index.php
First submission 2023-09-15 06:56:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 297.5 KB (304640 bytes) |
| Compile time: | 2022-12-19 01:56:42 |
| MD5: | 868532d1519c35f5286db7166055711d |
| SHA1: | ed85a798e92814ce6e1295dddde8fcbda29fea8b |
| SHA256: | 9efbde4de467c8a82b270b40c014c4243284b016bd2788164d85012f36aed0ad |
| Import Hash : | fb170d2cb5ff517fc5a6b94f9af4be2d |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
| Virus Total: |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://mindshot.cl/tmp/index.php  |
mindshot.cl |
2023-09-15 06:56:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1eeee | 126976 | 6b27e3f045025538f778e1e756c17fbb8f6548ac | 8e1299831f1aa9ceccd26cd9af27b389 | |
| .data | 0x20000 | 0x2e2b4c | 91136 | 630514e07d1683bfcce4644eeea3cc3c5169ef29 | 2f5bcbd4e8606b3e615a557c4d0f0839 | |
| .rsrc | 0x303000 | 0x14c20 | 85504 | 4f547c17b54f4670e66786d11f309caa87170e6e | da347d7553eededde0b32061d5453d96 |
PE Resources 6
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x3167f0 | 2216 | |
| RT_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x315028 | 1128 | |
| RT_STRING | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x317758 | 1224 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x3167c0 | 48 | |
| RT_GROUP_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x315490 | 104 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x3170b0 | 628 |
Meta infos 8
| InternalName: | Cascade.exe |
| FileVersions: | 42.51.494 |
| LegalCopyrights: | Challangers bottle |
| CompanyName: | Phunderstuck |
| ProductVersion: | 57.5.64.0 |
| FileDescriptions: | Anybodies |
| Translation: | 0x124e 0x03fe |
| ProductName: | Bonni |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| WINHTTP.dll |
| USER32.dll |
| ole32.dll |
| GDI32.dll |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| 167.exe | 2023-09-15 11:53:02 | ed40d082ca526399d0b7a93d74ef974c |