WUDFHost.exe
First submission 2023-09-11 11:51:04
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 219.5 KB (224768 bytes) |
Compile time: | 2022-10-16 00:26:51 |
MD5: | 43d6aa62427fda7e63d503d069c22f63 |
SHA1: | 2cae45a0d2723b7cb3b9a9eb89f26bfe3776c034 |
SHA256: | 74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60 |
Import Hash : | f815858bb8146375fb6d659cf6f7de7c |
Sections 4 | .text .data .rsrc .reloc |
Directories 4 | import resource debug relocation |
Virus Total: | 38/70 VT report date: 2023-09-11 09:41:01 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
PE Sections 2 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x21368 | 136192 | 8690318bdc4826cbfa54f2e026821d40300be71d | f4db1966c458b2526cd82dc5bf3b9f91 | |
.data | 0x23000 | 0x201df04 | 10752 | 375f331ba2a1d21dfeaeedaa2273c072c572d348 | 313a60394749f1fc3c0513bbd85031c0 | |
.rsrc | 0x2041000 | 0xaca0 | 44544 | f7805f339b0700343ef943c63b6a23cc19be8f1a | 9407ed2a82d907f456faa11aa80d3d76 | |
.reloc | 0x204c000 | 0x7cbc | 32256 | 15b0fee564da7eaabbe9241c656cc7389f3a38ab | 5a42ae6039bdbd1a3f9c8281d9deed26 |
PE Resources 6
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x204a568 | 176 | |
RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2049f68 | 1128 | |
RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x204b7d0 | 1230 | |
RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x204a618 | 34 | |
RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2044568 | 48 | |
RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x204a640 | 620 |
Meta infos 7
LegalCopyright: | Copyright (C) 2022, Uniqum |
ProductionVersion: | 82.67.62.16 |
FileDescription: | Silvuple |
Translation: | 0x05bf 0x0ad4 |
ProductsVersion: | 9.50.11.69 |
OriginalFilename: | petshop.exe |
ProductName: | Junfsiol |
Packers detected 2
Microsoft Visual C++ 8 |
VC8 -> Microsoft Corporation |
Anti debug functions 5
GetLastError |
IsDebuggerPresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Library |
KERNEL32.dll |
mscoree.dll |
USER32.dll |
MSIMG32.dll |
GDI32.dll |
Strings analysis - Possible IPs found 2
82.67.62.16 |
9.50.11.69 |