Project_Reboot_3.0.dll?ex=670c7d20&is=670b2ba0&hm=dca78df3f8d6766e62d5ec3bebd42d973ba587a8f1401a3067f81767b33c106e&
First submission 2024-10-13 20:18:01
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 2092.0 KB (2142208 bytes) |
| Compile time: | 2024-09-14 16:08:24 |
| MD5: | 6e9ddad2af0bb95b241ac92bd07282d7 |
| SHA1: | fa35ba5239c7def50bd4b9481b3e7fcf4e44a218 |
| SHA256: | 6248b8a119344adca3ef9f9b9c920dae32abb061e5e365c041a3f6650c5c9903 |
| Import Hash : | 8a493cdd5f73e368024fd6dd71454181 |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 8/77 VT report date: 2024-10-13 19:22:26 |
| Malware Type 1 | trojan |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1042567831570616431/1284516136993685545/Project_Reboot_3.0.dll?ex=670c7d20&is=670b2ba0&hm=dca78df3f8d6766e62d5ec3bebd42d973ba587a8f1401a3067f81767b33c106e&  |
cdn.discordapp.com |
2024-10-13 20:18:01 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x173dc7 | 1523200 | fcd2ffa4c8d2d1e137203c4b1a77f0322b04d71d | 58e423b561075f6d455b1c359a1b6019 | |
| .rdata | 0x175000 | 0x801e4 | 524800 | 25d43a1458bf89448c9335a630e04129b34c344c | 33dc7000cd29dfdafea4b0e140c810a3 | |
| .data | 0x1f6000 | 0xd770 | 35328 | f2e8f32e01d3ab1191edb26594717be25a9ce2f5 | 1bb1379fb88b651cdc31d5e6a753ddd9 | |
| .pdata | 0x204000 | 0xc240 | 50176 | b349be59ec388b08c78c722a86d8722eb60a05da | b227317099eec7dd79918e71a03d3e0b | |
| .rsrc | 0x211000 | 0xf8 | 512 | 74b9c83e26fd2cabc3daf4ec67f61c0d2b9e0a40 | e26841304580c214140c4e241d3b5a47 | |
| .reloc | 0x212000 | 0x1bd4 | 7168 | 727dc5c2019d89714293007228dfd31088857b0c | 0bc1b31a262172e993bc518acfad0b9f |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x211060 | 145 |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Temporary |
| %s.%s.tmp |
| Text |
| Playlists.txt |
| skins.txt |
| imgui_log.txt |
| ObjectsDump.txt |
| Weapons.txt |
| Library |
| ADVAPI32.dll |
| secur32.dll |
| d3d9.dll |
| api-ms-win-crt-utility-l1-1-0.dll |
| security.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| VCRUNTIME140_1.dll |
| xinput1_3.dll |
| WS2_32.dll |
| api-ms-win-crt-time-l1-1-0.dll |
| xinput1_2.dll |
| xinput9_1_0.dll |
| IMM32.dll |
| KERNEL32.dll |
| api-ms-win-crt-environment-l1-1-0.dll |
| Crypt32.dll |
| USER32.dll |
| api-ms-win-crt-locale-l1-1-0.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| api-ms-win-crt-convert-l1-1-0.dll |
| msvcp140.dll |
| xinput1_1.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| xinput1_4.dll |
| api-ms-win-crt-stdio-l1-1-0.dll |
| IPHLPAPI.DLL |
| vcruntime140.dll |
| api-ms-win-crt-filesystem-l1-1-0.dll |
| api-ms-win-crt-math-l1-1-0.dll |
Strings analysis - Possible IPs found 29
| 127.0.0.1 |
| 2.5.4.8 |
| 2.5.4.9 |
| 2.5.4.6 |
| 2.5.4.7 |
| 2.5.4.4 |
| 2.5.4.5 |
| 2.5.4.3 |
| 2.5.4.72 |
| 68.134.74.228 |
| 1.2.0.4 |
| 26.66.97.190 |
| 2.5.4.10 |
| 2.5.4.11 |
| 2.5.4.12 |
| 2.5.4.13 |
| 2.5.4.17 |
| 1.3.14.3 |
| 2.5.4.45 |
| 101.3.4.2 |
| 2.5.29.19 |
| 2.5.4.65 |
| 2.5.29.17 |
| 2.5.4.46 |
| 2.5.29.18 |
| 2.5.4.44 |
| 2.5.4.43 |
| 2.5.4.42 |
| 2.5.4.41 |
Strings analysis - Possible URLs found 6
| https://curl.se/docs/http-cookies.html |
| http://scripts.sil.org/ofl |
| file:// |
| https://curl.se/docs/alt-svc.html |
| file://%s%s%s |
| https://curl.se/docs/hsts.html |
Import functions
api-ms-win-crt-environment-l1-1-0.dll 1
api-ms-win-crt-filesystem-l1-1-0.dll 6
api-ms-win-crt-locale-l1-1-0.dll 2
api-ms-win-crt-time-l1-1-0.dll 3
api-ms-win-crt-convert-l1-1-0.dll 9
d3d9.dll 1
MSVCP140.dll 81
CRYPT32.dll 16
api-ms-win-crt-string-l1-1-0.dll 10
VCRUNTIME140_1.dll 1
api-ms-win-crt-runtime-l1-1-0.dll 18
KERNEL32.dll 81
api-ms-win-crt-math-l1-1-0.dll 15
api-ms-win-crt-utility-l1-1-0.dll 3
VCRUNTIME140.dll 16
ADVAPI32.dll 10
api-ms-win-crt-stdio-l1-1-0.dll 31
WS2_32.dll 36
api-ms-win-crt-heap-l1-1-0.dll 5
USER32.dll 30
IMM32.dll 5