nOjRmu66yYy4.exe?ex=670d1854&is=670bc6d4&hm=b547ab60dd344d05dcf3261e1e0ef191ab18d1671a7912e48019f9801c03b1c6&
First submission 2024-10-13 18:26:02
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1392.0 KB (1425408 bytes) |
| Compile time: | 2023-03-11 15:46:52 |
| MD5: | 8b923746242130bc39f9566cf8ab60dc |
| SHA1: | 430ef7824759dc2295eb6cc5591bf2558c71e350 |
| SHA256: | 021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f |
| Import Hash : | a98fcc30097a9893402b8be27c43a74b |
| Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 29/76 VT report date: 2024-10-13 17:03:32 |
| Malware Type 1 | trojan |
| Threat Type 3 | gamehack filerepmalware misc |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1146180038979506257/1248262806869114880/nOjRmu66yYy4.exe?ex=670d1854&is=670bc6d4&hm=b547ab60dd344d05dcf3261e1e0ef191ab18d1671a7912e48019f9801c03b1c6&  |
cdn.discordapp.com |
2024-10-13 18:26:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xaf4bc | 718336 | 13220126e6a3fb74db21c36b0b26850529147304 | 74c729ffe067e412265cef5e227b941f | |
| .rdata | 0xb1000 | 0xa2220 | 664576 | dc3ff3ffe332458682122e7b115280162d8a2003 | 9d57e79a55d59989ad76759c60a966aa | |
| .data | 0x154000 | 0x4204 | 7168 | 9434aa4d90349ea384e01e532170662802b64665 | 5ecefc752dc538d6b53e0188d9c9fa36 | |
| .pdata | 0x159000 | 0x7080 | 29184 | 05a20b37e863974d497c1f223f55a82e4825d857 | d4eab302e769e08c2f79b1e7684c7829 | |
| _RDATA | 0x161000 | 0x15c | 512 | 3fd54eb7ed92651af58d63f3df4dcdd5c5471309 | 92fa6a13e2a5108e0caa3aead0a96d6d | |
| .rsrc | 0x162000 | 0x288 | 1024 | 087e42634c196f85555967c5bdd71bd4062e41fc | 6be9b05798cdc0744a882fd69ae48858 | |
| .reloc | 0x163000 | 0xd14 | 3584 | c739d83c11793749dfbe171547c63785ef8ba475 | 648dec168b05f1b45ea532ce07107dfa |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x162060 | 548 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 10
| FindWindowA |
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| Process32First |
| Process32Next |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| Text |
| imgui_log.txt |
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| mscoree.dll |
| KERNEL32.dll |
| d3dx9_43.dll |
| xinput1_4.dll |
| dwmapi.dll |
| xinput1_3.dll |
| D3DCompiler_43.dll |
| xinput1_2.dll |
| xinput9_1_0.dll |
| IMM32.dll |
| USER32.dll |
| xinput1_1.dll |
| d3d11.dll |
Strings analysis - Possible URLs found 5
| http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL |
| https://github.com/JulietaUla/Montserrat)MontserratBold7.200;ULA |
| https://github.com/JulietaUla/Montserrat)MontserratRegular7.200;ULA |
| http://www.zkysky.com.ar/This |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |