demon.x64.exe

First submission 2024-10-17 18:33:04

File details

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Mime type:	application/x-dosexec
File size:	100.0 KB (102400 bytes)
Compile time:	2024-09-17 20:11:16
MD5:	806425052861a58f462b8e18b7502ae6
SHA1:	5420baed36ecfb3df7727effddcff30723e1cd86
SHA256:	db58a931d38306d3925aba738425200f14fc3e93054f5f3e3fdea3813c23e366
Sections 6	.text .data .rdata .edata .idata .reloc
Directories 3	import export relocation

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

OSINT Enrichments

Virus Total:	47/77 VT report date: 2024-10-11 14:53:22
Malware Type 1	trojan
Threat Type 3	havoc havokiz marte

URLs, FQDN and IP indicators 1

URL	Host (FQDN/IP)	Date Added
hXXp://169.1.16.29/demon.x64.exe	169.1.16.29	2024-10-17 18:33:04

PE Sections 1 suspicious

Name	VAddress	VSize	Size	SHA1	MD5	Suspicious
.text	0x1000	0x17680	96256	afc3aa75e813d0e5c80139add99e39ef88036817	ce967e38392020a6072f57795a2ec815
.data	0x19000	0x960	2560	92d98e383895f5f836154717e56d9aa86ba0bf91	103a569d2c96646811451d85f213377e
.rdata	0x1a000	0x2e0	1024	6875c4a2c7a370f1124d023ff0446fe6757b03ce	f2d3e05b699537879063e0a2e221085a
.edata	0x1b000	0x36	512	9e74980a6d6a489fe5fe061665b26c31056ee691	25ac9abda48057f0e5e7cdb5c057538b
.idata	0x1c000	0x14	512	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5	bf619eac0cdf3f68d496ea9344137e8b
.reloc	0x1d000	0xec	512	a7c573119b1d44a2f7ae3879a848bb43db84cdb3	285bb24486a4bb73835695c37bba67b2

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)