Swift-Sleep-bypass.exe

First submission 2024-10-17 18:38:02

File details

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Mime type:	application/x-dosexec
File size:	100.0 KB (102400 bytes)
Compile time:	2024-09-17 20:19:09
MD5:	7a8f8e764dc64d0ee5faed04014d1794
SHA1:	3bd240c7bd0384e6ddd6dbec2781cab56382001d
SHA256:	c1a79af2db1fd681a749a3c496c0d40b6f493b8cef94baefcfe7d3522eceedea
Sections 6	.text .data .rdata .edata .idata .reloc
Directories 3	import export relocation

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

OSINT Enrichments

Virus Total:	48/77 VT report date: 2024-10-11 14:59:34
Malware Type 1	trojan
Threat Type 3	havoc havokiz marte

URLs, FQDN and IP indicators 1

URL	Host (FQDN/IP)	Date Added
hXXp://169.1.16.29/Swift-Sleep-bypass.exe	169.1.16.29	2024-10-17 18:38:03

PE Sections 1 suspicious

Name	VAddress	VSize	Size	SHA1	MD5	Suspicious
.text	0x1000	0x17680	96256	afc3aa75e813d0e5c80139add99e39ef88036817	ce967e38392020a6072f57795a2ec815
.data	0x19000	0x960	2560	7b6f842b3555655eb6e8e522c71c4de9fd5e0a1f	5ed60b1fd2a973d11ec312e0c41932a7
.rdata	0x1a000	0x2e0	1024	6875c4a2c7a370f1124d023ff0446fe6757b03ce	f2d3e05b699537879063e0a2e221085a
.edata	0x1b000	0x36	512	45e6094985c37c4bd98a81051426d7284e225b82	9c2e406664b6a0d94abb43a7671fbbf8
.idata	0x1c000	0x14	512	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5	bf619eac0cdf3f68d496ea9344137e8b
.reloc	0x1d000	0xec	512	a7c573119b1d44a2f7ae3879a848bb43db84cdb3	285bb24486a4bb73835695c37bba67b2

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)