reverse_ctl.exe

First submission 2024-10-17 20:37:06

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 6986.67 KB (7154345 bytes)
Compile time: 2024-08-02 12:23:25
MD5: 51dadf28bb2dfca8bcfdd80a15cfdfe1
SHA1: 1ed622472c9323c0a5674ab66194bd45fe817def
SHA256: c1b5b2692f77317e4a4ed00a960dabaac5c8316a02861844d2970a7f9dc3a915
Import Hash : 456e8615ad4320c9f54e50319a19df9c
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://47.236.122.191/reverse_ctl.exe VirusTotal Report 47.236.122.191 VirusTotal Report 2024-10-17 20:37:06

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x29210 168960 6766fdac7e7ff041a0543a344a339dc375a6e66e aca64598002ecff9eefbc96554edf015
.rdata 0x2b000 0x12642 75776 9edcc89891aabe0689696bb46f213b2206ebd2ae ac9d8aa3ef3043a788afea2b0073d2a7
.data 0x3e000 0x73d8 3584 3e4547154414efe7a9146e813cb6e4d201fee452 d0a288978c66419b180b35f625b6dce7
.pdata 0x46000 0x2208 9216 4f52f9908d0deae6d9454b2262789030c67d4e05 74cf3ea22e0a1756984435d6f80f7da5
.rsrc 0x49000 0xf41c 62976 1e8529b98ad0b12f7eb9a074ec22d6145b33efc5 67d67d1491ed1bb007b5d15c2f5a8a9c
.reloc 0x59000 0x768 2048 4fc3afbbb3d4417f1fadc5f4e09e1f961ca4b266 71de9271648326ec88350e903470cf3e

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x57a3c 1128
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x57ea4 104
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x57f0c 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Executable
*X.sO
Compressed
base_library.zip
bbase_library.zip
Library
mscoree.dll
ADVAPI32.dll
bapi-ms-win-core-file-l1-1-0.dll
bapi-ms-win-crt-math-l1-1-0.dll
bapi-ms-win-core-file-l2-1-0.dll
bapi-ms-win-crt-runtime-l1-1-0.dll
bapi-ms-win-core-timezone-l1-1-0.dll
7python311.dll
bapi-ms-win-core-processenvironment-l1-1-0.dll
COMCTL32.dll
bapi-ms-win-core-processthreads-l1-1-0.dll
bapi-ms-win-core-file-l1-2-0.dll
bapi-ms-win-core-processthreads-l1-1-1.dll
bapi-ms-win-core-interlocked-l1-1-0.dll
blibcrypto-1_1.dll
bapi-ms-win-core-profile-l1-1-0.dll
bapi-ms-win-crt-utility-l1-1-0.dll
bapi-ms-win-core-memory-l1-1-0.dll
bapi-ms-win-core-namedpipe-l1-1-0.dll
ucrtbase.dll
bapi-ms-win-crt-convert-l1-1-0.dll
bucrtbase.dll
bapi-ms-win-crt-time-l1-1-0.dll
bapi-ms-win-core-debug-l1-1-0.dll
bapi-ms-win-core-datetime-l1-1-0.dll
Bapi-ms-win-core-synch-l1-2-0.dll
bapi-ms-win-core-rtlsupport-l1-1-0.dll
bVCRUNTIME140.dll
bapi-ms-win-core-synch-l1-1-0.dll
bapi-ms-win-crt-process-l1-1-0.dll
KERNEL32.dll
bapi-ms-win-core-handle-l1-1-0.dll
USER32.dll
bapi-ms-win-core-util-l1-1-0.dll
bapi-ms-win-core-console-l1-1-0.dll
bapi-ms-win-crt-string-l1-1-0.dll
bapi-ms-win-core-localization-l1-2-0.dll
bapi-ms-win-crt-conio-l1-1-0.dll
bpython311.dll
bapi-ms-win-crt-locale-l1-1-0.dll
bapi-ms-win-crt-heap-l1-1-0.dll
bapi-ms-win-core-heap-l1-1-0.dll
bapi-ms-win-core-libraryloader-l1-1-0.dll
bapi-ms-win-crt-environment-l1-1-0.dll
bapi-ms-win-core-sysinfo-l1-1-0.dll
bapi-ms-win-crt-filesystem-l1-1-0.dll
bapi-ms-win-core-string-l1-1-0.dll
bapi-ms-win-core-errorhandling-l1-1-0.dll
GDI32.dll
bapi-ms-win-crt-stdio-l1-1-0.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
rt.exe 2024-07-20 23:13:09 16c657e788d1b5f6ba16f1880ae3ffa2
OneDrive.exe 2024-07-24 11:27:03 f468ae483026819d6977e2a5e34ea52a
2020.exe 2024-08-28 04:41:03 95606667ac40795394f910864b1f8cc4
Proxy.exe 2024-07-26 08:04:05 979c9b19507478fe8f08d537ec70538b
chrome.exe 2024-08-26 00:31:09 780eb7021e18368fd30e77f156dbaeb1
nikzbi.exe 2024-08-27 09:01:02 f2b9c2a610af9cfb62abcdd5b850b320
xx.exe 2024-09-22 18:25:03 cdb08964f95490ea413b0202f9d4576f
wsd.exe 2024-09-23 20:32:02 f1a4608262276d12a77a5db012189fa6