wc4aw1t506.dll
First submission 2023-09-14 10:59:03
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1090.5 KB (1116672 bytes) |
| Compile time: | 2023-09-11 18:16:55 |
| MD5: | e4919447b9ea5c4f02a0746ab64f8e7e |
| SHA1: | bf40844bd9286804351cf1c51ad1f68a26b81d92 |
| SHA256: | f583b43851502322a69c67f0f8f3e50f296f397e4bbb50bc646bccca6ee79215 |
| Import Hash : | 9881fe8bdd76fbd975354d75e7c256d2 |
| Sections 7 | .text .rdata .data .pdata .gfids .rsrc .reloc |
| Directories 4 | import export resource relocation |
| Virus Total: | 16/70 VT report date: 2023-09-14 08:48:22 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://128.140.55.166/wc4aw1t506.dll  |
128.140.55.166 |
2023-09-14 10:59:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xe7c7 | 59392 | 6fa71a022b29b5763ade560bfc1f83ae3f828de6 | 4d43afee646fc3c82cad1d4be1319574 | |
| .rdata | 0x10000 | 0x417e6 | 268288 | fb2621e17457632c1673bb588cf4b23a419d010d | 633134f5daac042d68b605addf7b7839 | |
| .data | 0x52000 | 0xbf598 | 779264 | fbbd95dcac937aa7b8e0de184a771e0af23e54c3 | 81a2913d9eec8d23ffeb4c439a17457a | |
| .pdata | 0x112000 | 0xe40 | 4096 | 3b14d5bdaaf9e4811eec29ee31c53f4846c331e8 | ad64602dff4bbef558102c9b9a9b606f | |
| .gfids | 0x113000 | 0x94 | 512 | e77578487b6803ed741fb698da7a8640bf3f1fd5 | b2e0b6647b886286763312a427dc2c1c | |
| .rsrc | 0x114000 | 0x728 | 2048 | 0c55dd4c0998fed3b6019e177e9106fb279b7af0 | cbc8a329d23b29cf1007bd2a03f54f84 | |
| .reloc | 0x115000 | 0x624 | 2048 | 4e3981613223788a5ba4499c129a93ed26de62bb | f2fa1171ec9ebec450265f67ebc73004 |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114320 | 646 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1145a8 | 381 | |
| None | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114120 | 196 |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| mscoree.dll |
| utpcxre663tc32.dll |
| KERNEL32.dll |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| DllRegisterServer | 0x18000f1b4 |