neofetch.exe

First submission 2024-10-14 17:46:03

File details

File type: PE32+ executable (console) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 2646.1 KB (2709608 bytes)
Compile time: 2024-09-22 20:48:05
MD5: d6b10fe0f03dc8bdf3cd5ec9e4e3d305
SHA1: 744f9e241070e7ab43f6cb834420d2ba763a405a
SHA256: d0786c4c6c967ba28706f92402a6151fc509b010e1d2a18f19118548bbe40393
Import Hash : 52dee48e9c20d673929d8b1b29a57a87
Sections 19 .text .data .rdata .pdata .xdata .bss .idata .CRT .tls .rsrc .reloc /4 /19 /31 /45 /57 /70 /81 /97
Directories 4 import resource tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 51/77 VT report date: 2024-10-14 17:18:57
Malware Type 3 trojan downloader dropper
Threat Type 3 nekark xycxfp znxkz

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://130.61.181.50/ransomware/neofetch.exe VirusTotal Report 130.61.181.50 VirusTotal Report 2024-10-14 17:46:03

PE Sections 3 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0xbb8b8 768512 26421f654ef65f36573c6d816f7547dfdbc6f47b 826e9c889d49b538d084a406a9f0298e
.data 0xbd000 0x2f40 12288 241daad8c296cdf275e12802af7b33ad187c7340 04dfdc5bf29abe685a786f6251249903
.rdata 0xc0000 0x10ea0 69632 28230f203e5836a5799aabdcbb3f797ef5aca3b3 90c0d6444be82ab4d614654671bc0995
.pdata 0xd1000 0xbf40 49152 8a49c51305fa3b0c1e05c8902882983f2cc57946 2f7b6070c92df0be8d6990d0d76234a2
.xdata 0xdd000 0x10cec 69120 d28269301cf2177ec4c2b13df7cc5df5ac7b703a 03aa60eee77135cc64a643d1382e207d
.bss 0xee000 0xd10 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0xef000 0x146c 5632 f06dccd409e92b6af6d3d9229211ae80aee82197 aacba69961f2fd3a31e1f813b23de13c
.CRT 0xf1000 0x68 512 951ad4deaa79ba911f52eda8c5f3d9f942633444 914377f4789c146c5c73ed48c7df0eec
.tls 0xf2000 0x10 512 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 bf619eac0cdf3f68d496ea9344137e8b
.rsrc 0xf3000 0x4e8 1536 de462dc7fcd276d2c14c7cb6abe93313e2522b68 1028f2a1bf91d049b71dd4b4b7d8ad7d
.reloc 0xf4000 0x1648 6144 a0d400cceb10ed163304fa92941ae06f4b0041c2 0d6a21af08a80adbcd6660e809f24b6a
/4 0xf6000 0x610 2048 4d43928a8a04d41cbdbcbe62639aaf69db6c37af ccdb2020a8c444ddc1e3131cda3e09ad
/19 0xf7000 0x10904 68096 61918f97b52ff48e5a231a07624d6ce3e49a0112 1256ac538511796d4b59aed9ff989406
/31 0x108000 0xc32 3584 58334a794da58792e0253accf9b6b9e0f3913e27 58501516bbd4e4d0ca022d663b69bbf0
/45 0x109000 0x1c03 7680 ccde1981e642e49b7a76e7be11e91701c8ac684f 7f4019ad8350d8ddb882cd208fa65690
/57 0x10b000 0x19c8 6656 3f130631e7924154dfaec7e0015456af4e43f70a 9c2b69d90e0a7bea91953b238bbc120f
/70 0x10d000 0x4ab 1536 37df039666f048f28d38dae0f90cf3303090417b 219ae2cf9805256acd91cf77ad4b72cd
/81 0x10e000 0x63d 2048 8346243e83dae499f43cbdf6114839909eeeb8f1 41b0c301da188b0744221cca42faa6fe
/97 0x10f000 0x402 1536 066e94d60ad13b34c771f3803fabd251126b2acd eab3a73416f75a197fe4d0fcf5f065ca

PE Resources 1

Name Language Sublanguage Offset Size Data
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0xf3058 1167

Anti debug functions 4

GetLastError
IsDebuggerPresent
OutputDebugStringA
RaiseException

Strings analysis - File found

Library
ADVAPI32.dll
MSVCRT.dll
KERNEL32.dll
USER32.dll

Strings analysis - Possible IPs found 1

130.61.181.50

Strings analysis - Possible URLs found 1

https://H

Import functions