67081de6be937_ParticlerOps.exe

First submission 2024-10-12 07:11:02

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 4506.32 KB (4614469 bytes)
Compile time: 2010-06-27 09:06:38
MD5: dc724c3aafa18b464c83bd5910407805
SHA1: f02ea54bb5d8b6b20016cd90892f4b56163d8e6b
SHA256: 0a35146706c4712aea807ce394aab0270d5c115ceb3d0e79695f49f763648a55
Import Hash : b5a014d7eeb4c2042897567e1288a095
Sections 4 .text .rdata .data .rsrc
Directories 2 import resource

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 16/77 VT report date: 2024-10-11 08:27:36
Malware Type 1 trojan
Threat Type 2 nekark nnehx

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://cache.ussc.org/dist/67081de6be937_ParticlerOps.exe VirusTotal Report cache.ussc.org VirusTotal Report 2024-10-12 07:11:02

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x11317 70656 cde6cb8f4d9c69a41fd804a023d7d7eda31c5c70 797279c5ab1a163aed1f2a528f9fe3ce
.rdata 0x13000 0x30ea 12800 b91950cddac9f80cbceac26c930f598527952eda 1359639b02bcb8f0a8743e6ead1c0030
.data 0x17000 0x292c 2048 bfdd94ea30958629cf0db8b738b24afd78faff1b 9415c9c8dea3245d6d73c23393e27d8e
.rsrc 0x1a000 0x18d04 101888 07aca978674316298cc9c197452413b3c29f169b 9dee09854e79aa987e5336a4defda540

PE Resources 4

Name Language Sublanguage Offset Size Data
RT_ICON LANG_RUSSIAN SUBLANG_RUSSIAN 0x21ed0 67624
RT_GROUP_ICON LANG_RUSSIAN SUBLANG_RUSSIAN 0x326f8 76
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x32744 848
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x32a94 624

Meta infos 10

LegalCopyright: Copyright \xa9 2005-2010 Oleg N. Scherbakov
InternalName: 7ZSfxMod
FileVersion: 1.4.0.1795
FileDescription: 7z Setup SFX (x86)
PrivateBuild: June 27, 2010
ProductVersion: 1.4.0.1795
CompanyName: Oleg N. Scherbakov
Translation: 0x0000 0x04b0
OriginalFilename: 7ZSfxMod_x86.exe
ProductName: 7-Zip SFX

Packers detected 3

Microsoft Visual C++ v6.0
Microsoft Visual C++ 5.0
Microsoft Visual C++

Anti debug functions 1

GetLastError

Anti debug functions 1

Bochs & QEmu CPUID Trick

Strings analysis - File found

Executable
`8.sO
Library
SHELL32.dll
USER32.dll
ole32.dll
KERNEL32.dll
COMCTL32.dll
MSVCRT.dll
OLEAUT32.dll
GDI32.dll

Import functions

Name Latest seen MD5
IHBHXXQF.exe 2024-07-01 14:59:02 5f4de1a8ed39bdcaf3e4c6d5fa547fc2
PENDXGKW.exe 2024-08-27 18:36:01 61d31fb13c1dd46fcb03caf7f648508c
msconfig32.exe#pend 2024-08-30 22:08:02 c09d528d8d3bb7a36febd2767c0cc83c
AUGUST.exe 2024-09-25 20:58:03 25860926414bf43383246f7c773a8d6c
orderconfirmation.exe 2024-09-26 16:35:03 1dfda6fc13c7efab9f6148e7339ab80c
66b72acef0ad2_7ainstall.exe 2024-10-09 16:39:02 c096091896176545bc3aac5adb5f7aad