IsDebuggerPresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Library
KERNEL32.dll
mscoree.dll
USER32.dll
MSIMG32.dll
GDI32.dll

Strings analysis - Possible IPs found 2

82.67.62.16
9.50.11.69

Import functions