service.exe
First submission 2024-10-15 17:42:02
File details
| File type: | PE32+ executable (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1842.5 KB (1886720 bytes) |
| Compile time: | 2024-10-10 00:20:33 |
| MD5: | d44e2b02979b3331e0eb2fab9e96196e |
| SHA1: | f63dc99f5bd59d534157f6f15d686ee79a0c694a |
| SHA256: | 22fb4c9c67ccdfcd03136a651aaa697c448d86f2a156bd4ef0113adfc2948635 |
| Import Hash : | 36c66603aaac9755a6698f59059e1970 |
| Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
| Directories 4 | import resource debug relocation |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://shopping-nice.com/files/service.exe  |
shopping-nice.com |
2024-10-15 17:42:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xa1825 | 662016 | 9d1ebb6e8a869b88780bb648e869b5f67339142d | 4e98e409eae4eb0b54d99163282fab3c | |
| .rdata | 0xa3000 | 0x11cff6 | 1167360 | ae14407abf54803426e8a953e3878ca623acc900 | a029c466e04f9ae68ad1f8362855a5ed | |
| .data | 0x1c0000 | 0xa1b4 | 6144 | e445da8542b8cfce6d0eb394682e1f45022e8ee2 | 472ea7294c9509f4f8538576d6673d43 | |
| .pdata | 0x1cb000 | 0xa92c | 43520 | 6f512a5944a5a9a031225b231221a03b6df5d084 | b1bed0c82f2a51c7c30405310a4e4b6d | |
| _RDATA | 0x1d6000 | 0x15c | 512 | 22c7b3ff0a1f1293670810984f4bd79c41973926 | 82ad43e5429dcdf611a1b357c48fae4a | |
| .rsrc | 0x1d7000 | 0x540 | 1536 | 66ccfd29cb904ffdcc7bb351e31b660827a7d6b7 | 9d17cdc6a38a2c1d4cf625c2dfb0114e | |
| .reloc | 0x1d8000 | 0x105c | 4608 | 9b31714b13c15ae70cd10b578d7ca8d0709f8a22 | aa30b0feb118266406b55a25b5bea69b |
PE Resources 2
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_VERSION | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x1d70a0 | 796 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1d73c0 | 381 |
Meta infos 9
| LegalCopyright: | Copyright \xa9 2009-2023 HWG inc. |
| InternalName: | hwg_service.exe |
| FileVersion: | 51.3.29.14 |
| CompanyName: | Electronic Services Limited. |
| ProductVersion: | 51.3.29.14 |
| FileDescription: | VM NET Service |
| Translation: | 0x044e 0x04b0 |
| OriginalFilename: | hwg_service.exe |
| ProductName: | VM NET Client |
Anti debug functions 7
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 2
| Virtual Box |
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| mscoree.dll |
| KERNEL32.dll |
| WS2_32.dll |
| USER32.dll |
| gdiplus.dll |
| GDI32.dll |
Strings analysis - Possible IPs found 1
| 51.3.29.14 |