pered.exe
First submission 2024-07-26 01:57:03
Last sumbission 2024-09-01 23:59:02
File details
File type: | PE32+ executable (GUI) x86-64, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 11169.85 KB (11437924 bytes) |
Compile time: | 2024-07-25 16:00:16 |
MD5: | faf1270013c6935ae2edaf8e2c2b2c08 |
SHA1: | d9a44759cd449608589b8f127619d422ccb40afa |
SHA256: | 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840 |
Import Hash : | a6cec5b1a631d592d80900ab7e1de8df |
Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
Directories 4 | import resource debug relocation |
File features detected
URLs, FQDN and IP indicators 1
PE Sections 1 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x28720 | 165888 | e4a68f1b7a5590eedd6e14edc56806c8fc90ee7e | bde1e371902cf81ea9be7e3f95382cfd | |
.rdata | 0x2a000 | 0x12a9e | 76800 | 43cd2712d0ff1d0b67c869e4f7f6b98b1f5c2531 | 7c82554272ff55e21ababb1ca44b86b3 | |
.data | 0x3d000 | 0x103e8 | 3584 | f64ecee3fa8884abfb5989486daed448f331e775 | baf7e08c61eeb50b5a3978422561c938 | |
.pdata | 0x4e000 | 0x20c4 | 8704 | df2656553c01f8594fc3f9df7a73d2fcd03fbf72 | 306be8c7742d2c9622517b124ebf3ac1 | |
_RDATA | 0x51000 | 0x15c | 512 | f35f173d4274d20980dfef0a6f46ce9064d4cf0e | e9000b5de7c8ee475c9ff9bfd52a2223 | |
.rsrc | 0x52000 | 0xf4a0 | 62976 | 5abcc3a42410d482147c92bcfc7dc8128a3a7bd3 | 2508ecb87b352f8ffb867f41ca7a6464 | |
.reloc | 0x62000 | 0x758 | 2048 | 31549301083f61b8fdf8df1671f67eef09df21f7 | bc11f54c2d33adf3a95c6af00e70eb22 |
PE Resources 3
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x60a3c | 1128 | |
RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x60ea4 | 104 | |
RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x60f0c | 1426 |
Packers detected 1
Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 6
GetLastError |
IsDebuggerPresent |
IsProcessorFeaturePresent |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Compressed |
base_library.zip |
xbase_library.zip |
Text |
xcryptography-42.0.8.dist-info\top_level.txt |
Library |
mscoree.dll |
ADVAPI32.dll |
bapi-ms-win-core-file-l1-1-0.dll |
bapi-ms-win-crt-math-l1-1-0.dll |
ucrtbase.dll |
bapi-ms-win-core-libraryloader-l1-1-0.dll |
KERNEL32.dll |
bapi-ms-win-core-localization-l1-2-0.dll |
bapi-ms-win-crt-string-l1-1-0.dll |
bapi-ms-win-core-errorhandling-l1-1-0.dll |
COMCTL32.dll |
bapi-ms-win-core-processthreads-l1-1-0.dll |
bapi-ms-win-core-processthreads-l1-1-1.dll |
bapi-ms-win-core-interlocked-l1-1-0.dll |
bapi-ms-win-core-datetime-l1-1-0.dll |
bapi-ms-win-core-profile-l1-1-0.dll |
bapi-ms-win-crt-time-l1-1-0.dll |
bapi-ms-win-crt-utility-l1-1-0.dll |
bapi-ms-win-core-memory-l1-1-0.dll |
bapi-ms-win-core-processenvironment-l1-1-0.dll |
bapi-ms-win-crt-conio-l1-1-0.dll |
bapi-ms-win-core-timezone-l1-1-0.dll |
bapi-ms-win-core-synch-l1-1-0.dll |
blibssl-1_1.dll |
bapi-ms-win-core-debug-l1-1-0.dll |
Bapi-ms-win-core-synch-l1-2-0.dll |
bapi-ms-win-core-util-l1-1-0.dll |
bapi-ms-win-crt-filesystem-l1-1-0.dll |
bapi-ms-win-crt-convert-l1-1-0.dll |
bapi-ms-win-crt-runtime-l1-1-0.dll |
bapi-ms-win-core-rtlsupport-l1-1-0.dll |
bucrtbase.dll |
bapi-ms-win-crt-process-l1-1-0.dll |
bapi-ms-win-core-handle-l1-1-0.dll |
bpython310.dll |
USER32.dll |
b_pytransform.dll |
blibcrypto-1_1.dll |
bapi-ms-win-crt-stdio-l1-1-0.dll |
bapi-ms-win-core-file-l2-1-0.dll |
bapi-ms-win-crt-heap-l1-1-0.dll |
bpython3.dll |
6python310.dll |
bapi-ms-win-core-file-l1-2-0.dll |
bapi-ms-win-core-console-l1-1-0.dll |
bapi-ms-win-core-heap-l1-1-0.dll |
bapi-ms-win-core-string-l1-1-0.dll |
bapi-ms-win-core-namedpipe-l1-1-0.dll |
bapi-ms-win-crt-locale-l1-1-0.dll |
bapi-ms-win-core-sysinfo-l1-1-0.dll |
bapi-ms-win-crt-environment-l1-1-0.dll |
bVCRUNTIME140.dll |
GDI32.dll |
blibffi-7.dll |
Strings analysis - Possible URLs found 1
http://schemas.microsoft.com/SMI/2016/WindowsSettings |
Import functions
Name | Latest seen | MD5 |
---|---|---|
scrd.exe | 2022-09-03 17:52:06 | 5d827372fe226a2ae4e2ababebaa0221 |
elevated.exe | 2022-09-26 10:44:02 | 8a32017e36960f365076023db2432821 |
obf.exe | 2022-11-21 23:44:02 | def004932329421183edb964d150dc2f |
new.exe | 2022-11-26 11:07:07 | 51c6a3db5320bbe73f6c4afc29a7725d |
new33.exe | 2022-11-26 11:37:03 | f41e454bd8f94376f0fe048abfe9b593 |
ms.exe | 2023-01-24 19:38:32 | 253b78e6b07ba74dd5bab6c546189449 |
py.exe | 2023-01-30 14:09:32 | f48085b102f5144a388e08592e673861 |
testdamned.exe | 2023-04-30 07:55:05 | 6c56c4158826328c3e14422e9e54fbf8 |
dc.exe | 2023-06-19 09:45:05 | a1dc3e2f998031a7c96685e6571f4f5f |