o1.exe
First submission 2022-05-10 13:48:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| File type: | 375.73 KB (384752 bytes) |
| Compile time: | 2021-09-25 23:56:47 |
| MD5: | 8413d6561a7cea036bcb55ce3739c927 |
| SHA1: | 08202c401822dee611a59ec94d0951f5810909cc |
| SHA256: | 45657b8e77b893c62e2ea98135ff4e0479e6588337758d88c266d141897dc767 |
| Import Hash : | 61259b55b8912888e90f516ca08dc514 |
| Sections 5 | .text .rdata .data .ndata .rsrc |
| Directories 3 | import resource security |
| Virus Total: | 3/68 VT report date: 2022-05-10 11:35:18 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/973328545218695221/973331573493608468/o1.exe  |
cdn.discordapp.com |
2022-05-10 13:48:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6676 | 26624 | 55517dc6ad93689679677d152abfdd1ce20f1135 | 6f5abe9eeda26ee84b3c1ed1a6c82001 | |
| .rdata | 0x8000 | 0x139a | 5120 | dc4f14d019cad6646b38852dfb7370532acafebc | 8c5edfd8ff9cc0135e197611be38ca18 | |
| .data | 0xa000 | 0x20378 | 1536 | f45486287d474fdcafc99c24e37c4eb61bf613b3 | 4b2421975c21b032f7ea000f5e7f9fbf | |
| .ndata | 0x2b000 | 0x27000 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .rsrc | 0x52000 | 0x28408 | 165376 | 61c6b9f2a3f7f8fb98af2fc4ba3f8f4de576a866 | b0247578abeb936dd4ca3cf39f9b5d79 |
PE Resources 5
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x79680 | 1128 | |
| RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x79d08 | 96 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x79d68 | 118 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x79de0 | 740 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x7a0c8 | 830 |
Meta infos 8
| Translation: | 0x0409 0x04b0 |
| LegalCopyright: | Triad Hospitals Inc |
| FileDescription: | Rohm & Haas Co. |
| Comments: | Tecumseh Products Company |
| LegalTrademarks: | R.J. Reynolds Tobacco Company |
| FileVersion: | 22.18.23 |
| ProductName: | Bell Microproducts Inc. |
| CompanyName: | Lawson Software |
Anti debug functions 2
| FindWindowExW |
| GetLastError |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| fddae6e3dba50938d0410249c0516acc | ab76de18bd4ec43ce487f659d1ee756b4d116e35 | 6688 | 378064 |
Strings analysis - File found
| Library |
| %s%s.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| USER32.dll |
| COMCTL32.dll |
| ole32.dll |
| GDI32.dll |
| KERNEL32.dll |
Strings analysis - Possible URLs found 8
| http://ocsp.sectigo.com0 |
| http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0% |
| http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v |
| http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# |
| http://nsis.sf.net/NSIS_Error |
| http://ocsp.usertrust.com0 |
| http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t |
| https://sectigo.com/CPS0D |