MeteorClient.exe?ex=670c18ce&is=670ac74e&hm=159167a5eea16dabf060334833693634e8467b7998a27ab3c01edbb72e6da9d4&

First submission 2024-10-13 20:40:02

File details

File type: PE32+ executable (console) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 7094.29 KB (7264549 bytes)
Compile time: 2024-10-12 20:38:41
MD5: d64bbed8177a1ed6a060108fe9eb70db
SHA1: 566eb6965ce40b7ae35ded7bb4318181ac761a80
SHA256: 0684a8c6ebb2b0f669ed39ea789118e3ebcf0ec5bdc4fe34e91c73784764e0a2
Import Hash : 023abd09c65289e3a2df4aa2b19cccec
Sections 7 .text .rdata .data .pdata _RDATA .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/952258819671588864/1294736473169592421/MeteorClient.exe?ex=670c18ce&is=670ac74e&hm=159167a5eea16dabf060334833693634e8467b7998a27ab3c01edbb72e6da9d4& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 20:40:02

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x2b150 176640 5030762a2c7b9e8244cb98e3a841dad9af12bddb 1ffe948fda8287176b84b7a3b237172e
.rdata 0x2d000 0x12c26 77312 caa52a98dd8acdd5526515e7585278379526bfa2 c0baf03f8bc4ba3199d31a09668597dd
.data 0x40000 0x33b8 3584 5aa4b317e22e3d51d25a43c83314955564eb4a3e 0714d4ddb9a1211592095e1351376cf2
.pdata 0x44000 0x2364 9216 ef8176853647112b5daddfe42ae3c299647ef41a 83c41aa29e95d587861d91bdbdbcb3d6
_RDATA 0x47000 0x1f4 512 4440dcc4642667be6a67c5c84f8b4680eacfb597 7c7efebb897cc4ea38b70ce8f0efef3f
.rsrc 0x48000 0xef8c 61440 14785e0e1a23bdcc620ec3118e5703c4870318fd 3579cae944fcd6d7d429e7acd4be96ae
.reloc 0x57000 0x75c 2048 6e5b545c20fad2811376b7e15a105eb231094d98 6492d58c46d0b94c9dcff3d29f4e25f2

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x565ac 1128
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x56a14 104
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x56a7c 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 7

GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Compressed
base_library.zip
bbase_library.zip
Library
mscoree.dll
ADVAPI32.dll
KERNEL32.dll
8python312.dll
ucrtbase.dll
bVCRUNTIME140.dll
bpython312.dll
USER32.dll
blibcrypto-3.dll

Strings analysis - Possible IPs found 1

7.4.6.5

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions