swift-nobypass.exe

First submission 2024-10-17 18:56:03

File details

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Mime type:	application/x-dosexec
File size:	100.0 KB (102400 bytes)
Compile time:	2024-09-17 20:17:06
MD5:	5156dd825ef6a5a11c47034f1ec48c9d
SHA1:	7e4e44f7788a33b41dc45d78c335bf989e6b882c
SHA256:	54f5603c31f360beaf872181bf60e0c65c86b2d1c256408991cf6e3d0f362d32
Sections 6	.text .data .rdata .edata .idata .reloc
Directories 3	import export relocation

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

OSINT Enrichments

Virus Total:	37/77 VT report date: 2024-10-11 15:04:30
Malware Type 1	trojan
Threat Type 3	havoc havokiz marte

URLs, FQDN and IP indicators 1

URL	Host (FQDN/IP)	Date Added
hXXp://169.1.16.29/swift-nobypass.exe	169.1.16.29	2024-10-17 18:56:03

PE Sections 1 suspicious

Name	VAddress	VSize	Size	SHA1	MD5	Suspicious
.text	0x1000	0x17680	96256	afc3aa75e813d0e5c80139add99e39ef88036817	ce967e38392020a6072f57795a2ec815
.data	0x19000	0x960	2560	60ec33af4f6b19c8f0a61444fd504ce534690469	c68d09c9e4d2d0574aa516573a476c6b
.rdata	0x1a000	0x2e0	1024	6875c4a2c7a370f1124d023ff0446fe6757b03ce	f2d3e05b699537879063e0a2e221085a
.edata	0x1b000	0x36	512	1cd64ebef13c6149f7bcbc50de294ba0e44ae0b0	6fc6ab1b4955bea1c60a443266edc674
.idata	0x1c000	0x14	512	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5	bf619eac0cdf3f68d496ea9344137e8b
.reloc	0x1d000	0xec	512	a7c573119b1d44a2f7ae3879a848bb43db84cdb3	285bb24486a4bb73835695c37bba67b2

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)