6706e721f2c06.exe
First submission 2024-10-15 21:54:02
File details
File type: | PE32+ executable (GUI) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 160.5 KB (164352 bytes) |
Compile time: | 2062-07-25 14:18:00 |
MD5: | 9d26cee91cd86b11808a161681be9f85 |
SHA1: | f0334a5e2d01bbaf5bdb4a103bf9504dad218f85 |
SHA256: | c3dee07cba853e66489d883ef5bcc094ea32861828ebfcde773e7527726be35c |
Import Hash : | 4cea7ae85c87ddc7295d39ff9cda31d1 |
Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
Virus Total: | 45/77 VT report date: 2024-10-11 15:23:05 |
Malware Type 1 | trojan |
Threat Type 3 | remcos drzam yxejjz |
URLs, FQDN and IP indicators 1
PE Sections 2 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x7b80 | 31744 | 06e63be17d4a58c8b55b36c7342e541d00d61a93 | 60800deac1fde21b98089f2241ee6168 | |
.rdata | 0x9000 | 0x22c8 | 9216 | 3b5f897036bf0d72ebd732362c8f60d2e1f1a5cf | 59d15cdf89780817c3d48dd588a6a129 | |
.data | 0xc000 | 0x1f00 | 1024 | 7f0ee10c956d86fef4e6351c3ee77dd00350a9c9 | 9d1580dccaf8e787a43caf4bba48a079 | |
.pdata | 0xe000 | 0x408 | 1536 | ad44ea7406ea6c51a0ab1ea04598f448ce47d593 | 15cd12257317071f28e4f7b728f8825e | |
.rsrc | 0xf000 | 0x1e000 | 119296 | d9a52291ab42be197325e68fd8385381caf807ae | 30405be46955f0873b6e5e8b5914975a | |
.reloc | 0x2d000 | 0x20 | 512 | 4d5087ba3cb6a051543140baca75212fa7ac8e34 | 637787151ee546a94902de9694a58fd6 |
PE Resources 8
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
AVI | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xf9f8 | 11802 | |
RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x271a0 | 1128 | |
RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x27f04 | 288 | |
RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x29498 | 974 | |
RT_RCDATA | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2b458 | 7 | |
RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2b460 | 188 | |
RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2b51c | 1032 | |
RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2b924 | 2022 |
Meta infos 9
LegalCopyright: | \xa9 Microsoft Corporation. All rights reserved. |
InternalName: | Wextract |
FileVersion: | 11.00.19041.1 (WinBuild.160101.0800) |
CompanyName: | Microsoft Corporation |
ProductVersion: | 11.00.19041.1 |
FileDescription: | Win32 Cabinet Self-Extractor |
Translation: | 0x0409 0x04b0 |
OriginalFilename: | WEXTRACT.EXE .MUI |
ProductName: | Internet Explorer |
Packers detected 1
Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 3
GetLastError |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Temporary |
TMP4351$.TMP |
IXP%03d.TMP |
msdownld.tmp |
Library |
KERNEL32.dll |
ADVAPI32.dll |
SETUPAPI.dll |
advpack.dll |
USER32.dll |
VERSION.dll |
MSVCRT.dll |
setupx.dll |
COMCTL32.dll |
cabinet.dll |
SHELL32.dll |
GDI32.dll |
Import functions
Name | Latest seen | MD5 |
---|---|---|
wam.exe | 2022-08-29 08:31:03 | 9b8464cd768802d3d49b80a8ef78d7a1 |
netnvm64.exe | 2022-09-27 08:04:05 | 4c2cdb900536961dfdcda8be0be11574 |
Galaxy.exe | 2022-10-07 18:49:02 | 26984bb9bcbde9866faca7f20717f587 |
new.exe | 2022-10-11 10:52:03 | 762d276b402209a5ce78d9a9258f1bd3 |
movie.exe | 2022-10-22 01:12:02 | 4cf7cc220ac7067fb426f142abbc9468 |
well.exe | 2022-10-22 07:14:02 | 1736d5e66964722a2d5301c515f17496 |
civiltechnological.exe | 2022-10-26 18:52:05 | 6715b8072392e3643ef086fc986ec25f |
becomeproblem.exe | 2022-10-28 20:47:06 | d6e9e86e003086022805cd59d1a406bd |
securitytitle.exe | 2022-10-31 07:21:03 | 284f809cd813f041b06e903f33841601 |
understanddecline.exe | 2022-11-16 18:50:09 | fbbf2ce201380bfd14cbe5a31d2b17de |
server5.EXE | 2022-12-20 14:22:06 | a383534669ff5ef9786e6aa9dc78ca66 |
ransom.EXE | 2022-12-20 14:41:31 | f75bbc3a02c7ae376c6e21bb58d70224 |
krnl_connect.exe | 2022-12-21 02:38:04 | d2e78f6663b47a7ec04a4d014cab5ff1 |
prettyremote.exe | 2022-12-24 16:45:05 | 6628fb4f54815e0907c1760315b78983 |
activitycoordinate.exe | 2022-12-28 21:43:02 | 95a9c9387e52c3dd853429264fe35564 |
25.exe | 2023-01-04 09:50:02 | 5f2e9cf31a58bf42d6059f472649ef2f |
xx.exe | 2023-01-05 18:51:02 | f4974a20ba2cd22cb9069aac0d337136 |
Installerr.exe | 2023-02-25 18:50:02 | 720cef5d7d31d20d9ce66ff8fccaa0dc |
aliacesz.exe | 2023-03-06 07:09:03 | 9b34a1a535c29e31915e4b8993d9bb5e |
setup.EXE | 2023-06-04 20:24:04 | 426937c153dd506951c7f40a94094c48 |
djlw_zip.exe | 2023-06-16 13:33:01 | 90c4d8c8f396f66d9b556ab05344a8cd |
leadiadequatepro.exe | 2024-06-28 09:22:03 | b149f82964b1e269ade2686612a9e777 |
easyengineeringpro.exe | 2024-06-28 10:18:02 | 51d6c3f850923398dda928c4a71d6187 |
cultureeyestrainpro.exe | 2024-06-28 10:26:05 | db527e671b1947fdb99b9a5a64f2742f |
propertysitepro.exe | 2024-07-29 08:06:03 | a7221cf05ec4add1d531b242c1faace7 |
Solara.exe | 2024-09-26 01:43:02 | 51c009abf871216f8d9e40cdd785ce6c |
file.exe | 2024-10-05 10:13:02 | 7300cad585fefa6a6f67c78ac264b128 |
vclib.exe | 2024-10-08 00:11:03 | 52c1acdcbb715dd099648b26b98254e8 |
NOScript_V1.35_Optimization_Program.exe?ex=670cea11&is=670b9891&hm=ef0c18bb613bbf2531ff91f08d378787965d64e2e6c1999a8028027b37a26526& | 2024-10-13 18:32:02 | 00a66870b86ad2c0c9a723dbe3d587d0 |