DaTaTools.exe
First submission 2024-10-15 18:18:46
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 7364.0 KB (7540736 bytes) |
| Compile time: | 2024-10-06 18:32:53 |
| MD5: | 59c0515abb09b4870ed6421353689be4 |
| SHA1: | a040d035d7a010a2612c012ec79135dd27a33030 |
| SHA256: | 77772ecd252c62a743d8c62026bc91c19378f8205f976f614b57b5acbcd86c2a |
| Import Hash : | 594557f558ac7f3e0d1542ce53d7777f |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 37/76 VT report date: 2024-10-06 18:50:48 |
| Malware Type 1 | trojan |
| Threat Type 2 | jaik flystudio |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://42.193.42.92/DataTools/DaTaTools.exe  |
42.193.42.92 |
2024-10-15 18:18:46 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2380b6 | 2330624 | 53d9274b806345ecb7f73a09f6146f6a993462f7 | 405de9aae71eda3a2ebd73636ef18cbe | |
| .rdata | 0x23a000 | 0x4c6972 | 5009408 | ec23f869f49521ca2b7b51aafde6d99ac31b88e8 | 35386da913fff64d4361a649cca8a69e | |
| .data | 0x701000 | 0x9342a | 151552 | ffa748b563338540f97019a0fa09ac49c7de8045 | eefcf4e9b82b6842aac55e18f8936f01 | |
| .rsrc | 0x795000 | 0xa810 | 45056 | 34a1ede5055727a5a4c33d31a9a07b4aee9e29d5 | b04bef1aaa4f84bcc64b90bfd71f32ea |
PE Resources 12
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| TEXTINCLUDE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x7961a8 | 337 | |
| WAVE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x7962fc | 5192 | |
| RT_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x798064 | 308 | |
| RT_BITMAP | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79acc4 | 324 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x79b218 | 7336 | |
| RT_MENU | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79cecc | 644 | |
| RT_DIALOG | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79e804 | 396 | |
| RT_STRING | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79f2bc | 36 | |
| RT_GROUP_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79f36c | 34 | |
| RT_GROUP_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79f3b8 | 20 | |
| RT_VERSION | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x79f3cc | 628 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x79f640 | 461 |
Meta infos 8
| LegalCopyright: | \x73ca\x745a QQ1758282 |
| FileVersion: | 1.1.0.0 |
| CompanyName: | \x73ca\x745a |
| ProductVersion: | 1.1.0.0 |
| FileDescription: | \x627e\x5bfb\x90a3\x66fe\x7ecf\x5931\x53bb\x7684\x6d6a\x6f2b,\x68a6\x60f3\x7740\x8fd8\x80fd\x89c1\x5230\x4ece\x524d\x7684\x4f60 |
| Translation: | 0x0804 0x04b0 |
| Comments: | DaTaTools V3 |
| ProductName: | \x73ca\x745a\x5de5\x5177\x7bb1DaTaTools |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 6
| FindWindowExA |
| GetLastError |
| GetWindowThreadProcessId |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| Temporary |
| \2.jpg.tmp |
| 2.jpg.tmp |
| Text |
| \bin\Event.txt |
| \npc\XiChong.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys08.txt |
| \Bin\nr.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys06.txt |
| \bin\ScriptBase.txt |
| _.txt |
| msg.txt |
| ItemSet.txt |
| EnemyAI.txt |
| moni.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys03.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys05.txt |
| |*.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys07.txt |
| \debugger.txt |
| *.txt |
| \warp.txt |
| ShanHuDaTaTools.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys04.txt |
| TechArea.txt |
| \enemy.txt |
| D:\GMSV\data\npc\XY_shanhu_wybys02.txt |
| \wordmapinfoconfig.txt |
| http://42.193.42.92/Ver.txt |
| \bin\moni.txt |
| \skilllv.txt |
| Library |
| - Skin.dll |
| ntdll.dll |
| WShlwapi.dll |
| SkinH_EL.dll |
| MSVCRT.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| MSIMG32.dll |
| USER32.dll |
| ole32.dll |
| KERNEL32.dll |
| VERSION.dll |
| GDI32.dll |
| SHLWAPI.dll |
| MPR.dll |
| gdiplus.dll |
| COMCTL32.dll |
| RASAPI32.dll |
| WINMM.dll |
| IPHLPAPI.DLL |
| WS2_32.dll |
| WININET.dll |
| COMDLG32.dll |
| riched20.dll |
| OLEAUT32.dll |
| AVIFIL32.dll |
| MSVFW32.dll |
| riched32.dll |
| ODBC32.dll |
Strings analysis - Possible IPs found 2
| 42.193.42.92 |
| 192.168.0.129 |
Strings analysis - Possible URLs found 17
| http://www.iec.ch |
| http://42.193.42.92/Ver.txt |
| http:// |
| https://qm.qq.com/q/anqExqcZgs |
| http://www.baidu.com |
| http://ns.adobe.com/exif/1.0/ |
| https://www.aqianniao.com/login/regView?adcode=shanhu |
| http://purl.org/dc/elements/1.1/ |
| http://www.w3.org/1999/02/22-rdf-syntax-ns# |
| http://ns.adobe.com/xap/1.0/mm/ |
| http://ns.adobe.com/xap/1.0/sType/ResourceEvent# |
| http://ns.adobe.com/tiff/1.0/ |
| http://bbs.shanhucg.com |
| http://42.193.42.92/DataTools/DaTaTools.exe |
| http://ns.adobe.com/xap/1.0/sType/ResourceRef# |
| http://ns.adobe.com/photoshop/1.0/ |
| http://ns.adobe.com/xap/1.0/ |