gawdth.exe
First submission 2024-07-26 01:49:02
Last sumbission 2024-09-02 00:31:29
File details
File type: | PE32+ executable (GUI) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 898.81 KB (920382 bytes) |
Compile time: | 2024-05-12 12:17:07 |
MD5: | c02798b26bdaf8e27c1c48ef5de4b2c3 |
SHA1: | bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615 |
SHA256: | af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78 |
Import Hash : | b1c5b1beabd90d9fdabd1df0779ea832 |
Sections 8 | .text .rdata .data .pdata .didat _RDATA .rsrc .reloc |
Directories 6 | import export resource debug tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
Virus Total: | 34/79 VT report date: 2024-07-25 23:58:05 |
Malware Type 3 | trojan dropper spyware |
Threat Type 1 | graftor |
URLs, FQDN and IP indicators 1
PE Sections 0 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x4676e | 288768 | 278d421b8fcce5071cdb55190b5a29b42bdf8201 | f06bb06e02377ae8b223122e53be35c2 | |
.rdata | 0x48000 | 0x128c4 | 76288 | 3114d29305d4b88fffea6ad50b3704072be27858 | 2de06d4a6920a6911e64ff20000ea72f | |
.data | 0x5b000 | 0xe75c | 6656 | a1ae38ef93496365ab03cd8e1b3098ca6ac430e0 | 0dbdb901a7d477980097e42e511a94fb | |
.pdata | 0x6a000 | 0x306c | 12800 | e0cde833721b87c288e4dbf07c14d46d8670d708 | b0ce0f057741ad2a4ef4717079fa34e9 | |
.didat | 0x6e000 | 0x360 | 1024 | 190f8d2fea268d844623189351a02d25e6bedfff | 1fcc7b1d7a02443319f8fcc2be4ca936 | |
_RDATA | 0x6f000 | 0x15c | 512 | 8d13993151b09d8343303215408e337388130e61 | 3f331ec50f09ba861beaf955b33712d5 | |
.rsrc | 0x70000 | 0xff7c | 65536 | 5f2ce9aee06fb8dbc4a8eb14d730c52b98bd3602 | 7cc0e4178407044344713ed68f887c23 | |
.reloc | 0x80000 | 0x970 | 2560 | b8c49df878d332ebd45f8be315a23f5d1c7402bf | 77a9ddfc47a5650d6eebbcc823e39532 |
PE Resources 6
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
PNG | LANG_RUSSIAN | SUBLANG_NEUTRAL | 0x711ec | 5545 | |
RT_ICON | LANG_NEUTRAL | SUBLANG_DEFAULT | 0x7d394 | 1128 | |
RT_DIALOG | LANG_RUSSIAN | SUBLANG_NEUTRAL | 0x7e148 | 586 | |
RT_STRING | LANG_RUSSIAN | SUBLANG_NEUTRAL | 0x7f548 | 616 | |
RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_DEFAULT | 0x7f7b0 | 118 | |
RT_MANIFEST | LANG_RUSSIAN | SUBLANG_NEUTRAL | 0x7f828 | 1875 |
Packers detected 1
Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 6
GetLastError |
IsDebuggerPresent |
IsProcessorFeaturePresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Temporary |
winrarsfxmappingfile.tmp |
Library |
Crypt32.dll |
peerdist.dll |
msasn1.dll |
profapi.dll |
api-ms-win-core-synch-l1-2-0.dll |
RpcRtRemote.dll |
sfc_os.dll |
XmlLite.dll |
USERENV.dll |
ntmarta.dll |
rasadhlp.dll |
mscoree.dll |
mlang.dll |
cryptsp.dll |
linkinfo.dll |
UxTheme.dll |
imageres.dll |
VERSION.dll |
cscapi.dll |
usp10.dll |
wkscli.dll |
devrtl.dll |
secur32.dll |
wintrust.dll |
atl.dll |
WINNSI.DLL |
rsaenh.dll |
riched20.dll |
cryptui.dll |
ntshrui.dll |
slc.dll |
oleaccrc.dll |
PSAPI.DLL |
propsys.dll |
KERNEL32.dll |
NETAPI32.dll |
aclui.dll |
dhcpcsvc6.dll |
cryptbase.dll |
ws2help.dll |
SHELL32.dll |
samlib.dll |
shdocvw.dll |
dwmapi.dll |
cabinet.dll |
MPR.dll |
WS2_32.dll |
WindowsCodecs.dll |
dnsapi.dll |
SSPICLI.DLL |
samcli.dll |
apphelp.dll |
dfscli.dll |
dsrole.dll |
ieframe.dll |
lpk.dll |
comres.dll |
netutils.dll |
clbcatq.dll |
dhcpcsvc.dll |
IPHLPAPI.DLL |
srvcli.dll |
DXGIDebug.dll |
browcli.dll |
SETUPAPI.dll |
Fole32.dll |
ADVAPI32.dll |
GDI32.dll |
COMDLG32.dll |
OLEAUT32.dll |
USER32.dll |
SHLWAPI.dll |
COMCTL32.dll |
gdiplus.dll |
Strings analysis - Possible URLs found 1
http://schemas.microsoft.com/SMI/2005/WindowsSettings |
Import functions
Name | Latest seen | MD5 |
---|---|---|
a.exe | 2024-05-26 01:26:02 | 5c95d5493dda877b228a6485a6d40d9c |
csrss.exe | 2024-05-30 10:24:06 | 1eaae465bda927c1893a5744301cde9b |
lrthijawd.exe | 2024-06-14 16:06:02 | 1b1ecd323162c054864b63ada693cd71 |
kfiwarhg.exe | 2024-06-14 16:30:14 | 7d44a8a6757c2b7287c4a7b761f4e326 |
4x.exe | 2024-06-07 14:16:02 | c8432b773d48e5e0a9f2d1ecb7c557f8 |
motruhjgmawes.exe | 2024-06-14 16:49:08 | 57a6a83482ce2897e8cdec17accbd662 |
potkmdaw.exe | 2024-07-12 12:39:02 | cefc3739d099bae51eb2a9d3887ac12c |
live3.exe | 2024-07-20 05:58:04 | 9fe68af3f2db3c8428035cabfccafd04 |
live.exe | 2024-07-20 07:37:04 | deb7f0871db1a1ad70b0ec844efc51d1 |
jsawdtyjde.exe | 2024-08-25 14:04:02 | 4c3049f8e220c2264692cb192b741a30 |
uhigdbf.exe | 2024-09-02 03:07:02 | eeecdefa939b534bc8f774a15e05ab0f |