AutoHotKey.exe
First submission 2024-10-15 17:55:02
File details
| File type: | PE32+ executable (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1289.0 KB (1319936 bytes) |
| Compile time: | 2023-07-08 07:25:42 |
| MD5: | dc20d755a0ce47329c8b36ad9b99097b |
| SHA1: | c10767cf93b25513efffa19c68df4262b83d9be4 |
| SHA256: | 7d47220e8a09c113b82ba9f366ce2cbe5924b0cc661dc9df93c13e8dbfa1f254 |
| Import Hash : | a9b5160326ed68a4bb81944dabab7ed6 |
| Sections 7 | .text .rdata .data .pdata text data .rsrc |
| Directories 2 | import resource |
File features detected
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://asurastrike.de/ERAB/AutoHotKey.exe  |
asurastrike.de |
2024-10-15 17:55:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xecf26 | 970752 | 19c6bb4be1aa4d154d0035dfc0f98ddc16cc2192 | c7e59ab13d802ef3a99c383dd342de46 | |
| .rdata | 0xee000 | 0x3497c | 215552 | d1c3dbe7e565b41f672efaf827520f1b43d7e22b | 84f386cafc697632e175f3133ddc45c9 | |
| .data | 0x123000 | 0xc818 | 20992 | 8b9c674ce9057e66fad2f3f02c03a9fd683d7560 | fba42b5b7462d1099b946570f1b5b694 | |
| .pdata | 0x130000 | 0x8418 | 34304 | fb590d616c3efdb2eac8733636d5097f8b5ef1a2 | e00301686647df8cb55214b909600dc1 | |
| text | 0x139000 | 0x258d | 9728 | 4c0370f7184e9f3f24f2fb635ff0fb83397697fd | a849b5d875105e777eb8405b21f42175 | |
| data | 0x13c000 | 0x6ec0 | 28672 | 353e3345d0a3058c1fee970144c22844ac1d4560 | 8f4275b626558a8640120f611553e570 | |
| .rsrc | 0x143000 | 0x96c0 | 38912 | 33e63d83d4d958ac16060efcfb9f4f21c03bdf59 | 106911fc032032f326faa5d6afce7f87 |
PE Resources 7
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x14bf60 | 744 | |
| RT_MENU | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x143978 | 712 | |
| RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x14c288 | 232 | |
| RT_ACCELERATOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x14c370 | 72 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x148490 | 20 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x14c3b8 | 772 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x143480 | 1268 |
Meta infos 9
| LegalCopyright: | Copyright (C) 2003-2013 |
| InternalName: | AutoHotkey |
| FileVersion: | 1.1.37.01 |
| CompanyName: | AutoHotkey Foundation LLC |
| ProductVersion: | 1.1.37.01 |
| FileDescription: | AutoHotkey Unicode 64-bit |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: | AutoHotkey.exe |
| ProductName: | AutoHotkey |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 10
| FindWindowW |
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| OutputDebugStringW |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Text |
| *.txt |
| Library |
| USER32.dll |
| KERNEL32.dll |
| dwmapi.dll |
| ntdll.dll |
| mscoree.dll |
| ADVAPI32.dll |
| OLEAUT32.dll |
| VERSION.dll |
| WSOCK32.dll |
| PSAPI.DLL |
| COMCTL32.dll |
| ole32.dll |
| WININET.dll |
| SHELL32.dll |
| WINMM.dll |
| GDI32.dll |
| COMDLG32.dll |
Strings analysis - Possible URLs found 8
| https://autohotkey.com |
| file:// |
| http://www.w3.org/2001/XMLSchema-instance |
| file:/// |
| file:///I |
| http://www.w3.org/2001/XMLSchema |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |