ywx.exe
First submission 2024-10-17 23:22:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 428.5 KB (438784 bytes) |
| Compile time: | 2024-10-17 12:16:33 |
| MD5: | 4dba58c6e9f435c1cca607525760d0fd |
| SHA1: | ff8d2afd9d7f0a828592fee34ca55d1a3542f7ed |
| SHA256: | d2886d86ef67a3550a4aadcf623aa785fddcd3af754b3035229647f186005b1c |
| Import Hash : | d9a5f4c55bbbe3c1ce16a8560ae80827 |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://176.111.174.140/ywx.exe  |
176.111.174.140 |
2024-10-17 23:22:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x4ef9a | 323584 | 062e7870197d7f060977d97c9dd7e68e22c1ad16 | a06fe7f6af4a53d551acbf91573dae92 | |
| .rdata | 0x50000 | 0x1488c | 84480 | b7e7208745a777406b989a4af07aa594b4d1c03f | d8fbba7e0409f47e021bfc995a8d381f | |
| .data | 0x65000 | 0x6ddc | 11264 | 827ef07468441620723f7089d5a6921647d3c11f | 6639fca53606c7aabd108b05f99a0e1a | |
| .rsrc | 0x6c000 | 0x1e0 | 512 | a78032bea3fcb50d7ddd44fe466614e9b8cd3b54 | 98e41e68d325b18ccaa97806e147c168 | |
| .reloc | 0x6d000 | 0x45c4 | 17920 | af0e03f992354bbf797a1f870fd2d50282ec21c2 | 07b59061159861f672f5a82793451ada |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x6c060 | 381 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 8
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| Bkernel32.dll |
| mscoree.dll |
| SHELL32.dll |
| WININET.dll |
| ntdll.dll |
| WS2_32.dll |
| ADVAPI32.dll |
| USER32.dll |
| gdiplus.dll |
| ole32.dll |
| GDI32.dll |
| KERNEL32.dll |