54f0fa329a53.exe
First submission 2024-10-15 12:57:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 947.0 KB (969728 bytes) |
| Compile time: | 2024-10-13 11:32:24 |
| MD5: | 7de1a4a7d819cc98fccdea05f9326c1a |
| SHA1: | be8cbf5903dd27666d08c66114b084e5245d88b8 |
| SHA256: | c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3 |
| Import Hash : | 285f07c66f98861b92460fa57c11d967 |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 56/77 VT report date: 2024-10-15 12:08:29 |
| Malware Type 1 | trojan |
| Threat Type 3 | stealc zusy stealerc |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://assets.gziraq.com/css/54f0fa329a53.exe  |
assets.gziraq.com |
2024-10-15 12:57:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x87979 | 555520 | 543cee87f247810b85d43ad31ad82e9802f74735 | 80831045492aac3d7214964be10dc8b7 | |
| .rdata | 0x89000 | 0x10dbc | 69120 | 34060afa6b491b6b3daf9491a1ebf1f5080aed0a | 82c202f63385834858b719ce48a86fba | |
| .data | 0x9a000 | 0x5041c | 323072 | 6b1cf26c5700315256c868c5f316787b50bb312b | e208993c960204a277ddbd287f66454f | |
| .rsrc | 0xeb000 | 0x595 | 1536 | 3e1f867bc43560491850b9abfdddde8c73f47780 | aafc017bf609fd7dc53f76eaf55ee3ee | |
| .reloc | 0xec000 | 0x4a6c | 19456 | a77f95e96b873d581ad20e0b563b43bb98f2f026 | 009df06dda17fef3270fc1c1ff15d647 |
PE Resources 2
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xeb0a0 | 888 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xeb418 | 381 |
Meta infos 9
| LegalCopyright: | \xa9 Microsoft Corporation. All rights reserved. |
| InternalName: | |
| FileVersion: | 10.0.19041.3636 (WinBuild.160101.0800) |
| CompanyName: | Microsoft Corporation |
| ProductVersion: | 10.0.19041.3636 |
| FileDescription: | Print Utility |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: | Print.Exe |
| ProductName: | Microsoft\xae Windows\xae Operating System |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 7
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| Hmscoree.dll |
| KERNEL32.dll |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| 7f3c2473d1e6.exe | 2024-10-13 06:20:02 | 21b00885507b17bb51792cbac9cd7d01 |
| 670a8ccf0c6f9_LofiseNose.exe | 2024-10-13 07:06:02 | 400af20bb680795b1a047b588d8f1b26 |