am19.exe
First submission 2024-10-16 04:06:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 416.0 KB (425984 bytes) |
| Compile time: | 2024-07-25 14:12:00 |
| MD5: | d7e27b31e4e9fea544ad222cecb5338c |
| SHA1: | 484f64323864bcf4326e63f8908f43192306856b |
| SHA256: | ba7570395a1adfa7dd22638402d994c2b36efb559d1a69ddc91503bb0b608839 |
| Import Hash : | be0c2c50a71730b54474cda1c9b2928c |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 43/76 VT report date: 2024-10-16 03:39:14 |
| Malware Type 3 | trojan downloader dropper |
| Threat Type 3 | doina amadey deyma |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://185.215.113.103/test/am19.exe  |
185.215.113.103 |
2024-10-16 04:06:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x4e5fa | 321024 | d5e8b0f92edd5c9ef5a828516464bf1672993111 | 247d40b35166287cb4b49509a208df50 | |
| .rdata | 0x50000 | 0x11070 | 70144 | 2e92209b827cf0d1adc6e42d41a2ce4cdd4553ce | 4b6f3708364fc7ce4e202f96f25a7b49 | |
| .data | 0x62000 | 0x667c | 13312 | 162885b464480b42b02021256030cd36a282ce73 | 0066d19dde9729444b5459eb9c2ea480 | |
| .rsrc | 0x69000 | 0x1e0 | 512 | 26acb84785e1385f17fbf39b38ee67689ff74468 | b7d16686b376821266a9345c26b7e6d6 | |
| .reloc | 0x6a000 | 0x4c58 | 19968 | 91a30d6890fca54d9f873d8f0cab11e4058d4af2 | b8416175415f0a3617cb949612d39195 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x69060 | 381 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| AKERNEL32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| combase.dll |
| SHELL32.dll |
| WININET.dll |
| WS2_32.dll |
| ntdll.dll |
| ole32.dll |
| KERNEL32.dll |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| newwork.exe | 2024-07-19 08:36:02 | 3764897fd08b8427b978fb099c091f71 |