RezWareUpdater.exe?ex=670cae4b&is=670b5ccb&hm=6b7767e2959bba7239b160100573375d95ac04f204f064ca6d9161caf5dd4d0e&

First submission 2024-10-13 18:25:03

File details

File type: PE32+ executable (console) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 13474.25 KB (13797632 bytes)
Compile time: 2024-10-10 19:34:17
MD5: caf83d29d4db7764696f1c225317fe16
SHA1: d6eccfffdf1558f9661ea5d3682ef81357f3de4c
SHA256: 90d1c781e275b373b9f5d719b04c228e30296564cf874b9c806da895a978c149
Import Hash : a06f302f71edd380da3d5bf4a6d94ebd
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 7/77 VT report date: 2024-10-13 17:12:00
Malware Type 1 trojan

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1293585587353419776/1293991018248536064/RezWareUpdater.exe?ex=670cae4b&is=670b5ccb&hm=6b7767e2959bba7239b160100573375d95ac04f204f064ca6d9161caf5dd4d0e& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 18:25:03

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x2b110 176640 ea200f32c9b32ca6d80cc06d709db3e6a5557f73 55ff5ed922edfe0b0c10734c674f4ee4
.rdata 0x2d000 0x12842 76288 143382e2abb9a78cf7bd9e117d95a50993807fb1 baea2bd13376f5730f42869043fccaa4
.data 0x40000 0x5408 3584 249cf6b3c95e5782a7f27c661b5f018c45d7745c aff56347f897785154c53727472c548d
.pdata 0x46000 0x22f8 9216 b5fd13ef0a20267ee6c023bcfed00a928a687dfd 57f77a295f3be6e2a8e90035dde19ce2
.rsrc 0x49000 0x4b1c 19456 2bd1ab10e109b0f82c82d8baaef3ff7a46c4ea44 cc038531547849dfae4994fe6bbae7e2
.reloc 0x4e000 0x768 2048 e599e91a866af587afec0cc6408b4eaba8188703 42d6242177dbae8e11ed5d64b87d0d48

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x490e8 17678
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x4d5f8 20
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x4d60c 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 7

GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Backup
h.oLd
Compressed
base_library.zip
bbase_library.zip
Library
mscoree.dll
vcruntime140.dll
bapi-ms-win-core-file-l1-1-0.dll
bapi-ms-win-crt-math-l1-1-0.dll
ucrtbase.dll
bapi-ms-win-core-sysinfo-l1-1-0.dll
bapi-ms-win-core-namedpipe-l1-1-0.dll
bpywin32_system32\pywintypes312.dll
bapi-ms-win-crt-string-l1-1-0.dll
bapi-ms-win-core-memory-l1-1-0.dll
bapi-ms-win-core-file-l1-2-0.dll
bapi-ms-win-core-processthreads-l1-1-1.dll
bapi-ms-win-core-interlocked-l1-1-0.dll
bapi-ms-win-core-profile-l1-1-0.dll
bapi-ms-win-core-datetime-l1-1-0.dll
bapi-ms-win-crt-utility-l1-1-0.dll
bapi-ms-win-crt-multibyte-l1-1-0.dll
bapi-ms-win-core-synch-l1-1-0.dll
bapi-ms-win-core-rtlsupport-l1-1-0.dll
bpython312.dll
bapi-ms-win-crt-locale-l1-1-0.dll
bapi-ms-win-crt-runtime-l1-1-0.dll
bapi-ms-win-crt-process-l1-1-0.dll
bapi-ms-win-core-util-l1-1-0.dll
bapi-ms-win-core-console-l1-1-0.dll
bapi-ms-win-crt-time-l1-1-0.dll
bapi-ms-win-core-file-l2-1-0.dll
bapi-ms-win-core-heap-l1-1-0.dll
bapi-ms-win-crt-environment-l1-1-0.dll
bapi-ms-win-core-timezone-l1-1-0.dll
blibffi-8.dll
bpywin32_system32\pythoncom312.dll
bapi-ms-win-core-string-l1-1-0.dll
bapi-ms-win-crt-conio-l1-1-0.dll
blibcrypto-3.dll
bapi-ms-win-crt-heap-l1-1-0.dll
bucrtbase.dll
ADVAPI32.dll
KERNEL32.dll
8python312.dll
bapi-ms-win-core-processenvironment-l1-1-0.dll
bPythonwin\mfc140u.dll
USER32.dll
bapi-ms-win-crt-convert-l1-1-0.dll
bVCRUNTIME140.dll
blibssl-3.dll
bapi-ms-win-core-debug-l1-1-0.dll
bapi-ms-win-core-processthreads-l1-1-0.dll
bapi-ms-win-crt-filesystem-l1-1-0.dll
bapi-ms-win-core-handle-l1-1-0.dll
bVCRUNTIME140_1.dll
bapi-ms-win-core-localization-l1-2-0.dll
Bapi-ms-win-core-synch-l1-2-0.dll
bpython3.dll
bapi-ms-win-core-libraryloader-l1-1-0.dll
bapi-ms-win-core-errorhandling-l1-1-0.dll
bapi-ms-win-crt-stdio-l1-1-0.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
FreeMenuF7.exe?ex=670c6a4f&is=670b18cf&hm=708940c07a26aaf3672b4ecc443356a73d7db9284ddace557e866ab656ed23b4& 2024-10-13 17:37:02 1069ade6b99d29bfe4d0526e23ed714d
oconsole.exe 2024-10-16 08:19:03 a6ff47344d0188ec4c26dc435698a477