Services.exe
First submission 2023-09-13 16:34:07
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 7293.0 KB (7468032 bytes) |
Compile time: | 2023-08-30 18:23:06 |
MD5: | e962e5b9badb08fa227761855fedf45f |
SHA1: | 6d7e692b52498ab70bba061e325e6756d65f9978 |
SHA256: | 1e78377257155e87512b7813cc01a9b047ee03227957e62373aa07245ea94bd7 |
Import Hash : | de8af78b3569eb79f0a43010a95e85a8 |
Sections 9 | .text .rdata .data .vmp0 .vmp1 .vmp2 .reloc .rsrc .srdata |
Directories 3 | import resource relocation |
Virus Total: | 61/70 VT report date: 2023-09-13 14:21:35 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
PE Sections 7 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x514ef | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.rdata | 0x53000 | 0xab90 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.data | 0x5e000 | 0x17fc | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.vmp0 | 0x60000 | 0x36d661 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.vmp1 | 0x3ce000 | 0x508 | 1536 | 3a8a61b13d94d7ed691d1b23a17e9fdcfe506c7f | 6e40eacf9493bd351013efd6a0a3f761 | |
.vmp2 | 0x3cf000 | 0x666e90 | 6713344 | 4d98aa9d32f1b2be123dff029dcb13dc661c90e3 | fcbfa20f90b2b558f33ae38cb2af437a | |
.reloc | 0xa36000 | 0x648 | 2048 | a7a6941f77dcb6e8e008181993755ccf5f3174ea | 80b06e371cace14bbf49063c5279a5c3 | |
.rsrc | 0xa37000 | 0xba1a8 | 721408 | 7320373eab8a62c6ab48952d21e7ded07a029e8b | e2604dc92a1184e5c5205ebd57d23c2f | |
.srdata | 0xaf2000 | 0x7000 | 28672 | 0b29e90a63a2aad7d130822c54310e27185e926c | 3a6ec8fee222051d61ccb05a4e3265c1 |
PE Resources 9
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
PNG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xae700c | 3335 | |
RT_BITMAP | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaeebc4 | 240 | |
RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xae3618 | 9640 | |
RT_MENU | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaeecb4 | 162 | |
RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaf00a4 | 770 | |
RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaf10d8 | 184 | |
RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xae682c | 174 | |
RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xae68dc | 1838 | |
None | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaf1190 | 24 |
Strings analysis - File found
Library |
ADVAPI32.dll |
KERNEL32.dll |
USER32.dll |
SETUPAPI.dll |
SHELL32.dll |
Strings analysis - Possible URLs found 2
http://schemas.microsoft.com/SMI/2005/WindowsSettings |
http://schemas.microsoft.com/SMI/2016/WindowsSettings |
Import functions
Name | Latest seen | MD5 |
---|---|---|
Services.exe | 2023-09-05 15:33:07 | ca7502cd02a0a170d9f4305c18410126 |