oconsole.exe
First submission 2024-10-16 08:19:03
File details
File type: | PE32+ executable (console) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 20543.66 KB (21036712 bytes) |
Compile time: | 2024-10-13 16:10:46 |
MD5: | a6ff47344d0188ec4c26dc435698a477 |
SHA1: | a53fa13d323b5973409dacd6b2e69e10bd506345 |
SHA256: | 39e20fa47644c31275280e79c46e8a4d53b796dde456aac92fd8399c984b0358 |
Import Hash : | a06f302f71edd380da3d5bf4a6d94ebd |
Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
Virus Total: | 27/77 VT report date: 2024-10-16 07:49:33 |
Malware Type 1 | trojan |
Threat Type 2 | clyp disco |
URLs, FQDN and IP indicators 1
PE Sections 1 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x2b110 | 176640 | ea200f32c9b32ca6d80cc06d709db3e6a5557f73 | 55ff5ed922edfe0b0c10734c674f4ee4 | |
.rdata | 0x2d000 | 0x12842 | 76288 | 296d799e4cfbc2390c21fb88463aeaea864d3133 | 218d7d3a658eaea257d8afb85a8d7db4 | |
.data | 0x40000 | 0x5408 | 3584 | 249cf6b3c95e5782a7f27c661b5f018c45d7745c | aff56347f897785154c53727472c548d | |
.pdata | 0x46000 | 0x22f8 | 9216 | b5fd13ef0a20267ee6c023bcfed00a928a687dfd | 57f77a295f3be6e2a8e90035dde19ce2 | |
.rsrc | 0x49000 | 0xef8c | 61440 | a2f889fc23a4bb2ff4d728fc6dcfff45237dca94 | 5d72e0338b034862f777c781ab7d2219 | |
.reloc | 0x58000 | 0x768 | 2048 | e599e91a866af587afec0cc6408b4eaba8188703 | 42d6242177dbae8e11ed5d64b87d0d48 |
PE Resources 3
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x575ac | 1128 | |
RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x57a14 | 104 | |
RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x57a7c | 1293 |
Packers detected 2
Microsoft Visual C++ 8.0 (DLL) |
Microsoft Visual C++ 8.0 |
Anti debug functions 7
GetLastError |
GetWindowThreadProcessId |
IsDebuggerPresent |
IsProcessorFeaturePresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Backup |
h.oLd |
Compressed |
bbase_library.zip |
base_library.zip |
Database |
p4.i.Db |
&A.Db |
Text |
bsetuptools-65.5.0.dist-info\entry_points.txt |
bsetuptools-65.5.0.dist-info\top_level.txt |
Library |
mscoree.dll |
vcruntime140.dll |
7python311.dll |
bsqlite3.dll |
bpython3.dll |
blibssl-1_1.dll |
blibffi-8.dll |
bpywin32_system32\pywintypes311.dll |
ADVAPI32.dll |
KERNEL32.dll |
bPythonwin\mfc140u.dll |
ucrtbase.dll |
bVCRUNTIME140_1.dll |
bVCRUNTIME140.dll |
USER32.dll |
bpywin32_system32\pythoncom311.dll |
bpython311.dll |
blibcrypto-1_1.dll |
Strings analysis - Possible URLs found 1
http://schemas.microsoft.com/SMI/2016/WindowsSettings |
Import functions
Name | Latest seen | MD5 |
---|---|---|
FreeMenuF7.exe?ex=670c6a4f&is=670b18cf&hm=708940c07a26aaf3672b4ecc443356a73d7db9284ddace557e866ab656ed23b4& | 2024-10-13 17:37:02 | 1069ade6b99d29bfe4d0526e23ed714d |
RezWareUpdater.exe?ex=670cae4b&is=670b5ccb&hm=6b7767e2959bba7239b160100573375d95ac04f204f064ca6d9161caf5dd4d0e& | 2024-10-13 18:25:03 | caf83d29d4db7764696f1c225317fe16 |