GSAutoClicker.exe?ex=670c8e24&is=670b3ca4&hm=51be56320789350c63b80ba15ac4b60b6b739c1094dae83636c4b1e5bb776c07&

First submission 2024-10-13 19:43:01

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 846.92 KB (867241 bytes)
Compile time: 2016-05-30 18:33:32
MD5: 6862f65be14fd3ce88086ec79777db6e
SHA1: 7f0eb7535b59a926446a400ff93f48165b58ac95
SHA256: 7c90795c9b28fac978386626f5a54033dc9cba46ef6a3f742fc7d52b394590f2
Import Hash : aaaa8913c89c8aa4a5d93f06853894da
Sections 4 .text .rdata .data .rsrc
Directories 2 import resource

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 4/77 VT report date: 2024-10-13 19:37:32
Malware Type 1 trojan

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1293995977077817479/1294862460825763873/GSAutoClicker.exe?ex=670c8e24&is=670b3ca4&hm=51be56320789350c63b80ba15ac4b60b6b739c1094dae83636c4b1e5bb776c07& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 19:43:01

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x80017 524800 60ec177f287382fcb62db5191dc30eefc3292a1c 2dbaea09b92aff2a23fb90133ffbb9a6
.rdata 0x82000 0xd95c 55808 0cb1800d663d33a72cefcd4129e761c876c51627 7a75746a057d3e0b1ac5c5b9bcb2c6b9
.data 0x90000 0x1a518 26624 dd5cc679dbfbba152661243ab505b173399c2d7a 56af83db6167fe1c3889dcabd192a76f
.rsrc 0xab000 0x9abc 39936 13b19cd503e7eec927641493bb58ca5e0989f742 0be88fdcdc69b17fb54a09c13cb0f99f

PE Resources 7

Name Language Sublanguage Offset Size Data
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_UK 0xaf308 16936
RT_MENU LANG_ENGLISH SUBLANG_ENGLISH_UK 0xb3530 78
RT_DIALOG LANG_ENGLISH SUBLANG_ENGLISH_UK 0xb3580 240
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0xb44fc 132
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_UK 0xb45e8 20
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0xb45fc 596
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0xb4850 620

Meta infos 7

LegalCopyright: goldensoft.org
ProductVersion: 3.1.4
FileDescription: GS Auto Clicker
Translation: 0x0409 0x04b0
ProductName: GS Auto Clicker
Comments: www.goldensoft.org
FileVersion: 3.1.4

Packers detected 2

Microsoft Visual C++ 8
VC8 -> Microsoft Corporation

Anti debug functions 11

FindWindowExW
FindWindowW
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
OutputDebugStringW
Process32FirstW
Process32NextW
RaiseException
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 1

VMCheck.dll

Strings analysis - File found

Library
mscoree.dll
KERNEL32.dll
ADVAPI32.dll
OLEAUT32.dll
VERSION.dll
WSOCK32.dll
SHELL32.dll
UxTheme.dll
ICMP.DLL
PSAPI.DLL
COMCTL32.dll
ole32.dll
WININET.dll
USER32.dll
USERENV.dll
WINMM.dll
GDI32.dll
MPR.dll
COMDLG32.dll

Strings analysis - Possible IPs found 1

255.255.255.255

Import functions

Name Latest seen MD5
taskhostw.exe 2024-10-06 21:37:03 d515411b9a3c0d9fb13b9c6a928a7fd0
taskhostw.exe 2024-10-07 06:33:04 822a424b469a4aec464f209d49dd072f
taskhostw.exe 2024-10-07 16:57:05 58ff14d476f2bbaab31b12587c09559e
nggeejan22.exe 2024-10-09 15:26:02 40a93e64a968a16b5139e7a5e4836353
ngown.exe 2024-10-09 15:28:02 1ea3b00d00461c1ee3c576e21dcda173
taskhostsw.exe 2024-10-14 21:13:03 b072f78321c660283d46e104ae677220
taskhostw.exe 2024-10-15 10:34:03 3e2f27edd3deacd8f08f6ed1133b2040
taskhostw.exe 2024-10-16 23:06:03 daaa8ac3995fb610eda2e52a639d191f
taskhostws.exe 2024-10-17 16:48:04 b47e4f366b08fe509c2a8f9ee7251f51