timeSync.exe
First submission 2023-09-15 00:31:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 246.0 KB (251904 bytes) |
| Compile time: | 2022-05-22 21:32:58 |
| MD5: | 8816dec1704461c24f7575c00f7f86d4 |
| SHA1: | fcf92c87351d810816a655946b5541d9aa638788 |
| SHA256: | 891daaeaed0ec160ca3c06fd3a5a896b776bc22a7f42cb9cb02afb49b989d4ed |
| Import Hash : | 85f93ec750e6f7137bb7fe5a5261ac14 |
| Sections 4 | .text .data .rsrc .reloc |
| Directories 4 | import resource debug relocation |
| Virus Total: | 32/71 VT report date: 2023-09-14 22:15:45 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://171.22.28.221/timeSync.exe  |
171.22.28.221 |
2023-09-15 00:31:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2f776 | 194560 | 8a1d756ee446c431c1ac257d95b257f9f48388a0 | 2b68c9d6dd7ffdd18fcc88a675cfb352 | |
| .data | 0x31000 | 0x50410 | 12800 | fa98d93183d95cac16acbdf99e1dba0713262123 | fa862a4c8fb5d8ad9748a31a8690135e | |
| .rsrc | 0x82000 | 0x1a76b0 | 34816 | 31a5c4cd7a40624fdecc0645772d5aadc3a28589 | 5afa366a531c750247aa59c37ed17328 | |
| .reloc | 0x22a000 | 0x2166 | 8704 | 05fcfad695aa7fbcd32ca444eed08e8fe86bbd9b | 9e0929cb4bb8a7f2989ae01dc096f4d5 |
PE Resources 8
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x85700 | 14 | |
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x88d50 | 1384 | |
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x851f0 | 1128 | |
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x8a190 | 1310 | |
| RT_ACCELERATOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x856d0 | 48 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x892b8 | 48 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x85658 | 48 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x892e8 | 624 |
Meta infos 7
| LegalCopyright: | Copyright (C) 2022, Uniqum |
| ProductionVersion: | 82.27.62.16 |
| FileDescription: | Silvuple |
| Translation: | 0x08bf 0x0ad5 |
| ProductsVersion: | 29.510.12.19 |
| OriginalFilename: | betshop.exe |
| ProductName: | Kuihmfghi |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| mscoree.dll |
| USER32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 1
| 82.27.62.16 |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| s1.exe | 2023-09-14 23:51:02 | 1d6a742534494f66081d5b70f44f6695 |