jyi6mm2w2g.dll
First submission 2023-09-14 10:54:03
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1093.0 KB (1119232 bytes) |
| Compile time: | 2023-09-11 18:15:51 |
| MD5: | 7d2156efddf126dfb4c466da06f15e11 |
| SHA1: | cf90131f73f72b7f32bccca438283a04a1001dbe |
| SHA256: | 452bb497728f1eb2ccd56b83f7a13e51447bd79852085e68908cb6c47625060b |
| Import Hash : | 660e4ba65070c42e55f04efddf5f7d78 |
| Sections 7 | .text .rdata .data .pdata .gfids .rsrc .reloc |
| Directories 4 | import export resource relocation |
| Virus Total: | 15/70 VT report date: 2023-09-14 08:48:23 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://23.88.100.71/jyi6mm2w2g.dll  |
23.88.100.71 |
2023-09-14 10:54:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xe83d | 59904 | f0478e72303212d9ff227c9de4ccfa312838ece9 | 5ca0c94e51412e1c03389811bd4f490a | |
| .rdata | 0x10000 | 0x419d6 | 268800 | fa16cebc7ef5be1354fff1899eeb76fad92b65ed | 3c5b30c91148eb43a6ca921fa0ddeaaf | |
| .data | 0x52000 | 0xbfbb8 | 780800 | e303867394969b5202c11762bbf2b9e471f360e2 | ff53217541840dd98296d8cffe1ad986 | |
| .pdata | 0x112000 | 0xe4c | 4096 | bf32d986708b801efcad62e3bd1c3f84467da771 | bd8d2698e17d03d37ac8278219176162 | |
| .gfids | 0x113000 | 0x94 | 512 | 18863189ddb3e9bbb7b2939ec00e4fb9b6ee4cb9 | 1947c73fe158e983612ea38eb99b3cba | |
| .rsrc | 0x114000 | 0x728 | 2048 | 0c55dd4c0998fed3b6019e177e9106fb279b7af0 | cbc8a329d23b29cf1007bd2a03f54f84 | |
| .reloc | 0x115000 | 0x61c | 2048 | 0900611d72b0ab38fdae3bfe15a84a52b7412d65 | 5c59096811af801a95e7e38e9e770580 |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114320 | 646 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1145a8 | 381 | |
| None | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114120 | 196 |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| mscoree.dll |
| utpcxre663tc32.dll |
| KERNEL32.dll |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| DllRegisterServer | 0x18000f22c |
| Name | Latest seen | MD5 |
|---|---|---|
| oyylqpp3ia.dll | 2023-09-14 10:52:03 | 45f4c6ea59bc7a8c2d20098698104940 |
| 6sev8udq1h.dll | 2023-09-14 10:55:02 | 3a96a42f6d6334a36d2ea26abb0a2c95 |
| i9ien8gksg.dll | 2023-09-14 10:56:02 | fcbb53724b1df93a5d1fc45bb55b9069 |
| hk1c9y18em.dll | 2023-09-14 10:57:03 | a6ac1a8bb63362ed7515f2ca02fb52be |