pered.exe
First submission 2024-07-26 01:57:03
Last sumbission 2024-09-01 23:59:02
File details
| File type: | PE32+ executable (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 11169.85 KB (11437924 bytes) |
| Compile time: | 2024-07-25 16:00:16 |
| MD5: | faf1270013c6935ae2edaf8e2c2b2c08 |
| SHA1: | d9a44759cd449608589b8f127619d422ccb40afa |
| SHA256: | 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840 |
| Import Hash : | a6cec5b1a631d592d80900ab7e1de8df |
| Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
| Directories 4 | import resource debug relocation |
File features detected
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://meticulousfinance.top/inc/pered.exe  |
meticulousfinance.top |
2024-09-01 23:59:04 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x28720 | 165888 | e4a68f1b7a5590eedd6e14edc56806c8fc90ee7e | bde1e371902cf81ea9be7e3f95382cfd | |
| .rdata | 0x2a000 | 0x12a9e | 76800 | 43cd2712d0ff1d0b67c869e4f7f6b98b1f5c2531 | 7c82554272ff55e21ababb1ca44b86b3 | |
| .data | 0x3d000 | 0x103e8 | 3584 | f64ecee3fa8884abfb5989486daed448f331e775 | baf7e08c61eeb50b5a3978422561c938 | |
| .pdata | 0x4e000 | 0x20c4 | 8704 | df2656553c01f8594fc3f9df7a73d2fcd03fbf72 | 306be8c7742d2c9622517b124ebf3ac1 | |
| _RDATA | 0x51000 | 0x15c | 512 | f35f173d4274d20980dfef0a6f46ce9064d4cf0e | e9000b5de7c8ee475c9ff9bfd52a2223 | |
| .rsrc | 0x52000 | 0xf4a0 | 62976 | 5abcc3a42410d482147c92bcfc7dc8128a3a7bd3 | 2508ecb87b352f8ffb867f41ca7a6464 | |
| .reloc | 0x62000 | 0x758 | 2048 | 31549301083f61b8fdf8df1671f67eef09df21f7 | bc11f54c2d33adf3a95c6af00e70eb22 |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x60a3c | 1128 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x60ea4 | 104 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x60f0c | 1426 |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Compressed |
| base_library.zip |
| xbase_library.zip |
| Text |
| xcryptography-42.0.8.dist-info\top_level.txt |
| Library |
| mscoree.dll |
| ADVAPI32.dll |
| bapi-ms-win-core-file-l1-1-0.dll |
| bapi-ms-win-crt-math-l1-1-0.dll |
| ucrtbase.dll |
| bapi-ms-win-core-libraryloader-l1-1-0.dll |
| KERNEL32.dll |
| bapi-ms-win-core-localization-l1-2-0.dll |
| bapi-ms-win-crt-string-l1-1-0.dll |
| bapi-ms-win-core-errorhandling-l1-1-0.dll |
| COMCTL32.dll |
| bapi-ms-win-core-processthreads-l1-1-0.dll |
| bapi-ms-win-core-processthreads-l1-1-1.dll |
| bapi-ms-win-core-interlocked-l1-1-0.dll |
| bapi-ms-win-core-datetime-l1-1-0.dll |
| bapi-ms-win-core-profile-l1-1-0.dll |
| bapi-ms-win-crt-time-l1-1-0.dll |
| bapi-ms-win-crt-utility-l1-1-0.dll |
| bapi-ms-win-core-memory-l1-1-0.dll |
| bapi-ms-win-core-processenvironment-l1-1-0.dll |
| bapi-ms-win-crt-conio-l1-1-0.dll |
| bapi-ms-win-core-timezone-l1-1-0.dll |
| bapi-ms-win-core-synch-l1-1-0.dll |
| blibssl-1_1.dll |
| bapi-ms-win-core-debug-l1-1-0.dll |
| Bapi-ms-win-core-synch-l1-2-0.dll |
| bapi-ms-win-core-util-l1-1-0.dll |
| bapi-ms-win-crt-filesystem-l1-1-0.dll |
| bapi-ms-win-crt-convert-l1-1-0.dll |
| bapi-ms-win-crt-runtime-l1-1-0.dll |
| bapi-ms-win-core-rtlsupport-l1-1-0.dll |
| bucrtbase.dll |
| bapi-ms-win-crt-process-l1-1-0.dll |
| bapi-ms-win-core-handle-l1-1-0.dll |
| bpython310.dll |
| USER32.dll |
| b_pytransform.dll |
| blibcrypto-1_1.dll |
| bapi-ms-win-crt-stdio-l1-1-0.dll |
| bapi-ms-win-core-file-l2-1-0.dll |
| bapi-ms-win-crt-heap-l1-1-0.dll |
| bpython3.dll |
| 6python310.dll |
| bapi-ms-win-core-file-l1-2-0.dll |
| bapi-ms-win-core-console-l1-1-0.dll |
| bapi-ms-win-core-heap-l1-1-0.dll |
| bapi-ms-win-core-string-l1-1-0.dll |
| bapi-ms-win-core-namedpipe-l1-1-0.dll |
| bapi-ms-win-crt-locale-l1-1-0.dll |
| bapi-ms-win-core-sysinfo-l1-1-0.dll |
| bapi-ms-win-crt-environment-l1-1-0.dll |
| bVCRUNTIME140.dll |
| GDI32.dll |
| blibffi-7.dll |
Strings analysis - Possible URLs found 1
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| scrd.exe | 2022-09-03 17:52:06 | 5d827372fe226a2ae4e2ababebaa0221 |
| elevated.exe | 2022-09-26 10:44:02 | 8a32017e36960f365076023db2432821 |
| obf.exe | 2022-11-21 23:44:02 | def004932329421183edb964d150dc2f |
| new.exe | 2022-11-26 11:07:07 | 51c6a3db5320bbe73f6c4afc29a7725d |
| new33.exe | 2022-11-26 11:37:03 | f41e454bd8f94376f0fe048abfe9b593 |
| ms.exe | 2023-01-24 19:38:32 | 253b78e6b07ba74dd5bab6c546189449 |
| py.exe | 2023-01-30 14:09:32 | f48085b102f5144a388e08592e673861 |
| testdamned.exe | 2023-04-30 07:55:05 | 6c56c4158826328c3e14422e9e54fbf8 |
| dc.exe | 2023-06-19 09:45:05 | a1dc3e2f998031a7c96685e6571f4f5f |