m2.dat

First submission 2024-10-17 16:53:04

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 3854.94 KB (3947462 bytes)
Compile time: 2019-12-05 08:37:27
MD5: 9f764608bb066354b8c39e3c8ac55596
SHA1: 16364eaf46e7bb534711c08153f2d15df3a98152
SHA256: 21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
Import Hash : e2a1496c94d52a035fe47259ee6587b7
Sections 7 .text .rdata .data .pdata .gfids .rsrc .reloc
Directories 5 import export resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 57/79 VT report date: 2024-04-08 10:13:20
Malware Type 3 trojan miner downloader
Threat Type 3 starter aemwb malxmr

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://k2ygoods.top/m2.dat VirusTotal Report k2ygoods.top VirusTotal Report 2024-10-17 16:53:04

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x35924 219648 3ec2416895f04233fa51cf93dc74a663432e9836 dbbb91fb85476329768d95854847b7e0
.rdata 0x37000 0xfeca 65536 38102f50bfbb0809281d6653624ca9badc51e857 af799b024d43a13d663facb579b323e8
.data 0x47000 0x24904 5632 14d545b7ae51d299fe7152f449f7c9e704dbb4ff 03d3b2e088cb0dbd0ccc77a7c100f526
.pdata 0x6c000 0x28e0 10752 e61aa6606f56023f86e3ee72f975c869cf7a833c e034e40e9a2720458b41a860f0c5bdd3
.gfids 0x6f000 0xd0 512 a997e7cd64e9c915e2730b8a17a16ff87bca1b7e 1a6cc10a0b8e60577205ebd1d2848ed1
.rsrc 0x70000 0xd2b0 54272 56d5f235bcba7d2236537ee3c049742d12eefe1c 0754521f52da0db04bbea1067478c639
.reloc 0x7e000 0x8c0 2560 2c03932ec097134406bd36a6b0254acffabe761a d5c22281658a38a62475c3e9db27753d

PE Resources 6

Name Language Sublanguage Offset Size Data
PNG LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x7118c 5545
RT_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x77ea8 15729
RT_DIALOG LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x7c288 462
RT_STRING LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x7cb9c 106
RT_GROUP_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x7cc08 104
RT_MANIFEST LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x7cc70 1600

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 1

Bochs & QEmu CPUID Trick

Strings analysis - File found

Temporary
%s.%d.tmp
winrarsfxmappingfile.tmp
Registry
m/server.reg
m/server2.reg
Library
Crypt32.dll
peerdist.dll
msasn1.dll
profapi.dll
RpcRtRemote.dll
sfc_os.dll
XmlLite.dll
USERENV.dll
ntmarta.dll
rasadhlp.dll
mscoree.dll
mlang.dll
cryptsp.dll
linkinfo.dll
UxTheme.dll
imageres.dll
VERSION.dll
cscapi.dll
usp10.dll
wkscli.dll
devrtl.dll
secur32.dll
wintrust.dll
atl.dll
WINNSI.DLL
rsaenh.dll
riched20.dll
comres.dll
cryptui.dll
ntshrui.dll
slc.dll
oleaccrc.dll
PSAPI.DLL
propsys.dll
NETAPI32.dll
aclui.dll
dhcpcsvc6.dll
cryptbase.dll
ws2help.dll
SHELL32.dll
samlib.dll
KERNEL32.dll
shdocvw.dll
dwmapi.dll
cabinet.dll
MPR.dll
WS2_32.dll
WindowsCodecs.dll
dnsapi.dll
SSPICLI.DLL
samcli.dll
apphelp.dll
dfscli.dll
DXGIDebug.dll
dsrole.dll
ieframe.dll
lpk.dll
netutils.dll
clbcatq.dll
dhcpcsvc.dll
IPHLPAPI.DLL
srvcli.dll
browcli.dll
SETUPAPI.dll
ADVAPI32.dll
USER32.dll
COMCTL32.dll
Fole32.dll
SHLWAPI.dll
gdiplus.dll
COMDLG32.dll
GDI32.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2005/WindowsSettings

Import functions

Name Latest seen MD5
mac42.exe 2022-11-16 19:40:09 f1ffc56cb65c03961aadcca3e736f466