0b044d8b7dcbf25b42f8ab93775ac942
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2004-Aug-04 06:01:37 |
| Detected languages |
Chinese - PRC
|
| CompanyName | Microsoft Corporation |
| FileDescription | Win32 Cabinet Self-Extractor |
| FileVersion | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) |
| InternalName | Wextract |
| LegalCopyright | (C) Microsoft Corporation. All rights reserved. |
| OriginalFilename | WEXTRACT.EXE |
| ProductName | Microsoft(R) Windows(R) Operating System |
| ProductVersion | 6.00.2900.2180 |
Plugin Output
| Suspicious | PEiD Signature: |
ASProtect SKE 2.3 -> Alexey Solodovnikov (h)
ASPack v2.12 |
| Suspicious | The PE is packed with Aspack or Armadillo |
Unusual section name found:
Section is both writable and executable. Unusual section name found: Section is both writable and executable. Section .rsrc is both writable and executable. Section .data is both writable and executable. Unusual section name found: .adata Section .adata is both writable and executable. The PE only has 5 import(s). |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 59/72 (Scanned on 2020-07-10 13:43:42) |
Bkav:
W32.AIDetectVM.malware2
ClamAV: Win.Packed.Nsanti-6971682-0 FireEye: Generic.mg.0b044d8b7dcbf25b Qihoo-360: Win32/Backdoor.Hupigon.653 McAfee: Artemis!0B044D8B7DCB Cylance: Unsafe Zillya: Backdoor.Hupigon.Win32.64463 Sangfor: Malware K7AntiVirus: Trojan ( 005376ae1 ) Alibaba: Backdoor:Win32/Hupigon.95644e7f K7GW: Trojan ( 005376ae1 ) CrowdStrike: win/malicious_confidence_100% (D) TrendMicro: Mal_Pai-6 F-Prot: W32/Hupigon.G.gen!Eldorado Symantec: ML.Attribute.HighConfidence APEX: Malicious Cynet: Malicious (score: 100) Kaspersky: Packed.Win32.Black.d BitDefender: Backdoor.Hupigon.AYPE NANO-Antivirus: Trojan.Win32.Hupigon.iziz AegisLab: Trojan.Win32.Hupigon.lriU MicroWorld-eScan: Backdoor.Hupigon.AYPE Avast: Win32:Trojan-gen Tencent: Win32.Packed.Black.Eem Endgame: malicious (high confidence) Sophos: Mal/Behav-270 Comodo: Backdoor@#1fceyh6mfcbvn F-Secure: Trojan.TR/Dropper.Gen DrWeb: BackDoor.Pigeon.5402 VIPRE: Trojan.Win32.Generic!BT Invincea: heuristic Trapmine: malicious.high.ml.score Emsisoft: Backdoor.Hupigon.AYPE (B) Ikarus: Virus.Win32.Oliga Cyren: W32/Hupigon.G.gen!Eldorado Jiangmin: Backdoor/Huigezi.2008.fav Avira: TR/Dropper.Gen Fortinet: W32/Hupigon.GE!tr.bdr Arcabit: Backdoor.Hupigon.AYPE ViRobot: Backdoor.Win32.Hupigon.706048.P ZoneAlarm: Packed.Win32.Black.d Microsoft: Backdoor:Win32/Hupigon.FI AhnLab-V3: Win-Trojan/Hupigon3.Gen Acronis: suspicious BitDefenderTheta: AI:Packer.59313CE81D ALYac: Backdoor.Hupigon.AYPE MAX: malware (ai score=100) VBA32: Trojan-Dropper.Kaos ESET-NOD32: Win32/Packed.ASProtect.AAC TrendMicro-HouseCall: Mal_Pai-6 Rising: Backdoor.Gpegion!1.6634 (CLOUD) Yandex: Backdoor.Hupigon!oWYBtbdb8fU TACHYON: Backdoor/W32.Hupigon.704000.DF eGambit: Unsafe.AI_Score_100% GData: Backdoor.Hupigon.AYPE Ad-Aware: Backdoor.Hupigon.AYPE AVG: Win32:Trojan-gen Cybereason: malicious.b7dcbf Panda: Trj/CI.A |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2004-Aug-04 06:01:37 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 7.1 |
| SizeOfCode | 0x9a00 |
| SizeOfInitializedData | 0x52c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00060000 (Section: ) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xb000 |
| ImageBase | 0x1000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 5.1 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x110000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x5eaf1 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x40000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
Section_1
Section_2
.rsrc
.data
.adata
Imports
| kernel32.dll |
GetProcAddress
GetModuleHandleA LoadLibraryA |
|---|---|
| oleaut32.dll |
VariantChangeTypeEx
|
| kernel32.dll (#2) |
GetProcAddress
GetModuleHandleA LoadLibraryA |
Delayed Imports
1
2
3000
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 6.0.2900.2180 |
| ProductVersion | 6.0.2900.2180 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Chinese - PRC |
| CompanyName | Microsoft Corporation |
| FileDescription | Win32 Cabinet Self-Extractor |
| FileVersion (#2) | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) |
| InternalName | Wextract |
| LegalCopyright | (C) Microsoft Corporation. All rights reserved. |
| OriginalFilename | WEXTRACT.EXE |
| ProductName | Microsoft(R) Windows(R) Operating System |
| ProductVersion (#2) | 6.00.2900.2180 |
| Resource LangID | Chinese - PRC |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x43facbb6 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2003 (.NET) build 4035) | 13 |
| Total imports | 134 |
| 94 (VS2003 (.NET) build 4035) | 1 |
| C objects (VS2003 (.NET) build 4035) | 27 |
| Linker (VS2003 (.NET) build 4035) | 1 |
Errors
[*] Warning: Section has a size of 0!
[*] Warning: Section .adata has a size of 0!