PaoNan.exe

First submission 2024-10-15 18:19:10

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 6904.0 KB (7069696 bytes)
Compile time: 2024-09-30 09:42:19
MD5: ad7ab8cf90ee085da0456ac6a3545e98
SHA1: a707ef7f0cbfc1d5068fce98dae86a5725baffb1
SHA256: 471bdc7c0339be20bc01228e7c940817e75c06c95b7580061d710e30f27304ec
Import Hash : 353c113841e7e944253367e47591e0a8
Sections 4 .text .rdata .data .rsrc
Directories 2 import resource

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 49/77 VT report date: 2024-10-10 03:50:29
Malware Type 2 trojan pua
Threat Type 2 flystudio jaik

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://paonancs.cn/PaoNan.exe VirusTotal Report paonancs.cn VirusTotal Report 2024-10-15 18:19:10

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x111573 1122304 0431bb06bcf425566aa8396f56e0124d78e00593 89ce89c91b1df40acbd8bd9d433b23fa
.rdata 0x113000 0x580836 5771264 862f7bfecdbd8117f4912bb8a9f48783e6d3c7f3 8bb81c6d3c1d564fd8a057281fb55914
.data 0x694000 0x5f708 135168 624a840d79b087319278f5f343d40f95ae7c8673 ff72ab0c9f2db18d507f660e833cf543
.rsrc 0x6f4000 0x8e30 36864 1aa996a34f80af23c911abd4f7dff330d33b973c 5c4f135051334fdbe1e504a2058eb269

PE Resources 12

Name Language Sublanguage Offset Size Data
TEXTINCLUDE LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6f4dc0 337
WAVE LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6f4f14 5192
RT_CURSOR LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6f68e0 308
RT_BITMAP LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6f81d4 324
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x6f8728 9640
RT_MENU LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6facdc 644
RT_DIALOG LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6fbf24 396
RT_STRING LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6fc96c 36
RT_GROUP_CURSOR LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6fc9e0 34
RT_GROUP_ICON LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6fca2c 20
RT_VERSION LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x6fca40 544
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x6fcc60 461

Meta infos 8

LegalCopyright: \x8dd1\x7537\x793e\x56e2
FileVersion: 1.0.0.0
CompanyName: By\x5c0f\x4f1f
ProductVersion: 1.0.0.0
FileDescription: \x8dd1\x7537\x793e\x56e2
Translation: 0x0804 0x04b0
Comments: \x8dd1\x7537\x793e\x56e2
ProductName: \x8dd1\x7537\x793e\x56e2

Packers detected 3

Microsoft Visual C++ v6.0
Microsoft Visual C++ 5.0
Microsoft Visual C++

Anti debug functions 4

GetLastError
RaiseException
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 1

VMCheck.dll

Strings analysis - File found

Temporary
_update.tmp
\update.tmp
\_update.tmp
Object
y.OCX
Library
- Skin.dll
SkinH_EL.dll
mscoree.dll
dbghelp.dll
VGuard.dll
ADVAPI32.dll
COMCTL32.dll
MSIMG32.dll
WININET.dll
etcp.dll
KERNEL32.dll
USER32.dll
sw.dll
OLEAUT32.dll
SHLWAPI.dll
MPR.dll
UxTheme.dll
gdiplus.dll
ntdll.dll
hw.dll
MSVCRT.dll
WS2_32.dll
\hw.dll
filesystem_stdio.dll
SHELL32.dll
imagehlp.dll
WINMM.dll
COMDLG32.dll
PSAPI.DLL
GDI32.dll
Uhw.dll
IMM32.dll
urlmon.dll
WSOCK32.dll
oledlg.dll
ole32.dll
Crypt32.dll
AVIFIL32.dll
OPENGL32.dll
MSVFW32.dll

Strings analysis - Possible IPs found 1

1.0.0.1

Strings analysis - Possible URLs found 4

http://paonancs.oss-cn-shenzhen.aliyuncs.com/config.json?time=
http://
https://
http://www.cs27015.com

Import functions