oconsole.exe

First submission 2024-10-16 08:19:03

File details

File type: PE32+ executable (console) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 20543.66 KB (21036712 bytes)
Compile time: 2024-10-13 16:10:46
MD5: a6ff47344d0188ec4c26dc435698a477
SHA1: a53fa13d323b5973409dacd6b2e69e10bd506345
SHA256: 39e20fa47644c31275280e79c46e8a4d53b796dde456aac92fd8399c984b0358
Import Hash : a06f302f71edd380da3d5bf4a6d94ebd
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 27/77 VT report date: 2024-10-16 07:49:33
Malware Type 1 trojan
Threat Type 2 clyp disco

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://172.104.202.223/oconsole.exe VirusTotal Report 172.104.202.223 VirusTotal Report 2024-10-16 08:19:03

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x2b110 176640 ea200f32c9b32ca6d80cc06d709db3e6a5557f73 55ff5ed922edfe0b0c10734c674f4ee4
.rdata 0x2d000 0x12842 76288 296d799e4cfbc2390c21fb88463aeaea864d3133 218d7d3a658eaea257d8afb85a8d7db4
.data 0x40000 0x5408 3584 249cf6b3c95e5782a7f27c661b5f018c45d7745c aff56347f897785154c53727472c548d
.pdata 0x46000 0x22f8 9216 b5fd13ef0a20267ee6c023bcfed00a928a687dfd 57f77a295f3be6e2a8e90035dde19ce2
.rsrc 0x49000 0xef8c 61440 a2f889fc23a4bb2ff4d728fc6dcfff45237dca94 5d72e0338b034862f777c781ab7d2219
.reloc 0x58000 0x768 2048 e599e91a866af587afec0cc6408b4eaba8188703 42d6242177dbae8e11ed5d64b87d0d48

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x575ac 1128
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x57a14 104
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x57a7c 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 7

GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Backup
h.oLd
Compressed
bbase_library.zip
base_library.zip
Database
p4.i.Db
&A.Db
Text
bsetuptools-65.5.0.dist-info\entry_points.txt
bsetuptools-65.5.0.dist-info\top_level.txt
Library
mscoree.dll
vcruntime140.dll
7python311.dll
bsqlite3.dll
bpython3.dll
blibssl-1_1.dll
blibffi-8.dll
bpywin32_system32\pywintypes311.dll
ADVAPI32.dll
KERNEL32.dll
bPythonwin\mfc140u.dll
ucrtbase.dll
bVCRUNTIME140_1.dll
bVCRUNTIME140.dll
USER32.dll
bpywin32_system32\pythoncom311.dll
bpython311.dll
blibcrypto-1_1.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
FreeMenuF7.exe?ex=670c6a4f&is=670b18cf&hm=708940c07a26aaf3672b4ecc443356a73d7db9284ddace557e866ab656ed23b4& 2024-10-13 17:37:02 1069ade6b99d29bfe4d0526e23ed714d
RezWareUpdater.exe?ex=670cae4b&is=670b5ccb&hm=6b7767e2959bba7239b160100573375d95ac04f204f064ca6d9161caf5dd4d0e& 2024-10-13 18:25:03 caf83d29d4db7764696f1c225317fe16