AutoHotkey_1.1.37.02_setup.exe?ex=670cc2fb&is=670b717b&hm=570207948fb679469b7570acf604fb6812252590f27dc144fa3a5b51f3576a28&
First submission 2024-10-13 17:32:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 3345.81 KB (3426108 bytes) |
| Compile time: | 2010-11-18 19:41:55 |
| MD5: | c2e8062052bb2b25d4951b78ba9a5e73 |
| SHA1: | 947dbf6343d632fc622cc2920d0ad303c32fcc80 |
| SHA256: | 49a48e879f7480238d2fe17520ac19afe83685aac0b886719f9e1eac818b75cc |
| Import Hash : | fa4d5c869351014d1ce952f2833a7558 |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 8/77 VT report date: 2024-10-13 17:23:09 |
| Malware Type 1 | trojan |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1282753366694301779/1294738007190147205/AutoHotkey_1.1.37.02_setup.exe?ex=670cc2fb&is=670b717b&hm=570207948fb679469b7570acf604fb6812252590f27dc144fa3a5b51f3576a28&  |
cdn.discordapp.com |
2024-10-13 17:32:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x55cc | 22016 | cbf104c9872e7b62311c1545be7d60854312aa9c | c64c87c9aa464d2e806c4d837bed1860 | |
| .rdata | 0x7000 | 0x548 | 1536 | bf8fd133e895cf82d2f85f25b1134aa4fe42f76e | 456426414cb0467d180e86ee3e691e20 | |
| .data | 0x8000 | 0x220c | 512 | a5c55515bc7ac18193d84fbbec58d10bd95223cc | 19e034c032410ac04ee293cd340e2b1d | |
| .rsrc | 0xb000 | 0x58df | 23040 | fd47bea696a1be5231e1dcf614fa1285f5a11782 | c998d5f6013397bd6b94ab70290a4ec9 |
PE Resources 4
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xff48 | 1128 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x10418 | 34 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1043c | 460 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x10608 | 727 |
Meta infos 5
| Translation: | 0x0409 0x04b0 |
| FileVersion: | 1.1.37.02 |
| FileDescription: | AutoHotkey Setup |
| ProductVersion: | 1.1.37.02 |
| ProductName: | AutoHotkey |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 1
| GetLastError |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| SHELL32.dll |
| USER32.dll |
| KERNEL32.dll |
| MSVCRT.dll |