PaoNan.exe
First submission 2024-10-15 18:19:10
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 6904.0 KB (7069696 bytes) |
Compile time: | 2024-09-30 09:42:19 |
MD5: | ad7ab8cf90ee085da0456ac6a3545e98 |
SHA1: | a707ef7f0cbfc1d5068fce98dae86a5725baffb1 |
SHA256: | 471bdc7c0339be20bc01228e7c940817e75c06c95b7580061d710e30f27304ec |
Import Hash : | 353c113841e7e944253367e47591e0a8 |
Sections 4 | .text .rdata .data .rsrc |
Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
Virus Total: | 49/77 VT report date: 2024-10-10 03:50:29 |
Malware Type 2 | trojan pua |
Threat Type 2 | flystudio jaik |
URLs, FQDN and IP indicators 1
PE Sections 1 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x111573 | 1122304 | 0431bb06bcf425566aa8396f56e0124d78e00593 | 89ce89c91b1df40acbd8bd9d433b23fa | |
.rdata | 0x113000 | 0x580836 | 5771264 | 862f7bfecdbd8117f4912bb8a9f48783e6d3c7f3 | 8bb81c6d3c1d564fd8a057281fb55914 | |
.data | 0x694000 | 0x5f708 | 135168 | 624a840d79b087319278f5f343d40f95ae7c8673 | ff72ab0c9f2db18d507f660e833cf543 | |
.rsrc | 0x6f4000 | 0x8e30 | 36864 | 1aa996a34f80af23c911abd4f7dff330d33b973c | 5c4f135051334fdbe1e504a2058eb269 |
PE Resources 12
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
TEXTINCLUDE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6f4dc0 | 337 | |
WAVE | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6f4f14 | 5192 | |
RT_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6f68e0 | 308 | |
RT_BITMAP | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6f81d4 | 324 | |
RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x6f8728 | 9640 | |
RT_MENU | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6facdc | 644 | |
RT_DIALOG | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6fbf24 | 396 | |
RT_STRING | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6fc96c | 36 | |
RT_GROUP_CURSOR | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6fc9e0 | 34 | |
RT_GROUP_ICON | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6fca2c | 20 | |
RT_VERSION | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 0x6fca40 | 544 | |
RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x6fcc60 | 461 |
Meta infos 8
LegalCopyright: | \x8dd1\x7537\x793e\x56e2 |
FileVersion: | 1.0.0.0 |
CompanyName: | By\x5c0f\x4f1f |
ProductVersion: | 1.0.0.0 |
FileDescription: | \x8dd1\x7537\x793e\x56e2 |
Translation: | 0x0804 0x04b0 |
Comments: | \x8dd1\x7537\x793e\x56e2 |
ProductName: | \x8dd1\x7537\x793e\x56e2 |
Packers detected 3
Microsoft Visual C++ v6.0 |
Microsoft Visual C++ 5.0 |
Microsoft Visual C++ |
Anti debug functions 4
GetLastError |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Anti debug functions 1
VMCheck.dll |
Strings analysis - File found
Temporary |
_update.tmp |
\update.tmp |
\_update.tmp |
Object |
y.OCX |
Library |
- Skin.dll |
SkinH_EL.dll |
mscoree.dll |
dbghelp.dll |
VGuard.dll |
ADVAPI32.dll |
COMCTL32.dll |
MSIMG32.dll |
WININET.dll |
etcp.dll |
KERNEL32.dll |
USER32.dll |
sw.dll |
OLEAUT32.dll |
SHLWAPI.dll |
MPR.dll |
UxTheme.dll |
gdiplus.dll |
ntdll.dll |
hw.dll |
MSVCRT.dll |
WS2_32.dll |
\hw.dll |
filesystem_stdio.dll |
SHELL32.dll |
imagehlp.dll |
WINMM.dll |
COMDLG32.dll |
PSAPI.DLL |
GDI32.dll |
Uhw.dll |
IMM32.dll |
urlmon.dll |
WSOCK32.dll |
oledlg.dll |
ole32.dll |
Crypt32.dll |
AVIFIL32.dll |
OPENGL32.dll |
MSVFW32.dll |
Strings analysis - Possible IPs found 1
1.0.0.1 |
Strings analysis - Possible URLs found 4
http://paonancs.oss-cn-shenzhen.aliyuncs.com/config.json?time= |
http:// |
https:// |
http://www.cs27015.com |