cs-daili.exe
First submission 2024-10-15 19:39:04
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 296.0 KB (303104 bytes) |
| Compile time: | 2021-10-21 16:17:33 |
| MD5: | 4adcb0f7a3d272d2897488bc269a102b |
| SHA1: | 6eba2700f071030c82cfaa6165f2439f2865c02d |
| SHA256: | a59992138030f8f040b0048d8e7e1faf429bdfd2d0ef1ea26fecb90f40a862ed |
| Import Hash : | 5e726a232a120b1495be711a060576c9 |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
File features detected
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://dow.andylab.cn/cs-daili.exe  |
dow.andylab.cn |
2024-10-15 19:39:04 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x458a8 | 286720 | 6109ee49b34afadf4293bca34d42467db85b427c | 7ce9e34e618598df3523657828428d86 | |
| .data | 0x47000 | 0x20e0 | 4096 | 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d | 620f0b67a91f7f74151bc5be745b7110 | |
| .rsrc | 0x4a000 | 0x11a8 | 8192 | 625a27013fe0c840ff1e57f28b2f7884cd880e8f | f3997ad3af61bdd1967d122e9daa729a |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x4a300 | 3752 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x4a2ec | 20 | |
| RT_VERSION | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x4a0f0 | 508 |
Meta infos 6
| InternalName: | cs-daili |
| ProductVersion: | 2021.10.0017 |
| Translation: | 0x0804 0x04b0 |
| ProductName: | \x7f51\x7edc\x4ee3\x7406 |
| OriginalFilename: | cs-daili.exe |
| FileVersion: | 2021.10.0017 |
Packers detected 1
| Microsoft Visual Basic v5.0 - v6.0 |
Strings analysis - File found
| Temporary |
| \~ConvIconToBmp.tmp |
| Autogen |
| C:\Program Files (x86)\VB6Mini\bin\VB6.OLB |
| Data |
| taskkill /f /im NewTcp.Dat |
| Library |
| MSVBVM60.DLL |
| USER32.dll |
| GDI32.dll |
| WININET.dll |
| OLEAUT32.dll |
| UxTheme.dll |
| VBA6.DLL |
| VB5!6&vb6chs.dll |
| SHELL32.dll |