7120.exe

First submission 2023-09-13 01:51:03

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Mime type: application/x-dosexec
File size: 254.45 KB (260552 bytes)
Compile time: 2015-02-15 09:00:31
MD5: a8e200f1e66467d25a0a961fa69f9cbd
SHA1: d74ca44189fde53b1358977feed32cc1ae50ea79
SHA256: 8d25031c713f945e26935953121ab7db9f3d71b60ce75d2a89284697426fc20a
Import Hash : 4cfda23baf1e2e983ddfeca47a5c755a
Sections 4 .text .rdata .data .rsrc
Directories 5 import export resource debug security
Virus Total: 2/70 VT report date: 2023-06-09 09:53:51

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://184.175.115.10/enzf/7120.exe VirusTotal Report 184.175.115.10 VirusTotal Report 2023-09-13 01:51:03

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x2878a 165888 ef43287f9744999877f97b0a4d6deae1c45995aa d06d79869523ea3421d1bec81acb4dd3
.rdata 0x2a000 0x4fd3 20480 7cdb74324a6c4fd72aea036499c57b649fd308bb ae7c16bd625a124b8fbf6ecc9002c4ff
.data 0x2f000 0x21428 5632 95db54c6548fd28cb2d56c25c6226b18869cfe33 6754819d963e719555064632286f5a0d
.rsrc 0x51000 0x44d8 17920 2cbb082e270d01816951f35f54f151f2cbeb8d10 6aa2cae10e88f53028dea6fff76be49b

PE Resources 6

Name Language Sublanguage Offset Size Data
RT_BITMAP LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x5154c 2998
RT_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x52a7c 2216
RT_DIALOG LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x539bc 462
RT_STRING LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x54250 74
RT_GROUP_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x5429c 62
RT_MANIFEST LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x542dc 1738

Packers detected 2

Microsoft Visual C++ 8
VC8 -> Microsoft Corporation

Anti debug functions 6

FindWindowExW
GetLastError
IsDebuggerPresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

File signature

MD5 SHA1 Block size Virtual Address
46e063ea3fe41395f3b8903716790a99 8515eb98b211169180fe4b52f96f94e80a832ffe 6232 254320

Strings analysis - File found

Temporary
%s.%d.tmp
winrarsfxmappingfile.tmp
Data
version.dat
Library
KERNEL32.dll
Crypt32.dll
riched32.dll
riched20.dll
mscoree.dll
ADVAPI32.dll
SHLWAPI.dll
SHELL32.dll
OLEAUT32.dll
USER32.dll
COMCTL32.dll
COMDLG32.dll
ole32.dll
GDI32.dll

Strings analysis - Possible URLs found 15

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
http://ts-ocsp.ws.symantec.com07
http://ocsp.digicert.com0C
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ocsp.digicert.com0N
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
http://ocsp.thawte.com0
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
https://www.digicert.com/CPS0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

Import functions