win.exe

First submission 2023-01-20 20:32:40

File details

File type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
File type: 1845.5 KB (1889792 bytes)
Compile time: 1970-01-01 01:00:00
MD5: eb61b390ea1d6a48148fc1d368ce0bb4
SHA1: f1554eb9b2d8e1aa8669b906bac0df65637ee8bc
SHA256: b4a6a80062f30f25349c7dc4726d52eccba61de8419836c4e97c95c99a79af15
Import Hash : 6ed4f5f04d62b18d96b26d6db7c18840
Sections 3 UPX0 UPX1 .rsrc
Directories 3 relocation resource import
Virus Total: 37/71 VT report date: 2023-01-20 19:02:43

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://46.3.112.238/win.exe VirusTotal Report 46.3.112.238 VirusTotal Report 2023-01-20 20:32:42

PE Sections 2 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
UPX0 0x1000 0x39c000 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x39d000 0x1cd000 1888256 cc35cc09f9178fbf5449919d0d954c213ca391cb 17769e9836cb7814de42ec5ee552fed5
.rsrc 0x56a000 0x1000 1024 5e1e3521e01e97b5330d8c813b8d5e67a6229ff9 41b7056b593ab6a5a0a3314ef3a47c2c

PE Resources 1

Name Language Sublanguage Offset Size Data
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x56a05c 340

Packers detected 3

UPX -> www.upx.sourceforge.net
UPX 2.90 (LZMA)
UPX v0.80 - v0.84

Strings analysis - File found

Library
KERNEL32.dll

Strings analysis - Possible IPs found 1

2.5.4.3

Import functions

Name Latest seen MD5
BnWxM.exe 2022-08-02 21:31:02 44e041dc2e445fcd33cc89b8453d0539
FkSyDHJGjzKRHTp.exe 2022-08-28 12:59:02 21f894391eaac76010275132312ac5c8
1533572208.exe 2022-09-26 07:48:02 809b9513cecea98e925419a39a6244a2
smbscanlocal-6e08d39fe99ad508d7e0c7aed19ececd.exe 2022-10-15 05:08:04 6e08d39fe99ad508d7e0c7aed19ececd
softv2.exe 2022-10-21 04:31:04 624d887c50cd38398904002ffcbc732a
chrome10_.eff 2022-11-01 07:56:05 73b9004ff373f3b7b2f595541deb5a02
win8def.exe 2022-11-03 21:45:08 99fa3cf292e4c3534951b6ebd96a6802