i9ien8gksg.dll
First submission 2023-09-14 10:56:02
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1094.0 KB (1120256 bytes) |
| Compile time: | 2023-09-11 18:16:49 |
| MD5: | fcbb53724b1df93a5d1fc45bb55b9069 |
| SHA1: | 890b9b2dfda3203dc1a65c926d45b4e55db7c01a |
| SHA256: | 33e80e854c0959e28b1f94cdcd67e28298dcfa3d80d160bc2042f00047a81922 |
| Import Hash : | 660e4ba65070c42e55f04efddf5f7d78 |
| Sections 7 | .text .rdata .data .pdata .gfids .rsrc .reloc |
| Directories 4 | import export resource relocation |
| Virus Total: | 15/70 VT report date: 2023-09-14 08:48:10 |
File features detected
Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://23.88.100.71/i9ien8gksg.dll  |
23.88.100.71 |
2023-09-14 10:56:03 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xe849 | 59904 | ef30c5e954f119e882a203672b4590932f20aa66 | 0b38afbba0ec6fbd686032b9370e46f5 | |
| .rdata | 0x10000 | 0x41a26 | 269312 | f7610ce8a8f4d9688511b401f4227094821d4e42 | 19b614be781b1f5ee1f7e64fe3e25251 | |
| .data | 0x52000 | 0xbfd38 | 781312 | 4cff7ee7047c9951057a43bfcde56b5dbdd4940e | 707dc3d96e72818f6741a91c06f58b25 | |
| .pdata | 0x112000 | 0xe4c | 4096 | 834d7a7d4160777addb7bbfa4eb5941fbebc31f5 | 7207be020e0b7ba2d72c05fda5cd2d5c | |
| .gfids | 0x113000 | 0x94 | 512 | abea4113f9b478c04c57c2a1d03a271972c762f3 | 2f68f83abdd02cff1eb2214e91b9a309 | |
| .rsrc | 0x114000 | 0x728 | 2048 | 0c55dd4c0998fed3b6019e177e9106fb279b7af0 | cbc8a329d23b29cf1007bd2a03f54f84 | |
| .reloc | 0x115000 | 0x61c | 2048 | 4eb889fd1bf8e1df6592986ca1bc07fee4cc7300 | a409acf9bb3ff0b703a28054a403c662 |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114320 | 646 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x1145a8 | 381 | |
| None | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x114120 | 196 |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| mscoree.dll |
| utpcxre663tc32.dll |
| KERNEL32.dll |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| DllRegisterServer | 0x18000f244 |
| Name | Latest seen | MD5 |
|---|---|---|
| oyylqpp3ia.dll | 2023-09-14 10:52:03 | 45f4c6ea59bc7a8c2d20098698104940 |
| jyi6mm2w2g.dll | 2023-09-14 10:54:03 | 7d2156efddf126dfb4c466da06f15e11 |
| 6sev8udq1h.dll | 2023-09-14 10:55:02 | 3a96a42f6d6334a36d2ea26abb0a2c95 |
| hk1c9y18em.dll | 2023-09-14 10:57:03 | a6ac1a8bb63362ed7515f2ca02fb52be |