pub1.exe
First submission 2023-09-13 12:12:03
Last sumbission 2023-09-13 12:13:03
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 298.5 KB (305664 bytes) |
| Compile time: | 2022-08-19 10:29:38 |
| MD5: | b54e64a6057aebaffb2329e0f8e5bc85 |
| SHA1: | 51a101d7b31a8718968280b50aca05b597fb2fa9 |
| SHA256: | a2260ac65c2814e6a0e7b839474a298333f2a4a7ac60af12861dcc9edf5a6019 |
| Import Hash : | 6d41cb748e4d1fea5be7cc98b4681858 |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
| Virus Total: | 32/71 VT report date: 2023-09-13 10:06:58 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://login-sofi.4dq.com/tmp/tmp/pub1.exe  |
login-sofi.4dq.com |
2023-09-13 12:12:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2015c | 131584 | bd2b1fa9082f7fadd759b6fa90d907bf62c6bcaf | b7abafd03c58873d3739deb30842a34d | |
| .data | 0x22000 | 0x1ebbd2c | 92160 | 648574c740047532060b0e4ac3944443fb1683c3 | e0a3e17c00499adf63b6a1fbc72e44c2 | |
| .rsrc | 0x1ede000 | 0x13b58 | 80896 | b341dcc3c8970d66e95678b20e7b0cfb21b2978d | 5f63e41df90bbf3457207af689d4754e |
PE Resources 6
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1ef0468 | 2216 | |
| RT_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x1eeff98 | 1128 | |
| RT_STRING | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x1ef1958 | 512 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1ef0d10 | 20 | |
| RT_GROUP_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x1ef0400 | 104 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1ef0d28 | 632 |
Meta infos 8
| InternalName: | Superior.exe |
| FileVersions: | 42.51.49 |
| LegalCopyrights: | Challangers bojala |
| CompanyName: | Thunderstuck |
| ProductVersion: | 57.5.34.0 |
| FileDescriptions: | Anybodies |
| Translation: | 0x124e 0x043a |
| ProductName: | Bonni |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| USER32.dll |
| GDI32.dll |