reverse_ctl.exe
First submission 2024-10-17 20:37:06
File details
File type: | PE32+ executable (GUI) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 6986.67 KB (7154345 bytes) |
Compile time: | 2024-08-02 12:23:25 |
MD5: | 51dadf28bb2dfca8bcfdd80a15cfdfe1 |
SHA1: | 1ed622472c9323c0a5674ab66194bd45fe817def |
SHA256: | c1b5b2692f77317e4a4ed00a960dabaac5c8316a02861844d2970a7f9dc3a915 |
Import Hash : | 456e8615ad4320c9f54e50319a19df9c |
Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
Directories 4 | import resource debug relocation |
File features detected
URLs, FQDN and IP indicators 1
PE Sections 1 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x29210 | 168960 | 6766fdac7e7ff041a0543a344a339dc375a6e66e | aca64598002ecff9eefbc96554edf015 | |
.rdata | 0x2b000 | 0x12642 | 75776 | 9edcc89891aabe0689696bb46f213b2206ebd2ae | ac9d8aa3ef3043a788afea2b0073d2a7 | |
.data | 0x3e000 | 0x73d8 | 3584 | 3e4547154414efe7a9146e813cb6e4d201fee452 | d0a288978c66419b180b35f625b6dce7 | |
.pdata | 0x46000 | 0x2208 | 9216 | 4f52f9908d0deae6d9454b2262789030c67d4e05 | 74cf3ea22e0a1756984435d6f80f7da5 | |
.rsrc | 0x49000 | 0xf41c | 62976 | 1e8529b98ad0b12f7eb9a074ec22d6145b33efc5 | 67d67d1491ed1bb007b5d15c2f5a8a9c | |
.reloc | 0x59000 | 0x768 | 2048 | 4fc3afbbb3d4417f1fadc5f4e09e1f961ca4b266 | 71de9271648326ec88350e903470cf3e |
PE Resources 3
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x57a3c | 1128 | |
RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x57ea4 | 104 | |
RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x57f0c | 1293 |
Packers detected 2
Microsoft Visual C++ 8.0 (DLL) |
Microsoft Visual C++ 8.0 |
Anti debug functions 6
GetLastError |
IsDebuggerPresent |
IsProcessorFeaturePresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Executable |
*X.sO |
Compressed |
base_library.zip |
bbase_library.zip |
Library |
mscoree.dll |
ADVAPI32.dll |
bapi-ms-win-core-file-l1-1-0.dll |
bapi-ms-win-crt-math-l1-1-0.dll |
bapi-ms-win-core-file-l2-1-0.dll |
bapi-ms-win-crt-runtime-l1-1-0.dll |
bapi-ms-win-core-timezone-l1-1-0.dll |
7python311.dll |
bapi-ms-win-core-processenvironment-l1-1-0.dll |
COMCTL32.dll |
bapi-ms-win-core-processthreads-l1-1-0.dll |
bapi-ms-win-core-file-l1-2-0.dll |
bapi-ms-win-core-processthreads-l1-1-1.dll |
bapi-ms-win-core-interlocked-l1-1-0.dll |
blibcrypto-1_1.dll |
bapi-ms-win-core-profile-l1-1-0.dll |
bapi-ms-win-crt-utility-l1-1-0.dll |
bapi-ms-win-core-memory-l1-1-0.dll |
bapi-ms-win-core-namedpipe-l1-1-0.dll |
ucrtbase.dll |
bapi-ms-win-crt-convert-l1-1-0.dll |
bucrtbase.dll |
bapi-ms-win-crt-time-l1-1-0.dll |
bapi-ms-win-core-debug-l1-1-0.dll |
bapi-ms-win-core-datetime-l1-1-0.dll |
Bapi-ms-win-core-synch-l1-2-0.dll |
bapi-ms-win-core-rtlsupport-l1-1-0.dll |
bVCRUNTIME140.dll |
bapi-ms-win-core-synch-l1-1-0.dll |
bapi-ms-win-crt-process-l1-1-0.dll |
KERNEL32.dll |
bapi-ms-win-core-handle-l1-1-0.dll |
USER32.dll |
bapi-ms-win-core-util-l1-1-0.dll |
bapi-ms-win-core-console-l1-1-0.dll |
bapi-ms-win-crt-string-l1-1-0.dll |
bapi-ms-win-core-localization-l1-2-0.dll |
bapi-ms-win-crt-conio-l1-1-0.dll |
bpython311.dll |
bapi-ms-win-crt-locale-l1-1-0.dll |
bapi-ms-win-crt-heap-l1-1-0.dll |
bapi-ms-win-core-heap-l1-1-0.dll |
bapi-ms-win-core-libraryloader-l1-1-0.dll |
bapi-ms-win-crt-environment-l1-1-0.dll |
bapi-ms-win-core-sysinfo-l1-1-0.dll |
bapi-ms-win-crt-filesystem-l1-1-0.dll |
bapi-ms-win-core-string-l1-1-0.dll |
bapi-ms-win-core-errorhandling-l1-1-0.dll |
GDI32.dll |
bapi-ms-win-crt-stdio-l1-1-0.dll |
Strings analysis - Possible URLs found 1
http://schemas.microsoft.com/SMI/2016/WindowsSettings |
Import functions
Name | Latest seen | MD5 |
---|---|---|
rt.exe | 2024-07-20 23:13:09 | 16c657e788d1b5f6ba16f1880ae3ffa2 |
OneDrive.exe | 2024-07-24 11:27:03 | f468ae483026819d6977e2a5e34ea52a |
2020.exe | 2024-08-28 04:41:03 | 95606667ac40795394f910864b1f8cc4 |
Proxy.exe | 2024-07-26 08:04:05 | 979c9b19507478fe8f08d537ec70538b |
chrome.exe | 2024-08-26 00:31:09 | 780eb7021e18368fd30e77f156dbaeb1 |
nikzbi.exe | 2024-08-27 09:01:02 | f2b9c2a610af9cfb62abcdd5b850b320 |
xx.exe | 2024-09-22 18:25:03 | cdb08964f95490ea413b0202f9d4576f |
wsd.exe | 2024-09-23 20:32:02 | f1a4608262276d12a77a5db012189fa6 |