%E6%8A%96%E9%9F%B3%E5%BC%B9%E5%B9%95%E4%BF%9D%E5%A7%86.exe
First submission 2024-10-15 18:10:08
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1908.0 KB (1953792 bytes) |
| Compile time: | 2024-09-30 11:04:33 |
| MD5: | 467692ca4ffc05c33fa1381e92f1baf9 |
| SHA1: | b063f6c4d4053c790b6bad1b5af0495b2626fe3e |
| SHA256: | 674a56fcb8d895c908920e54e3cb29d82c02b2ae0d432b8d613ed4a423092700 |
| Import Hash : | 9e409225035cabe190a30e33f62c78ec |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 42/77 VT report date: 2024-10-01 07:11:44 |
| Malware Type 3 | trojan dropper pua |
| Threat Type 2 | graftor flystudio |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://www.huiip.top:81/%E6%8A%96%E9%9F%B3%E5%BC%B9%E5%B9%95%E4%BF%9D%E5%A7%86.exe  |
www.huiip.top |
2024-10-15 18:10:08 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xd8926 | 888832 | 8ecd90cc46a18a91794a0510cfbf6b39bde4bc72 | 4815de9ec2a613ff43b42eee50eb7aca | |
| .rdata | 0xda000 | 0xe2814 | 929792 | 9eb573c28337daf6b1ecc70c052302f17bb4a356 | c6e3138d57858df1b068727b92bc37bb | |
| .data | 0x1bd000 | 0x48808 | 106496 | cea666903c4265101a6614504e30c29b880c4626 | e709ad5b3e2a6813dbff41631f3f6a52 | |
| .rsrc | 0x206000 | 0x5958 | 24576 | fe7d8ea489fd8f53141bceeb55a7ffddd3821f59 | e7ffd9dfdf3a8e79fbac990bb710e2a0 |
PE Resources 11
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| TEXTINCLUDE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x206c20 | 337 | |
| RT_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x207110 | 180 | |
| RT_BITMAP | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x208818 | 324 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x20917c | 1640 | |
| RT_MENU | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x2097f0 | 644 | |
| RT_DIALOG | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x20aa38 | 396 | |
| RT_STRING | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x20b480 | 36 | |
| RT_GROUP_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x20b4cc | 34 | |
| RT_GROUP_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x20b534 | 20 | |
| RT_VERSION | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x20b548 | 576 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x20b788 | 461 |
Meta infos 7
| LegalCopyright: | \x4f5c\x8005\x7248\x6743\x6240\x6709 \x8bf7\x5c0a\x91cd\x5e76\x4f7f\x7528\x6b63\x7248 |
| ProductVersion: | 1.0.0.0 |
| FileDescription: | \x6613\x8bed\x8a00\x7a0b\x5e8f |
| Translation: | 0x0804 0x04b0 |
| ProductName: | \x6613\x8bed\x8a00\x7a0b\x5e8f |
| Comments: | \x672c\x7a0b\x5e8f\x4f7f\x7528\x6613\x8bed\x8a00\x7f16\x5199(http://www.eyuyan.com) |
| FileVersion: | 1.0.0.0 |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 4
| GetLastError |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 2
| VMware trick |
| VMCheck.dll |
Strings analysis - File found
| Text |
| http://www.huiip.top:83/%E5%BD%95%E5%88%B6%E9%9F%B3%E9%A2%91%2F%E5%88%97%E8%A1%A8.txt |
| http://www.huiip.top:83/%E8%83%8C%E6%99%AF%E9%9F%B3%E4%B9%90%2F%E5%88%97%E8%A1%A8.txt |
| Library |
| OLEAUT32.dll |
| ADVAPI32.dll |
| GDI32.dll |
| SHLWAPI.dll |
| MPR.dll |
| USER32.dll |
| SHELL32.dll |
| WS2_32.dll |
| COMCTL32.dll |
| MSVCRT.dll |
| BASS_SFX.dll |
| COMDLG32.dll |
| KERNEL32.dll |
| bass.dll |
| WINMM.dll |
| ole32.dll |
| bass_wadsp.dll |
Strings analysis - Possible IPs found 4
| 6.7.8.5 |
| 192.168.0.129 |
| 0.1.2.5 |
| 1.1.1.1 |
Strings analysis - Possible URLs found 8
| http:// |
| http://www.huiip.top:83/%E5%BD%95%E5%88%B6%E9%9F%B3%E9%A2%91%2F%E5%88%97%E8%A1%A8.txt |
| http://www.huiip.top:81/%E6%8A%96%E9%9F%B3%E5%BC%B9%E5%B9%95.exe |
| http://www.huiip.top:83/%E8%83%8C%E6%99%AF%E9%9F%B3%E4%B9%90%2F |
| http://www.eyuyan.com) |
| http://www.huiip.top:81/%E6%8A%96%E9%9F%B3%E5%BC%B9%E5%B9%95%E4%BF%9D%E5%A7%86.exe |
| http://www.huiip.top:83/%E8%83%8C%E6%99%AF%E9%9F%B3%E4%B9%90%2F%E5%88%97%E8%A1%A8.txt |
| http://www.huiip.top:83/%E5%BD%95%E5%88%B6%E9%9F%B3%E9%A2%91%2F |