7120.exe
First submission 2023-09-13 01:51:03
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
Mime type: | application/x-dosexec |
File size: | 254.45 KB (260552 bytes) |
Compile time: | 2015-02-15 09:00:31 |
MD5: | a8e200f1e66467d25a0a961fa69f9cbd |
SHA1: | d74ca44189fde53b1358977feed32cc1ae50ea79 |
SHA256: | 8d25031c713f945e26935953121ab7db9f3d71b60ce75d2a89284697426fc20a |
Import Hash : | 4cfda23baf1e2e983ddfeca47a5c755a |
Sections 4 | .text .rdata .data .rsrc |
Directories 5 | import export resource debug security |
Virus Total: | 2/70 VT report date: 2023-06-09 09:53:51 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
PE Sections 0 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x2878a | 165888 | ef43287f9744999877f97b0a4d6deae1c45995aa | d06d79869523ea3421d1bec81acb4dd3 | |
.rdata | 0x2a000 | 0x4fd3 | 20480 | 7cdb74324a6c4fd72aea036499c57b649fd308bb | ae7c16bd625a124b8fbf6ecc9002c4ff | |
.data | 0x2f000 | 0x21428 | 5632 | 95db54c6548fd28cb2d56c25c6226b18869cfe33 | 6754819d963e719555064632286f5a0d | |
.rsrc | 0x51000 | 0x44d8 | 17920 | 2cbb082e270d01816951f35f54f151f2cbeb8d10 | 6aa2cae10e88f53028dea6fff76be49b |
PE Resources 6
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_BITMAP | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x5154c | 2998 | |
RT_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x52a7c | 2216 | |
RT_DIALOG | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x539bc | 462 | |
RT_STRING | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x54250 | 74 | |
RT_GROUP_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x5429c | 62 | |
RT_MANIFEST | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x542dc | 1738 |
Packers detected 2
Microsoft Visual C++ 8 |
VC8 -> Microsoft Corporation |
Anti debug functions 6
FindWindowExW |
GetLastError |
IsDebuggerPresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
File signature
MD5 | SHA1 | Block size | Virtual Address |
---|---|---|---|
46e063ea3fe41395f3b8903716790a99 | 8515eb98b211169180fe4b52f96f94e80a832ffe | 6232 | 254320 |
Strings analysis - File found
Temporary |
%s.%d.tmp |
winrarsfxmappingfile.tmp |
Data |
version.dat |
Library |
KERNEL32.dll |
Crypt32.dll |
riched32.dll |
riched20.dll |
mscoree.dll |
ADVAPI32.dll |
SHLWAPI.dll |
SHELL32.dll |
OLEAUT32.dll |
USER32.dll |
COMCTL32.dll |
COMDLG32.dll |
ole32.dll |
GDI32.dll |
Strings analysis - Possible URLs found 15
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0( |
http://ts-ocsp.ws.symantec.com07 |
http://ocsp.digicert.com0C |
http://crl.thawte.com/ThawteTimestampingCA.crl0 |
http://ocsp.digicert.com0N |
http://crl3.digicert.com/sha2-assured-cs-g1.crl05 |
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: |
http://ocsp.thawte.com0 |
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O |
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 |
http://schemas.microsoft.com/SMI/2005/WindowsSettings |
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L |
http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0 |
https://www.digicert.com/CPS0 |
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0< |