Protectedformyman.exe

First submission 2024-10-18 07:36:02

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 1512.32 KB (1548616 bytes)
Compile time: 2024-10-18 04:47:04
MD5: 870025e332dfcfb4bd089bf2151388ff
SHA1: 4804d5dc6c73e109e14715ac22cd1d6caffe1772
SHA256: 1939e8b69d8f42401f74c941657a174b4647f3d21eb3cdcdff615ba9ff3ee3e1
Import Hash : 913b53759cda103df07e1be81a5e2514
Sections 3 .text .data .rsrc
Directories 3 import resource security

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 30/77 VT report date: 2024-10-18 05:26:24
Malware Type 2 trojan banker
Threat Type 3 zusy convagent msil

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://185.196.11.151/kfkn/Protectedformyman.exe VirusTotal Report 185.196.11.151 VirusTotal Report 2024-10-18 07:36:02

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x161af8 1449984 f2927a3dd40a6db69c99121679c066888766b676 04086a30a925043795ddd4939b904c2b
.data 0x163000 0x3cdc 4096 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x167000 0x10b18 69632 a921050966eb2817b1351d6493cd891bb311f4d6 d574ba00b7ea94993a321fb72ec52575

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x1670e8 67624
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x177910 20
RT_VERSION LANG_GERMAN SUBLANG_GERMAN 0x177924 500

Meta infos 6

InternalName: acvm7qw909e
ProductVersion: 1.00
Translation: 0x0407 0x04b0
ProductName: Careva_Meraq
OriginalFilename: acvm7qw909e.exe
FileVersion: 1.00

Anti debug functions 1

Virtual Box

File signature

MD5 SHA1 Block size Virtual Address
3d47c89a47044da3390b363b6279af73 ffd2cbd80c7f50149c443fb0a289be61fce3bb9d 20808 1527808

Strings analysis - File found

Autogen
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Library
USER32.dll
KERNEL32.dll
MSVBVM60.DLL
VB5!6&VB6DE.DLL
VBA6.DLL

Strings analysis - Possible URLs found 14

http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
http://ocsp.digicert.com0C
http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
http://ocsp.digicert.com0A
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
http://ocsp.digicert.com0\
http://www.digicert.com/CPS0
http://ocsp.digicert.com0X

Import functions