S0FTWARE.exe?ex=670cf846&is=670ba6c6&hm=ef0accaede7e828a27212ae4a123c9fb037408be859efe1d4c509beb514da77b&

First submission 2024-10-13 17:40:02

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 9346.5 KB (9570816 bytes)
Compile time: 1970-01-01 01:00:00
MD5: de40920ceb6061d4a5b62fd03a9438c5
SHA1: eb3d3f46aad57e868b9d4b2c07d24410bfd2ca85
SHA256: 959e47ec654acce16b8df4466da97f8479d65b9a69a2c3603c3cb6856ceaecc0
Import Hash : 4f2f006e2ecf7172ad368f8289dc96c1
Sections 7 .text .rdata .data .idata .reloc .symtab .rsrc
Directories 3 import resource relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 42/77 VT report date: 2024-10-13 17:03:27
Malware Type 2 trojan dropper
Threat Type 3 dtftn msil vidar

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1268641353307521130/1294976423769018428/S0FTWARE.exe?ex=670cf846&is=670ba6c6&hm=ef0accaede7e828a27212ae4a123c9fb037408be859efe1d4c509beb514da77b& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 17:40:02

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x305f59 3170304 9b6dbefbbceaf144d9718343469ada24f6da3b0f 574bf4d19e1ffddf2383b2fbcad2618d
.rdata 0x307000 0x5b49e8 5982720 b3391d82fc29fbece12c38aba9ce863f6ad60c3e b2a89a573f6d1778f5f8b8e8943c2d00
.data 0x8bc000 0x68648 240640 d23557ca5fc77f4246956775e2aced8fbe1c76b4 15450240646b32c5c7872f6106e3efa2
.idata 0x925000 0x45e 1536 d43729749d74b95207890706f89998247db50967 52d83605414a0f24fbda57874f293638
.reloc 0x926000 0x2992a 170496 adddb0c7e6393c9f508add103cd0097735db7a3b d8a2e51e79e47b9e876284292d3a58f5
.symtab 0x950000 0x4 512 943ae54f4818e52409fbbaf60ffd71318d966b0d 07b5472d347d42780469fb2654b7fc54
.rsrc 0x951000 0xd89 3584 484b4e87c02e97ff62398d01c083a3f10024a693 6f1ed2c4b7cfc5a2aad5e32487ffee2f

PE Resources 2

Name Language Sublanguage Offset Size Data
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x9510a0 1412
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x951624 1893

Meta infos 9

LegalCopyright: (c) 2009-2024
OriginalFileName:
FileVersion: 7.5.2
CompanyName: NAPS2 Software
ProductVersion: 7.5.2
FileDescription: NAPS2 installer
Translation: 0x0000 0x04b0
Comments: This installation was built with Inno Setup.
ProductName: NAPS2

Strings analysis - File found

Log
github.com/saferwall/pe/log.(*Filter).Log
github.com/saferwall/pe/log.(*stdLogger).Log
math.Log
Library
WINMM.dll
KERNEL32.dll
ntdll.dll
bcryptprimitives.dll
WS2_32.dll
Powrprof.dll
*syscall.DLL
*windows.DLL
type:.eq.syscall.DLL
type:.eq.golang.org/x/sys/windows.DLL

Strings analysis - Possible IPs found 7

5.4.112.5
2.5.4.102
5.4.32.5
127.0.0.1
2.5.4.62
72.5.4.82
4.52.5.4

Strings analysis - Possible URLs found 2

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://chunked19531259765625invaliduintptrSwapperChanDir

Import functions

Name Latest seen MD5
winresinet.exe 2024-05-20 15:23:06 c3736d21ee30c4dd5eec74b630e39b46
ewwe.exe 2024-06-18 10:38:25 58f8e96f834d5d882046bd503ee83b18
rev.exe 2024-07-10 15:14:04 35f6193692dc722a7b3384ccd2ab6778
go.exe 2024-07-10 15:15:09 6b7ca7aa20d0a9225f1b297bbf4c7f14
1.jpg 2024-07-10 15:33:09 aea9dd8e15582e240dce2c066ec1befc
66f45134d0ef8_Advsnced.exe 2024-09-25 22:57:04 59075d8a5bacaa3e994d886d2ec346f7
66f410932765c_videoshaper.exe 2024-10-08 02:21:03 927f42900da344192bdfea8e3325d631
8.11.9-Windows.exe 2024-09-27 16:45:03 1c6b522d985b2e60890a098e3d5e78b8
66dc99a997229_VirtualLibrary.exe 2024-10-08 00:31:05 0bd8936501f04777f9c8684b417b6399
66df5745ca628_SETUP.exe 2024-10-08 02:46:49 41acc938951854469f46ca6856927c22
66e34827a9d4e_driver.exe 2024-10-04 22:35:03 32ae51ec5c2a5b248bafe9cbd3db5d85
386.exe 2024-09-28 06:36:12 a523bc1239f0d151e77fef1b9b439796
Silencer.exe 2024-09-28 20:55:07 d19d5d7fe28ef9630b2ab06835b576cc
670270265df69_fhjh11.exe 2024-10-06 19:20:03 b884d5dacd4ac3c4eba7908f3321024a
66f6b6430e06f_FixIt.exe 2024-10-07 21:57:04 4a66239217d390819d227e60f32f6fce