down.exe
First submission 2024-10-15 18:00:05
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 756.0 KB (774144 bytes) |
| Compile time: | 2024-10-12 03:43:08 |
| MD5: | 623e0133db39d7c2efda2796158a1b12 |
| SHA1: | b847e7a29bea393bae9002ba980c9fb39882af37 |
| SHA256: | 77a53280fd609c5594c6f78453ca8468dc4d0305c87293655b85a50f88681792 |
| Import Hash : | 915938313dcfffe3f6c57db35c7a9d34 |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 45/77 VT report date: 2024-10-15 08:52:02 |
| Malware Type 3 | trojan dropper pua |
| Threat Type 1 | flystudio |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://49.234.48.162/pdd_biaoge/soft/down.exe  |
49.234.48.162 |
2024-10-15 18:00:05 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x84e9e | 544768 | 32779c64eeaf60323e461700f97c5f1b924911ec | 487c6d94923072dc33f1f7bcf6d902c0 | |
| .rdata | 0x86000 | 0x1e4de | 126976 | 028988c94063b3a05648cf30e1e4e732c3754ead | 27971fa8e2e1c764e2e82fdd5fd4950b | |
| .data | 0xa5000 | 0x4c68a | 73728 | 8e8e2ba8cc495c80a65369f94326bd20d7052a73 | 25d036d7750c5064fe880c018e8f6022 | |
| .rsrc | 0xf2000 | 0x5904 | 24576 | b1646e2001eb173c44f1108862c4212c9dd6ef9f | 5962008a34709fd158119beeaed540fd |
PE Resources 10
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| TEXTINCLUDE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf2c30 | 337 | |
| RT_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf3120 | 180 | |
| RT_BITMAP | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf4994 | 324 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xf52f8 | 1640 | |
| RT_MENU | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf596c | 644 | |
| RT_DIALOG | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf6bb4 | 396 | |
| RT_STRING | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf75fc | 36 | |
| RT_GROUP_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf7648 | 34 | |
| RT_GROUP_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf76b0 | 20 | |
| RT_VERSION | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0xf76c4 | 576 |
Meta infos 7
| LegalCopyright: | \x4f5c\x8005\x7248\x6743\x6240\x6709 \x8bf7\x5c0a\x91cd\x5e76\x4f7f\x7528\x6b63\x7248 |
| ProductVersion: | 1.0.0.0 |
| FileDescription: | \x6613\x8bed\x8a00\x7a0b\x5e8f |
| Translation: | 0x0804 0x04b0 |
| ProductName: | \x6613\x8bed\x8a00\x7a0b\x5e8f |
| Comments: | \x672c\x7a0b\x5e8f\x4f7f\x7528\x6613\x8bed\x8a00\x7f16\x5199(http://www.eyuyan.com) |
| FileVersion: | 1.0.0.0 |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 4
| GetLastError |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| Library |
| SHLWAPI.dll |
| OLEAUT32.dll |
| ADVAPI32.dll |
| VERSION.dll |
| GDI32.dll |
| MPR.dll |
| WSOCK32.dll |
| USER32.dll |
| SHELL32.dll |
| WS2_32.dll |
| COMCTL32.dll |
| ole32.dll |
| WININET.dll |
| KERNEL32.dll |
| WINMM.dll |
| IPHLPAPI.DLL |
| COMDLG32.dll |
| RASAPI32.dll |
Strings analysis - Possible IPs found 1
| 49.234.48.162 |
Strings analysis - Possible URLs found 2
| http://www.eyuyan.com) |
| http://49.234.48.162/pdd_biaoge/soft/ |