77.exe
First submission 2022-08-03 20:13:01
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| File type: | 462.5 KB (473600 bytes) |
| Compile time: | 2022-02-09 19:22:02 |
| MD5: | b4c7966345974a5554e5d99fa2800297 |
| SHA1: | 933fc5cfd4500f0e755a9e7f5adff60494887abd |
| SHA256: | 4dbc705f8b2459cd330ba96aac1462ffef090bbb55c6305e49397db8caafeff7 |
| Import Hash : | 029a987f21e33b48f24d21b6f9ff1129 |
| Sections 7 | .text .rdata .data .tls .gfids .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
| Virus Total: | 56/71 VT report date: 2022-08-03 16:07:25 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://jg.studio/77.exe  |
jg.studio |
2022-08-03 20:13:01 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x52aed | 338944 | de59e4ca964512050b041a15ae81756d711c8313 | 22ca55e1b948eef6d8eaa74c178eb61c | |
| .rdata | 0x54000 | 0x16fb4 | 94208 | 352f6a2ff2e34506e7d6759af55eaa9aeda3f7b1 | 58738501e97e6c76ea591261c4b943d8 | |
| .data | 0x6b000 | 0x3eec | 3584 | a069a2cddd54faf4620819c79e6b50ab370798cb | 90efd231c85fb53e2e544c3917cc650c | |
| .tls | 0x6f000 | 0x9 | 512 | aa0d33a0c854e073439067876e932688b65cb6a9 | 1f354d76203061bfdd5a53dae48d5435 | |
| .gfids | 0x70000 | 0x230 | 1024 | 543908de16087fdc46fd32bba746b043f69effd0 | 68b4acc15e6a4d63a54be2808ea37520 | |
| .rsrc | 0x71000 | 0x4bc4 | 19456 | ec5f35d169351118c971d1981e80f55cef17521c | 1c88c0b845bd21b8b5c260eadf5c37d5 | |
| .reloc | 0x76000 | 0x3884 | 14848 | 3bc93ba4ff3fd609d08cb71ba1f2459349330701 | 3eea2222f194b26e650b5b689079235b |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ITALIAN | SUBLANG_ITALIAN | 0x73024 | 9640 | |
| RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x755cc | 1461 | |
| RT_GROUP_ICON | LANG_ITALIAN | SUBLANG_ITALIAN | 0x75b84 | 62 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 9
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Database |
| \key3.db |
| Text |
| \sysinfo.txt |
| license_code.txt |
| Library |
| mscoree.dll |
| KERNEL32.dll |
| SHLWAPI.dll |
| WINMM.dll |
| ADVAPI32.dll |
| ntdll.dll |
| WS2_32.dll |
| USER32.dll |
| PSAPI.DLL |
| SHELL32.dll |
| Powrprof.dll |
| gdiplus.dll |
| urlmon.dll |
| GDI32.dll |