jhi_service.exe?ex=670d5ac7&is=670c0947&hm=8040a71b6195be0a4bb8815c2b285cadd27cbb211cf3a1979bff35665ba406ab&
First submission 2024-10-14 16:45:01
File details
| File type: | PE32+ executable (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 2692.5 KB (2757120 bytes) |
| Compile time: | 2024-06-16 10:43:27 |
| MD5: | cb48a79950590f0987d41cb73dcddf38 |
| SHA1: | 2063880164512a3e8951b2afbdf3cacff28ff4ee |
| SHA256: | 666590998dcbe7e07faf9f0fd979c2ded2f53da266be7572ecca07494c41dab3 |
| Import Hash : | 8c0bb638471d37b47999c4805855f817 |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 51/78 VT report date: 2024-10-14 12:32:50 |
| Malware Type 3 | trojan downloader dropper |
| Threat Type 3 | lazy cryptinject r002c0dg724 |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1140299281308340345/1279680705324122152/jhi_service.exe?ex=670d5ac7&is=670c0947&hm=8040a71b6195be0a4bb8815c2b285cadd27cbb211cf3a1979bff35665ba406ab&  |
cdn.discordapp.com |
2024-10-14 16:45:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xb3210 | 734208 | e1fa5ffe8d1fadefdae9edd97c5f4082809a0032 | abce5d377cb03ffd35606a13c6efe146 | |
| .rdata | 0xb5000 | 0x5b1d8 | 373248 | 71d183499f0ca10c3aeaa0fb93c940bfd9183acf | 9812aecdf1afff10fa2623cce3e69b28 | |
| .data | 0x111000 | 0x18bec0 | 1615872 | 7b7a81715b3ae3713352f1d9337d20ad5daa9830 | 5d641341f9d8c34a4b970867db73d851 | |
| .pdata | 0x29d000 | 0x7488 | 30208 | e9402840bed6b2b9edc4031e2f84795e84cb649e | fe71f5c0b1834be8500fdb26bf5b941d | |
| .rsrc | 0x2a5000 | 0x1e8 | 512 | 11c5d8987f23e6d53f296a1d55fab4265fcf15e9 | 743435a9b6f8db207af97cfcd855a20d | |
| .reloc | 0x2a6000 | 0x6f0 | 2048 | 1ff12843006b4872907f0bc8bd3d5f0d44935a1b | 2a155ef24c50b3b85e159b04ffbf052f |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2a5060 | 392 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 10
| FindWindowA |
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| Process32FirstW |
| Process32NextW |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Temporary |
| %s.%s.tmp |
| Data |
| *.dat |
| Library |
| ADVAPI32.dll |
| rpcrt4.dll |
| SHELL32.dll |
| VCRUNTIME140_1.dll |
| USER32.dll |
| api-ms-win-crt-convert-l1-1-0.dll |
| xinput1_3.dll |
| KERNEL32.dll |
| vcruntime140.dll |
| api-ms-win-crt-filesystem-l1-1-0.dll |
| api-ms-win-crt-math-l1-1-0.dll |
| api-ms-win-crt-utility-l1-1-0.dll |
| secur32.dll |
| d3dx9_43.dll |
| WS2_32.dll |
| WLDAP32.dll |
| api-ms-win-crt-locale-l1-1-0.dll |
| xinput1_1.dll |
| xinput1_4.dll |
| IPHLPAPI.DLL |
| d3d9.dll |
| security.dll |
| api-ms-win-crt-string-l1-1-0.dll |
| PSAPI.DLL |
| xinput9_1_0.dll |
| api-ms-win-crt-time-l1-1-0.dll |
| USERENV.dll |
| api-ms-win-crt-heap-l1-1-0.dll |
| api-ms-win-crt-stdio-l1-1-0.dll |
| COMDLG32.dll |
| IMM32.dll |
| xinput1_2.dll |
| normaliz.dll |
| Crypt32.dll |
| api-ms-win-crt-runtime-l1-1-0.dll |
| msvcp140.dll |
Strings analysis - Possible IPs found 26
| 127.0.0.1 |
| 2.5.4.8 |
| 2.5.4.9 |
| 2.5.4.6 |
| 2.5.4.7 |
| 2.5.4.4 |
| 2.5.4.5 |
| 2.5.4.3 |
| 2.5.4.72 |
| 2.5.4.10 |
| 2.5.4.11 |
| 2.5.4.12 |
| 2.5.4.13 |
| 2.5.4.17 |
| 1.3.14.3 |
| 2.5.4.45 |
| 101.3.4.2 |
| 2.5.4.44 |
| 2.5.4.65 |
| 2.5.29.17 |
| 2.5.4.46 |
| 2.5.29.18 |
| 2.5.29.19 |
| 2.5.4.43 |
| 2.5.4.42 |
| 2.5.4.41 |
Strings analysis - Possible URLs found 17
| http://scripts.sil.org/OFLThis |
| https://fontawesome.com |
| https://curl.haxx.se/docs/http-cookies.html |
| ftp://%s:%s@%s |
| file:// |
| http://purl.org/dc/elements/1.1/ |
| http://scripts.sil.org/OFLwww.katatrad.comwww.cadsondemak.comThanarat |
| http://www.w3.org/1999/02/22-rdf-syntax-ns# |
| file://%s%s%s |
| http://ns.adobe.com/xap/1.0/mm/ |
| http://ns.adobe.com/xap/1.0/sType/ResourceEvent# |
| http://ns.adobe.com/tiff/1.0/ |
| https://shyproduct.xdnz.xyz/ |
| http://ns.adobe.com/xap/1.0/sType/ResourceRef# |
| http://ns.adobe.com/photoshop/1.0/ |
| http://ns.adobe.com/xap/1.0/ |
| http://ns.adobe.com/exif/1.0/ |
Import functions
COMDLG32.dll 1
MSVCP140.dll 61
CRYPT32.dll 16
KERNEL32.dll 89
d3dx9_43.dll 1
api-ms-win-crt-locale-l1-1-0.dll 3
api-ms-win-crt-filesystem-l1-1-0.dll 6
api-ms-win-crt-math-l1-1-0.dll 10
api-ms-win-crt-utility-l1-1-0.dll 3
VCRUNTIME140.dll 15
PSAPI.DLL 1
USER32.dll 39
IMM32.dll 3
api-ms-win-crt-string-l1-1-0.dll 10
VCRUNTIME140_1.dll 1
api-ms-win-crt-runtime-l1-1-0.dll 29
api-ms-win-crt-convert-l1-1-0.dll 6
SHELL32.dll 2
RPCRT4.dll 3
api-ms-win-crt-stdio-l1-1-0.dll 32
d3d9.dll 1
USERENV.dll 1
api-ms-win-crt-time-l1-1-0.dll 2
WLDAP32.dll 18
api-ms-win-crt-heap-l1-1-0.dll 6
ADVAPI32.dll 24
WS2_32.dll 29
Normaliz.dll 1