MeteorClient.exe?ex=670c18ce&is=670ac74e&hm=159167a5eea16dabf060334833693634e8467b7998a27ab3c01edbb72e6da9d4&
First submission 2024-10-13 20:40:02
File details
File type: | PE32+ executable (console) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 7094.29 KB (7264549 bytes) |
Compile time: | 2024-10-12 20:38:41 |
MD5: | d64bbed8177a1ed6a060108fe9eb70db |
SHA1: | 566eb6965ce40b7ae35ded7bb4318181ac761a80 |
SHA256: | 0684a8c6ebb2b0f669ed39ea789118e3ebcf0ec5bdc4fe34e91c73784764e0a2 |
Import Hash : | 023abd09c65289e3a2df4aa2b19cccec |
Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
Directories 4 | import resource debug relocation |
File features detected
URLs, FQDN and IP indicators 1
PE Sections 1 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x2b150 | 176640 | 5030762a2c7b9e8244cb98e3a841dad9af12bddb | 1ffe948fda8287176b84b7a3b237172e | |
.rdata | 0x2d000 | 0x12c26 | 77312 | caa52a98dd8acdd5526515e7585278379526bfa2 | c0baf03f8bc4ba3199d31a09668597dd | |
.data | 0x40000 | 0x33b8 | 3584 | 5aa4b317e22e3d51d25a43c83314955564eb4a3e | 0714d4ddb9a1211592095e1351376cf2 | |
.pdata | 0x44000 | 0x2364 | 9216 | ef8176853647112b5daddfe42ae3c299647ef41a | 83c41aa29e95d587861d91bdbdbcb3d6 | |
_RDATA | 0x47000 | 0x1f4 | 512 | 4440dcc4642667be6a67c5c84f8b4680eacfb597 | 7c7efebb897cc4ea38b70ce8f0efef3f | |
.rsrc | 0x48000 | 0xef8c | 61440 | 14785e0e1a23bdcc620ec3118e5703c4870318fd | 3579cae944fcd6d7d429e7acd4be96ae | |
.reloc | 0x57000 | 0x75c | 2048 | 6e5b545c20fad2811376b7e15a105eb231094d98 | 6492d58c46d0b94c9dcff3d29f4e25f2 |
PE Resources 3
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x565ac | 1128 | |
RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x56a14 | 104 | |
RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x56a7c | 1293 |
Packers detected 2
Microsoft Visual C++ 8.0 (DLL) |
Microsoft Visual C++ 8.0 |
Anti debug functions 7
GetLastError |
GetWindowThreadProcessId |
IsDebuggerPresent |
IsProcessorFeaturePresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Compressed |
base_library.zip |
bbase_library.zip |
Library |
mscoree.dll |
ADVAPI32.dll |
KERNEL32.dll |
8python312.dll |
ucrtbase.dll |
bVCRUNTIME140.dll |
bpython312.dll |
USER32.dll |
blibcrypto-3.dll |
Strings analysis - Possible IPs found 1
7.4.6.5 |
Strings analysis - Possible URLs found 1
http://schemas.microsoft.com/SMI/2016/WindowsSettings |