2.jpg
First submission 2024-10-12 02:13:04
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 629.0 KB (644096 bytes) |
| Compile time: | 2024-04-14 23:32:00 |
| MD5: | 9d987b63de67acf038bf01bbcc04b841 |
| SHA1: | 698ecd6246528661cc8c165f80ab1683f12a4a82 |
| SHA256: | 5933db4a297cbade801e22b01ccc290b279dcc3f69adb7f6898cd5b914553b0e |
| Import Hash : | 237b17b2e4a814f3a0a6b82394c41992 |
| Sections 6 | .text .data .vavoy .cog .rsrc .reloc |
| Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 25/77 VT report date: 2024-10-12 01:54:30 |
| Malware Type 1 | trojan |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://odoo.kseibitools.com/drhbntdenedrhn/2.jpg  |
odoo.kseibitools.com |
2024-10-12 02:13:04 |
PE Sections 2 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x7e6dc | 518144 | 9773a256d9ca91ffcd0feff8e8d8d456d610f427 | 8428052b852ca87d2bd229448c45c35a | |
| .data | 0x80000 | 0x11ab8 | 25088 | 5a65b2f980fe938cc359084e207ff4abb675728d | 0303ff4e4e7e64761c1910a6d00f8105 | |
| .vavoy | 0x92000 | 0x400 | 1024 | 60cacbf3d72e1e7834203da608037b1bf83b40e8 | 0f343b0931126a20f133d67c2b018a3b | |
| .cog | 0x93000 | 0xd6 | 512 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 | bf619eac0cdf3f68d496ea9344137e8b | |
| .rsrc | 0x94000 | 0x15e60 | 90112 | d5f039d1ed78501156d44ea85603bdac819e6d37 | 2666adc8437e6a2c786e3cb9c74764bf | |
| .reloc | 0xaa000 | 0x1ebe | 8192 | 1be581089024f55e86a31a19def0659adbdfc562 | ff424a81e95314703e2898bd9967ca36 |
PE Resources 8
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xa8c48 | 1384 | |
| RT_ICON | LANG_TAMIL | SUBLANG_DEFAULT | 0xa6b48 | 1128 | |
| RT_DIALOG | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xa9448 | 88 | |
| RT_STRING | LANG_TAMIL | SUBLANG_DEFAULT | 0xa99b0 | 1200 | |
| RT_ACCELERATOR | LANG_TAMIL | SUBLANG_DEFAULT | 0xa7028 | 72 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xa91b0 | 48 | |
| RT_GROUP_ICON | LANG_TAMIL | SUBLANG_DEFAULT | 0xa6fb0 | 118 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xa91e0 | 612 |
Meta infos 7
| LegalCopyright: | Copyright (C) 2023, Pedrajo |
| InternalNames: | PinchesHotLapas |
| FileVersions: | 40.57.97.63 |
| FileDescription: | LocalSnaip |
| Translation: | 0x0209 0x04e4 |
| ProductVersions: | 13.5.43.42 |
| ProductName: | Gelikos |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| mscoree.dll |
| SHELL32.dll |
| USER32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 2
| 40.57.97.63 |
| 13.5.43.42 |