setup3.exe
First submission 2024-10-13 13:05:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 288.0 KB (294912 bytes) |
| Compile time: | 2023-12-18 05:14:24 |
| MD5: | 5b1dd11863c1347d4c2a4c21d1a47a45 |
| SHA1: | 8e5b69e075739ee17dd6fc9298e34144454a4347 |
| SHA256: | 1048b6aba5a804ab3ed6aa22950cb76b446ea306eeff4ae2012d197a2178dd8e |
| Import Hash : | 67def8961050d10da5ff74312b7f0aec |
| Sections 6 | .text .rdata .data .zek .lelidi .rsrc |
| Directories 2 | import resource |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 25/77 VT report date: 2024-10-13 12:43:40 |
| Malware Type 3 | trojan pua virus |
| Threat Type 1 | convagent |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://erhonics.cc/er1hrthnr/setup3.exe  |
erhonics.cc |
2024-10-13 13:05:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x14eff | 86016 | 39e0a0d98abeeb6a6b81262bf4694a8718b90ad9 | b22432fbd0642c5e86d74cf8c4280def | |
| .rdata | 0x16000 | 0x2076 | 8704 | 65e59d788a9612e2587457747de5e1d9b91f77e4 | 46cf41c7a1839cbcb485b4a6636a5d18 | |
| .data | 0x19000 | 0x26fff7c | 5120 | e1dbeb17b6b9ac885445821c5cedb8e636849f30 | 0182d82aaeeeca1c0fbdff93c0062d2a | |
| .zek | 0x2719000 | 0x4400 | 14336 | ef58a812a81ab14549d8f4fb86e9ecb54a5fb723 | b211778b80f6d441b6cf61ada776fc6d | |
| .lelidi | 0x271e000 | 0x2800 | 10240 | 34e163be8e43c5631d8b92e9c43ab0bf0fa62b9c | 1276481102f218c981e0324180bafd9f | |
| .rsrc | 0x2721000 | 0x29538 | 169472 | 51542c14ee79e580d80c1b36906f44aba1a6d317 | 6a52e3aa1b3fbb6451949275ba9ae810 |
PE Resources 7
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x273f0a8 | 2 | |
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x27428e8 | 9640 | |
| RT_ICON | LANG_TURKISH | SUBLANG_DEFAULT | 0x273ebc8 | 1128 | |
| RT_STRING | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x274a510 | 38 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x2744e90 | 34 | |
| RT_GROUP_ICON | LANG_TURKISH | SUBLANG_DEFAULT | 0x2738808 | 104 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x2744eb8 | 436 |
Meta infos 5
| ProductVersion: | 45.98.0.21 |
| Translation: | 0x0409 0x0548 |
| FileVersions: | 40.52.51.70 |
| LegalCopyrights: | Stone |
| CompanyName: | Juicet |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 4
| GetLastError |
| IsDebuggerPresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| USER32.dll |
| MSIMG32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 2
| 45.98.0.21 |
| 40.52.51.70 |