c.exe
First submission 2022-08-03 14:43:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| File type: | 463.0 KB (474112 bytes) |
| Compile time: | 2022-02-09 19:22:02 |
| MD5: | 5594e0ca7eaa0ae566ff83214c547e78 |
| SHA1: | 50b33de91d3a16b6eab91380a941ef852f7e36f8 |
| SHA256: | f87d3d53935db06707f2303dee46335a41419ca6cb6e599cf03eed703a85f194 |
| Import Hash : | 029a987f21e33b48f24d21b6f9ff1129 |
| Sections 7 | .text .rdata .data .tls .gfids .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
| Virus Total: | 53/71 VT report date: 2022-08-02 16:27:44 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://jg.studio/c.exe  |
jg.studio |
2022-08-03 14:43:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x52aed | 338944 | de59e4ca964512050b041a15ae81756d711c8313 | 22ca55e1b948eef6d8eaa74c178eb61c | |
| .rdata | 0x54000 | 0x16fb4 | 94208 | 352f6a2ff2e34506e7d6759af55eaa9aeda3f7b1 | 58738501e97e6c76ea591261c4b943d8 | |
| .data | 0x6b000 | 0x3eec | 3584 | a069a2cddd54faf4620819c79e6b50ab370798cb | 90efd231c85fb53e2e544c3917cc650c | |
| .tls | 0x6f000 | 0x9 | 512 | aa0d33a0c854e073439067876e932688b65cb6a9 | 1f354d76203061bfdd5a53dae48d5435 | |
| .gfids | 0x70000 | 0x230 | 1024 | 543908de16087fdc46fd32bba746b043f69effd0 | 68b4acc15e6a4d63a54be2808ea37520 | |
| .rsrc | 0x71000 | 0x4c28 | 19968 | 2b6773c0ad739bb9bf0ed90c0dabc8c0e7b70bff | ded2c2a6e4bd59a0dc54284d4be239c9 | |
| .reloc | 0x76000 | 0x3884 | 14848 | 3bc93ba4ff3fd609d08cb71ba1f2459349330701 | 3eea2222f194b26e650b5b689079235b |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ITALIAN | SUBLANG_ITALIAN | 0x73024 | 9640 | |
| RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x755cc | 1562 | |
| RT_GROUP_ICON | LANG_ITALIAN | SUBLANG_ITALIAN | 0x75be8 | 62 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 9
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Database |
| \key3.db |
| Text |
| \sysinfo.txt |
| license_code.txt |
| Library |
| mscoree.dll |
| KERNEL32.dll |
| SHLWAPI.dll |
| WINMM.dll |
| ADVAPI32.dll |
| ntdll.dll |
| WS2_32.dll |
| USER32.dll |
| PSAPI.DLL |
| SHELL32.dll |
| Powrprof.dll |
| gdiplus.dll |
| urlmon.dll |
| GDI32.dll |