Services.exe

First submission 2023-09-13 16:34:07

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 7293.0 KB (7468032 bytes)
Compile time: 2023-08-30 18:23:06
MD5: e962e5b9badb08fa227761855fedf45f
SHA1: 6d7e692b52498ab70bba061e325e6756d65f9978
SHA256: 1e78377257155e87512b7813cc01a9b047ee03227957e62373aa07245ea94bd7
Import Hash : de8af78b3569eb79f0a43010a95e85a8
Sections 9 .text .rdata .data .vmp0 .vmp1 .vmp2 .reloc .rsrc .srdata
Directories 3 import resource relocation
Virus Total: 61/70 VT report date: 2023-09-13 14:21:35

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://171.22.28.208/download/Services.exe VirusTotal Report 171.22.28.208 VirusTotal Report 2023-09-13 16:34:07

PE Sections 7 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x514ef 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x53000 0xab90 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.data 0x5e000 0x17fc 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.vmp0 0x60000 0x36d661 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.vmp1 0x3ce000 0x508 1536 3a8a61b13d94d7ed691d1b23a17e9fdcfe506c7f 6e40eacf9493bd351013efd6a0a3f761
.vmp2 0x3cf000 0x666e90 6713344 4d98aa9d32f1b2be123dff029dcb13dc661c90e3 fcbfa20f90b2b558f33ae38cb2af437a
.reloc 0xa36000 0x648 2048 a7a6941f77dcb6e8e008181993755ccf5f3174ea 80b06e371cace14bbf49063c5279a5c3
.rsrc 0xa37000 0xba1a8 721408 7320373eab8a62c6ab48952d21e7ded07a029e8b e2604dc92a1184e5c5205ebd57d23c2f
.srdata 0xaf2000 0x7000 28672 0b29e90a63a2aad7d130822c54310e27185e926c 3a6ec8fee222051d61ccb05a4e3265c1

PE Resources 9

Name Language Sublanguage Offset Size Data
PNG LANG_ENGLISH SUBLANG_ENGLISH_US 0xae700c 3335
RT_BITMAP LANG_ENGLISH SUBLANG_ENGLISH_US 0xaeebc4 240
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0xae3618 9640
RT_MENU LANG_ENGLISH SUBLANG_ENGLISH_US 0xaeecb4 162
RT_DIALOG LANG_ENGLISH SUBLANG_ENGLISH_US 0xaf00a4 770
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0xaf10d8 184
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0xae682c 174
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0xae68dc 1838
None LANG_ENGLISH SUBLANG_ENGLISH_US 0xaf1190 24

Strings analysis - File found

Library
ADVAPI32.dll
KERNEL32.dll
USER32.dll
SETUPAPI.dll
SHELL32.dll

Strings analysis - Possible URLs found 2

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
Services.exe 2023-09-05 15:33:07 ca7502cd02a0a170d9f4305c18410126