167.exe
First submission 2023-09-14 12:53:03
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 196.5 KB (201216 bytes) |
| Compile time: | 2022-06-21 06:24:27 |
| MD5: | a8ef33f60772ebeeeeb85eb64403265c |
| SHA1: | cb166d55759c53538bd4a5a2dfd722ee174fe857 |
| SHA256: | 60514c1c51b359839c67819246b09fbd861afa3ff772ad93bf466fc3acab642d |
| Import Hash : | 0da159e8cafbc91f7a91683e99c0a805 |
| Sections 4 | .text .data .rsrc .reloc |
| Directories 4 | import resource debug relocation |
| Virus Total: | 28/71 VT report date: 2023-09-14 10:03:42 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://h170690.srv22.test-hf.su/167.exe  |
h170690.srv22.test-hf.su |
2023-09-14 12:53:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x23bae | 146432 | a43f6e003472d4238a42ef679e649bb404baa280 | 9580583924aa958b0d71869856eb03ce | |
| .data | 0x25000 | 0x4fec8 | 11776 | cc918d742a83add90cf93ed1fdf4cdbcc7ac4d8c | 91ec27707a1e4f027731350fc1b993e4 | |
| .rsrc | 0x75000 | 0x1b5770 | 34816 | dffa61480e1314799e0a3e9bc14a9bed4604360e | 231a530d29c6b57319c5d85c58a3d04d | |
| .reloc | 0x22b000 | 0x1a4e | 7168 | 5be985e22b092dadf3d2753cbef1f4ef8c2e75c9 | d18b6d35efd1c2345675b526a374c63c |
PE Resources 6
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x7bbd8 | 1384 | |
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x78100 | 1128 | |
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x7d130 | 1596 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x7c140 | 48 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x78568 | 48 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x7c170 | 620 |
Meta infos 7
| LegalCopyright: | Copyright (C) 2022, Uniqum |
| ProductionVersion: | 82.67.62.16 |
| FileDescription: | Silvuple |
| Translation: | 0x08bf 0x0ad5 |
| ProductsVersion: | 9.50.2.69 |
| OriginalFilename: | petshop.exe |
| ProductName: | Kuihmfghni |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| KERNEL32.dll |
| mscoree.dll |
| USER32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 2
| 82.67.62.16 |
| 9.50.2.69 |