tdrp.exe
First submission 2024-10-17 01:53:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 74.5 KB (76288 bytes) |
| Compile time: | 2024-10-15 15:15:49 |
| MD5: | ff2df00e788749ba0f2ca8c29a35030c |
| SHA1: | 9638e9861cdd6a8b5e4aad28739ebd62ab12b6a1 |
| SHA256: | 8c8ef3881ab44057b4972c9112f73e334c664dace19295c5755f5a38ea6191d7 |
| Import Hash : | 4cb3381251b5ea793cf2758c80a4b865 |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 3 | import resource relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 52/77 VT report date: 2024-10-17 01:21:11 |
| Malware Type 3 | trojan downloader banker |
| Threat Type 3 | lazy clipbanker cliptoshuffler |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://185.215.113.66/tdrp.exe  |
185.215.113.66 |
2024-10-17 01:53:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xce4 | 3584 | 93ef2e9ecbf13b0000d75bccda37e449629db927 | 8a2c1ebaafb304912d7dc21edfcd9608 | |
| .rdata | 0x2000 | 0x74e | 2048 | 0dc6c91faa9beea4b938423b2ef31b904ed17c85 | 18eed5a40e3e4bf4f1be28f1da84eb51 | |
| .data | 0x3000 | 0x10aec | 67584 | 67142a9c57547fb42aa97516d9eb89987ce3396f | 1aff5ad547c4c730fc85ab2115a11e33 | |
| .rsrc | 0x14000 | 0x2b0 | 1024 | 79c7f9e3039c23759c1a6aa09f908c96b0d62a2b | d3c0a200e37454c5b637d8ffc8bf7fdf | |
| .reloc | 0x15000 | 0x2a8 | 1024 | 1745f1d34cb99f25f2237910190561e109a7c511 | 8d1b8a83be87cee29c8ad42631b1ef94 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x14058 | 598 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 3
| IsDebuggerPresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Data |
| %s\tbtnds.dat |
| Library |
| USER32.dll |
| MSVCR90.dll |
| KERNEL32.dll |