ipscan.exe
First submission 2024-09-28 16:15:03
Last sumbission 2024-10-15 19:38:05
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| Mime type: | application/x-dosexec |
| File size: | 108.5 KB (111104 bytes) |
| Compile time: | 2004-04-07 19:48:10 |
| MD5: | 6c1bcf0b1297689c8c4c12cc70996a75 |
| SHA1: | 9d99a2446aa54f00af0b049f54afa52617a6a473 |
| SHA256: | 40dc213fe4551740e12cac575a9880753a9dacd510533f31bd7f635e743a7605 |
| Import Hash : | 9368eb48dce6312cc6e8d24b90c63070 |
| Sections 3 | UPX0 UPX1 .rsrc |
| Directories 2 | import resource |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 37/77 VT report date: 2024-09-28 05:26:33 |
| Malware Type 3 | hacktool pua trojan |
| Threat Type 3 | portscan nettool angry |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://file.edunet.ac/ipscan.exe  |
file.edunet.ac |
2024-10-15 19:38:10 |
PE Sections 2 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x2e000 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| UPX1 | 0x2f000 | 0x1a000 | 104448 | 6b3d1eb2e337b1756595889649fd2ccf7eb20d7f | 7c30587528d73cde0f0955557a5cec92 | |
| .rsrc | 0x49000 | 0x2000 | 5632 | fc0a33c8f1239eed00369bc39e757210603a94b8 | 5cc6d5f69163fe15be4454b775f4745b |
PE Resources 11
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x42df0 | 180 | |
| RT_BITMAP | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x437c8 | 324 | |
| RT_ICON | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x49eb8 | 296 | |
| RT_MENU | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x3ebd0 | 1886 | |
| RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x434b8 | 232 | |
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x450f8 | 44 | |
| RT_ACCELERATOR | LANG_NEUTRAL | SUBLANG_DEFAULT | 0x40048 | 200 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x42ea8 | 34 | |
| RT_GROUP_ICON | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x49fe4 | 34 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x4a00c | 832 | |
| None | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x41be0 | 466 |
Meta infos 13
| LegalCopyright: | Copyright (C) 2000 |
| InternalName: | ipscan |
| FileVersion: | 0, 0, 0, 0 |
| FileDescription: | Angry IP scanner |
| SpecialBuild: | |
| CompanyName: | Angryziber Software |
| LegalTrademarks: | |
| Comments: | |
| ProductName: | |
| ProductVersion: | 0, 0, 0, 0 |
| PrivateBuild: | |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: | ipscan.exe |
Packers detected 3
| UPX v0.80 - v0.84 |
| UPX 2.90 (LZMA) |
| UPX -> www.upx.sourceforge.net |
Strings analysis - File found
| Library |
| ADVAPI32.dll |
| SHELL32.dll |
| KERNEL32.dll |
| COMDLG32.dll |
| +.DLL |
| USER32.dll |
| COMCTL32.dll |
| GDI32.dll |
| ole32.dll |
| WSOCK32.dll |