antispy.exe
First submission 2024-10-17 17:06:02
File details
| File type: | PE32+ executable (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 88.5 KB (90624 bytes) |
| Compile time: | 2015-06-15 18:07:53 |
| MD5: | 463c0ff29190fa0b4b16dbd64ae5a82c |
| SHA1: | b92d6c4a078304b775f5e81851b5e632c5fb0248 |
| SHA256: | 763cf9acd8564b1520ee3365aecabe1a7a013e5bbcf4e9164333cc27e2dfaa8a |
| Import Hash : | e2795133a833f0c3eaa0391d9efd5c1e |
| Sections 6 | .code .text .pdata .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://www.system-corporation.com/prg/1064/sys/antispy.exe  |
www.system-corporation.com |
2024-10-17 17:06:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .code | 0x1000 | 0x3274 | 13312 | 00763bbdf995046a68f3af09db69b59c9eda629b | d6a89afb689eb8a4273f30661414e3cd | |
| .text | 0x5000 | 0xa57e | 42496 | a87d32e45013b18381dd7c8b151aa03910e2557a | 6ecd8735bad06efe10d2ccdd9e3fb8d9 | |
| .pdata | 0x10000 | 0xa44 | 3072 | 5422b3f11eda395a9b2c65b53c58601156ac2632 | 13bce504fac2a88314adabd2aac2dfca | |
| .rdata | 0x11000 | 0x13cd | 5120 | ffc74862579ad1fb2a5c94348ad5025e531f5168 | e6159147b37bc3e968587cd50c2eceb2 | |
| .data | 0x13000 | 0x23c8 | 6656 | b39aa48cf7e88b1c67154389080a3e2e197b56a8 | ef133200616243da8a7e2a8fd945d17a | |
| .rsrc | 0x16000 | 0x4910 | 18944 | 35d2632ea9f8a31d2d0786921e60ea7039570fc7 | 29302ac45bcffc04443d707a09ff350a |
PE Resources 2
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1a6a0 | 6 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1a6a8 | 615 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 2
| GetWindowThreadProcessId |
| TerminateProcess |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| SHLWAPI.dll |
| WINMM.dll |
| ole32.dll |
| MSIMG32.dll |
| USER32.dll |
| SHELL32.dll |
| COMCTL32.dll |
| UxTheme.dll |
| GDI32.dll |
| MSVCRT.dll |
Strings analysis - Possible IPs found 1
| 127.0.0.1 |