shell.exe

First submission 2022-08-03 10:23:02

File details

File type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
File type: 24.5 KB (25088 bytes)
Compile time: 2022-08-02 21:29:56
MD5: bb0edcf312622f518415b85deec29be4
SHA1: 72bce426b56988b225862cc6611abb53150bfbc6
SHA256: 3ae4fa96ff3527bf4ea380cbcab19b7e9b0d77c3596d08f74b18b7b843ead231
Import Hash : 45d51bb2a26e8506fa017fe49072c102
Sections 9 .text .data .rdata .pdata .xdata .bss .idata .CRT .tls
Directories 2 import tls
Virus Total: 23/71 VT report date: 2022-08-03 07:26:59

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 2

URL Host (FQDN/IP) Date Added
hXXp://146.70.24.168/load/shell.exe VirusTotal Report 146.70.24.168 VirusTotal Report 2022-08-03 10:23:02
hXXps://dexpsystem.com/load/shell.exe VirusTotal Report dexpsystem.com VirusTotal Report 2022-08-03 10:44:08

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x3358 13312 7ca96e9ea8c33bba048b9e5a5e6b8092497a0230 c19c43b0c17194eb20853cebbe4ae00d
.data 0x5000 0x8f0 2560 78200ea73401df100c0cceac30cb466f663449fb 0d78fb1cb5ed111fb4f1d31172220122
.rdata 0x6000 0xac0 3072 276c13be71d6f49c19d6521dfb5b147e2d4fb0bc 892657c4664ebc62883b51b68dea3e2a
.pdata 0x7000 0x354 1024 f7fad08965ec22c9c2669dba141167c8ec175926 f4237906f3aa5943d75b279487b63772
.xdata 0x8000 0x2e4 1024 04042cd3a7b62b5b514f480748758c9fb8f72088 c19289d966fa50664f8a75f5290790b7
.bss 0x9000 0x980 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0xa000 0x7d0 2048 276edf1e8c21e23e2ad949a9f747dfbd7e562b9a 87cff7a3bdfeb1c79ed2b0c573285e52
.CRT 0xb000 0x68 512 4556102cc0d661eee8459f1baf6b3fbbbe0565d7 f9a73e50eee67fba2392e0e8c992c120
.tls 0xc000 0x10 512 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 bf619eac0cdf3f68d496ea9344137e8b

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)

Anti debug functions 3

GetLastError
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Library
KERNEL32.dll
MSVCRT.dll

Import functions