demon.x641.exe

First submission 2024-10-17 18:32:03

File details

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Mime type:	application/x-dosexec
File size:	100.0 KB (102400 bytes)
Compile time:	2024-09-17 20:07:43
MD5:	c2649b34f50484344a60cee642baa697
SHA1:	950653e79ac2fa2d10fcd31a7dd973d02896419e
SHA256:	b646ecc8fbd94b4b583cc46ed8443bf2e6596095ff087a5591abf0f9fb1b6fb3
Sections 6	.text .data .rdata .edata .idata .reloc
Directories 3	import export relocation

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

OSINT Enrichments

Virus Total:	36/77 VT report date: 2024-10-11 15:04:29
Malware Type 1	trojan
Threat Type 3	havoc havokiz marte

URLs, FQDN and IP indicators 1

URL	Host (FQDN/IP)	Date Added
hXXp://169.1.16.29/demon.x641.exe	169.1.16.29	2024-10-17 18:32:03

PE Sections 1 suspicious

Name	VAddress	VSize	Size	SHA1	MD5	Suspicious
.text	0x1000	0x17680	96256	afc3aa75e813d0e5c80139add99e39ef88036817	ce967e38392020a6072f57795a2ec815
.data	0x19000	0x960	2560	b7446d196825b6b5f56f7464940f7edf0d00a041	18753ac5ab16084d39ccfe944d2bc13e
.rdata	0x1a000	0x2e0	1024	6875c4a2c7a370f1124d023ff0446fe6757b03ce	f2d3e05b699537879063e0a2e221085a
.edata	0x1b000	0x36	512	5339f84e5adc5561d006f7762b525e757a762785	423620111dcbc5dea952df09f5633655
.idata	0x1c000	0x14	512	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5	bf619eac0cdf3f68d496ea9344137e8b
.reloc	0x1d000	0xec	512	a7c573119b1d44a2f7ae3879a848bb43db84cdb3	285bb24486a4bb73835695c37bba67b2

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)