index.php
First submission 2023-09-15 14:34:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 272.5 KB (279040 bytes) |
| Compile time: | 2022-03-24 08:19:59 |
| MD5: | cb77680df3b88a997837d29478d8a9fa |
| SHA1: | 698ea26835510137871b261181e00ca26f1a96a7 |
| SHA256: | 8bbbf51d4c5404915d1b306121e0226d1f23e88acf635c8cb4f4461dbe142838 |
| Import Hash : | ed59ec9c2e7c8ef8d97dbc8b84b56759 |
| Sections 3 | .text .data .rsrc |
| Directories 2 | import resource |
| Virus Total: | 27/63 VT report date: 2023-09-15 12:30:22 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://api-alajman.com/tmp/index.php  |
api-alajman.com |
2023-09-15 14:34:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1eec2 | 126976 | fedfc0fd4b9b1c9a9438a4ab455dbad0ca8369bb | e5368489aadfe860b57f11566c76982b | |
| .data | 0x20000 | 0x2e28ac | 90624 | fcb01ea260d09c4662e3c7ea5c9fdcfb9190a221 | 6fd5f8a2cc06caba389775f8554495cb | |
| .rsrc | 0x303000 | 0xeb28 | 60416 | 7e2f10dbf69d0528f57f1947d6cb3bf9b3593bbd | 000e1459594d742b04502f9d2d9a412f |
PE Resources 6
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x3106f0 | 2216 | |
| RT_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x30ef18 | 1128 | |
| RT_STRING | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x311660 | 1224 | |
| RT_GROUP_CURSOR | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x3106c0 | 48 | |
| RT_GROUP_ICON | LANG_SINDHI | SUBLANG_SYS_DEFAULT | 0x308b60 | 90 | |
| RT_VERSION | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x310fb0 | 640 |
Meta infos 8
| InternalName: | Cascader.exe |
| FileVersions: | 49.51.44.114 |
| LegalCopyrights: | Challangers bottle |
| CompanyName: | Phunderstuck |
| ProductVersion: | 57.5.64.0 |
| FileDescriptions: | Anybodies |
| Translation: | 0x124e 0x03fe |
| ProductName: | Bonni |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Library |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| USER32.dll |
| WINHTTP.dll |
| ole32.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 1
| 49.51.44.114 |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| index.php | 2023-09-15 14:11:02 | 9dfb568692c3817a381c171965d30e1c |