005ff3b5624fc5b594da3463619f3b0420684357138af6d46e51592853507868

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-02 02:19:01
Detected languages English - United States
FileVersion 1.0.0.0
ProductName nova client
ProductVersion 1.0.0.0

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Malicious VirusTotal score: 32/71 (Scanned on 2026-10-02 20:00:47) ALYac: Gen:Variant.Doina.125545
APEX: Malicious
AVG: Win64:Evo-gen [Trj]
AhnLab-V3: Trojan/Win.Generic.R774250
Arcabit: Trojan.Doina.D1EA69
Avast: Win64:Evo-gen [Trj]
Avira: TR/W64.Evo
BitDefender: Gen:Variant.Doina.125545
Bkav: W32.Malware.C2CEEACF
CTX: exe.unknown.doina
CrowdStrike: win/malicious_confidence_90% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/GenKryptik.HQGK trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Doina.125545 (B)
F-Secure: Trojan.TR/W64.Evo
Fortinet: W64/GenKryptik.HQGK!tr
GData: Gen:Variant.Doina.125545
Google: Detected
Ikarus: Trojan.Win64.Krypt
Kaspersky: VHO:Trojan.Win64.Agent.gen
Kingsoft: malware.kb.a.959
McAfeeD: ti!005FF3B5624F
MicroWorld-eScan: Gen:Variant.Doina.125545
Microsoft: Trojan:Win64/Doina.SQ!MTB
Rising: Trojan.Lazy!8.8EC3 (TFE:4:N7au4O3z2iE)
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
VIPRE: Gen:Variant.Doina.125545
Varist: W64/AEiApp.A5050FB0!Eldorado
huorong: Trojan/Obfuscated.jg

Hashes

MD5 128c1ff5b619ae8649fca606e76d3bfa 🔍
SHA1 a81f2c628d21ca19538dbe2a2773e32e1eb27b58 🔍
SHA256 005ff3b5624fc5b594da3463619f3b0420684357138af6d46e51592853507868 🔍
SHA3 69d1922c07e8892c9744af8f38986baaef92361e8f627b33237c5f6d9a81cd4d 🔍
SSDeep 24576:8qhdCOrm9Leqde99SveCDMCa/SpMVkBwcy7QCj+Z3g0ztl150rj9:M8m9yqbDPa/b+w3jq3VPIr 🔍
Imports Hash e6c6166959e9db1494bb9a620affb282 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Oct-02 02:19:01
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x4600
SizeOfInitializedData 0x155c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x161000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 63d26b773ad03a153861124011e3ea11 🔍
SHA1 5f6f952f98ef2102b7970268eb494ff38aa51f69 🔍
SHA256 30abb204cc035cb82140d1318d9c5eff58b5ac44b4252179efa7398a9b13ec61 🔍
SHA3 659e4c7e9026e22c409bc8db3b14e610b10448918f92de9448330a474b7e1952 🔍
VirtualSize 0x44c6
VirtualAddress 0x1000
SizeOfRawData 0x4600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.38485

.rdata

MD5 cf2d6c2b76b2f8b475599949ba3ce42f 🔍
SHA1 32edb2c1008b8b60d37487f4e705e51198dc96df 🔍
SHA256 dc6be90ecbe3555cd6c2575b6a821fdec6ba7db152bcec688eca2849d647ca19 🔍
SHA3 851af2ffecd4250de1f3a84bb67fe4688416e4f27a4f08ab53601a5ebe970035 🔍
VirtualSize 0x154ed8
VirtualAddress 0x6000
SizeOfRawData 0x155000
PointerToRawData 0x4a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99889

.data

MD5 10562efdacfdc1859a1c55630fd97b92 🔍
SHA1 39fa8dc476b5fde223aa36a61c2937309624d087 🔍
SHA256 06650d63d6729d121926b01c985a02e6771447127a9ad09d697bb76dae596fcf 🔍
SHA3 b2081d0d0e8755e76b47e3be81dc8dd02e8664d8e607533de5e8d73c989ad506 🔍
VirtualSize 0xa8
VirtualAddress 0x15b000
SizeOfRawData 0x200
PointerToRawData 0x159a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.41398

.pdata

MD5 a1b9fee556f4b727ffcf43aaa066f90a 🔍
SHA1 2977b28e3156acefdaa5c2832429559582bdee99 🔍
SHA256 f98484da5c37dc2869314ccddd937f80a4d848e05a166e63f6ac6bf388ca4b18 🔍
SHA3 0be492640375f9198a2807467ae050bea6818b6a4a9e4a0372a192d42f2fe790 🔍
VirtualSize 0x15c
VirtualAddress 0x15c000
SizeOfRawData 0x200
PointerToRawData 0x159c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.10381

.CRT

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x15d000
SizeOfRawData 0x200
PointerToRawData 0x159e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x2
VirtualAddress 0x15e000
SizeOfRawData 0x200
PointerToRawData 0x15a000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 906ab2d45cd0fa0f00a787078933189b 🔍
SHA1 388f7dafb975b40b1fd033dd0bc0a894d790aa06 🔍
SHA256 782039830656dac7c05c55992365eee411f173528c2bf9e8327568a24500be2a 🔍
SHA3 32a91c1cf9ca4c67a00e20f9a223e568d9eb62fca7b405ecf2cae0478e5fdfe8 🔍
VirtualSize 0x1d8
VirtualAddress 0x15f000
SizeOfRawData 0x200
PointerToRawData 0x15a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.69402

.reloc

MD5 d32abd94e2852064c541b6d3f6183e7d 🔍
SHA1 7ae1af91d1317195cdcfbc0cc303c67d31d72be2 🔍
SHA256 a5ff5fe34cffa8b02d0329b8c2729f0f98aadb200fce3734b9005f99bc647737 🔍
SHA3 8443a2dc9bc78de1068345abc46b5f0b23f6821f743420772fa160a5f34e53f4 🔍
VirtualSize 0x20
VirtualAddress 0x160000
SizeOfRawData 0x200
PointerToRawData 0x15a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.409253

Imports

ntdll.dll RtlExitUserProcess
KERNEL32.dll AddVectoredExceptionHandler
CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
CreateThread
GetCurrentProcess
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetTempPathW
GetTickCount
HeapAlloc
LoadLibraryA
Sleep
VirtualAlloc
VirtualFree
WriteFile
USER32.dll MessageBoxA

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x178
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10367
MD5 564183ab31000a88dbb3241ceb62909c 🔍
SHA1 2bfcdf21b4f09200e9214c1da14f15130a29e002 🔍
SHA256 4979428cede8e01b4a9c66bd8cfd91d3d97be39eb921a148b66c35af9b090aa0 🔍
SHA3 d68fd9903f76f16d77926165459b6ad86e11fbaea0ce89db690047efab0e9d49 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileVersion (#2) 1.0.0.0
ProductName nova client
ProductVersion (#2) 1.0.0.0
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x55e000
EndAddressOfRawData 0x55e001
AddressOfIndex 0x55b000
AddressOfCallbacks 0x55d000
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_1BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.