wget.exe
First submission 2024-10-14 23:40:03
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 4812.61 KB (4928112 bytes) |
| Compile time: | 1970-01-01 01:00:00 |
| MD5: | 695378debce1b312f353f84c11cb4629 |
| SHA1: | d0c48530c7cf2141cf3aff229a337d69769efa7e |
| SHA256: | f595e2e53680ba2937ac48708bc24e6fb5ff6b6fb97d60eb5040bf073ad933bf |
| Import Hash : | 552b863bc83609be81292a8eaceb466d |
| Sections 12 | .text .data .rdata .pdata .xdata .bss .idata .CRT .tls .rsrc .reloc /4 |
| Directories 5 | import resource tls relocation security |
File features detected
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://193.70.43.137/mvt/wget.exe  |
193.70.43.137 |
2024-10-14 23:40:03 |
PE Sections 3 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x3226d0 | 3287040 | daf91fd9933f029be6120aa2475042b83e28bcb4 | 07ac3d2b3fa530b55469affba3dc4400 | |
| .data | 0x324000 | 0xcd80 | 52736 | 815cf36d2cf7df02b43325ea3951ca8528971b60 | 9ffae80f1b211c0af502b184d1a8416b | |
| .rdata | 0x331000 | 0x137390 | 1274880 | 7b68aba720c1e655c552192c9e57d35755c749d7 | db8e5a0dfa3d44c1b3014cf59019a14d | |
| .pdata | 0x469000 | 0x1effc | 126976 | 739e89143165ba810605245949e1b2b4a667a2ae | a64d7b7f2c375cf01f993789d6201b66 | |
| .xdata | 0x488000 | 0x1ad04 | 110080 | 03ac678eefe00f3ec74085bb677ef66fbb2b1370 | 938c4aa7bd03f0fff5d207b3a8e81381 | |
| .bss | 0x4a3000 | 0x14620 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .idata | 0x4b8000 | 0x3b48 | 15360 | 6d78077640a32f3e1b0bfb5198dda683ed75ea24 | f96007ecf1a54a4c4ba45c18c9137eca | |
| .CRT | 0x4bc000 | 0x68 | 512 | ff5215a75ffa503bf209baea26a913cfad98d792 | bb168f7c483a7d2e679e216b162118e1 | |
| .tls | 0x4bd000 | 0x10 | 512 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 | bf619eac0cdf3f68d496ea9344137e8b | |
| .rsrc | 0x4be000 | 0x4e8 | 1536 | 0567ded701dc25bee91840affccf907896af7266 | 8b58e69a70f7082f3056d2a0b64145fe | |
| .reloc | 0x4bf000 | 0x769c | 30720 | 13eda6ff1ffdc84d70a2ef0e00d057bde5040bd8 | d335c11507d6eb0d434d41a16754abed | |
| /4 | 0x4c7000 | 0x14 | 512 | fa278fac617b1c5e27d946b39f208819d480c378 | d05322128fee195e6f283dbe26cc3010 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x4be058 | 1167 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| OutputDebugStringA |
| RaiseException |
| TerminateProcess |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| c44558cf5ef01a117734d975996995e9 | 50ed97e5f79be554a34d74abc751d816dbc829ee | 9992 | 4918120 |
Strings analysis - File found
| Log |
| metadata://gnu.org/software/wget/warc/wget.log |
| Temporary |
| %s.tmp |
| Data |
| ../../list/public_suffix_list.dat |
| Text |
| metadata://gnu.org/software/wget/warc/MANIFEST.txt |
| metadata://gnu.org/software/wget/warc/wget_arguments.txt |
| /robots.txt |
| Library |
| IPHLPAPI.DLL |
| ADVAPI32.dll |
| MSVCRT.dll |
| 2ADVAPI32.DLL |
| KERNEL32.dll |
| SHELL32.dll |
| USER32.dll |
| bcrypt.dll |
| WS2_32.dll |
| Crypt32.dll |
| rpcrt4.dll |
| mlang.dll |
| ole32.dll |
| %s.dll |
| ntdll.dll |
Strings analysis - Possible IPs found 1
| 127.0.0.1 |
Strings analysis - Possible URLs found 29
| ftp://%s |
| http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t |
| https://sectigo.com/CPS0D |
| http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# |
| http://www.metalinker.org/ |
| http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s |
| https://gnu.org/licenses/ |
| http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0# |
| ftp://%s%s:%d |
| http:// |
| http://crl.comodoca.com/AAACertificateServices.crl04 |
| http://www.gnu.org/licenses/gpl.html |
| http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0% |
| http://www.w3.org/XML/1998/namespace |
| http://ocsp.comodoca.com0 |
| https://sectigo.com/CPS0 |
| ftps:// |
| file:// |
| http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v |
| http://www.w3.org/2000/xmlns/ |
| http://ocsp.usertrust.com0 |
| ftp:// |
| http://%s |
| http://ocsp.sectigo.com0 |
| http://netpreserve.org/warc/1.0/revisit/identical-payload-digest |
| https://gnu.org/licenses/gpl.html |
| https://savannah.gnu.org/bugs/?func=additem&group=wget. |
| http://bibnum.bnf.fr/WARC/WARC_ISO_28500_version1_latestdraft.pdf |
| https:// |