0f058f66e58e1cd18e60cb6a66f0eda5b85de0ad7950f20bfe36e4261b98b411

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Sep-19 10:28:00
Detected languages English - United States

Plugin Output

Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
Malicious VirusTotal score: 17/71 (Scanned on 2026-09-23 11:19:15) APEX: Malicious
Bkav: W32.Malware.E19C0D21
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.Themida.L suspicious application
Elastic: malicious (high confidence)
Malwarebytes: Malware.Heuristic.2025
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!0F058F66E58E
Microsoft: Trojan:Win32/Sabsik.EN.A!ml
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.high.ml.score
Zoner: Probably Heur.ExeHeaderL
tehtris: Generic.Malware

Hashes

MD5 7af420cbe052a5955acba49535afb76f 🔍
SHA1 ee1d3603676e08ec0649cbacc005ecc28843c68b 🔍
SHA256 0f058f66e58e1cd18e60cb6a66f0eda5b85de0ad7950f20bfe36e4261b98b411 🔍
SHA3 f626893d9e1567eadf529bc430d7d82e40f946c4856319ba642fef22b2e29308 🔍
SSDeep 49152:H1ODYAaXvbHFcpSUxRaDWaWifZE0wqaT4wxoWSf8zWWgNy6hdG879HTY:IkAaXpcpSUzaDWap60w9KG6NjHTY 🔍
Imports Hash 3c48dbeaffaed70fd03fd8cc432cb762 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Sep-19 10:28:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x4200
SizeOfInitializedData 0x2a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000004BE058 (Section: .boot)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x78c000
SizeOfHeaders 0x400
Checksum 0x2d4555
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 8864409206e9e16631e49d13f755b7a4 🔍
SHA1 226c1b239f831e22b5840ebcb643cf742659ce70 🔍
SHA256 daef313209bc74e85b843d7d7e027ae503436da78200f664b0ee4946686a3c29 🔍
SHA3 9a7b9a2831c7bb168dbf49061ef084c7c9f7e24721f7495f43ede15118c6df3b 🔍
VirtualSize 0x40bc
VirtualAddress 0x1000
SizeOfRawData 0x3c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.91119

(#2)

MD5 8438e19f145da9e183849aaca21399af 🔍
SHA1 d541f5b4f727c66d29ebabbf137928df03f0ac0b 🔍
SHA256 05175c2eae9adb2c1cd8739aac0554050b0284e831b10d40f5482c360ae84f34 🔍
SHA3 d0fb27e10ab3bddc5b26971752d9aea613743f500bb3bf59910f895b8d07f49a 🔍
VirtualSize 0x17d0
VirtualAddress 0x6000
SizeOfRawData 0x800
PointerToRawData 0x4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.86546

(#3)

MD5 5cb98b8149332becb286ef5e15910ce4 🔍
SHA1 8a5eca6d73b701cf679db7bddd4ad0dedd5d640e 🔍
SHA256 4a92b5da6065c90c47543f25f6b70b4cad9be87f4f98b030bde5c3106ef0b12f 🔍
SHA3 57d69145db181190df5c5f80e78c383a79995c636d8fbe98cb0fd1cb2743fb54 🔍
VirtualSize 0x8e0
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.82982

(#4)

MD5 f353580e533beaa0d5f13e8ebe73925f 🔍
SHA1 65bf51f22d752fb7ff157b2336b3ccb28f0f0828 🔍
SHA256 3f390a11c3fee1a60d1b3af6053cf28d4032b4cc65dc797d0f83d1c91e5a1896 🔍
SHA3 ae63315e41e942579777b527e5f2788259fb2e5513bbe6dd33c10495acc1a268 🔍
VirtualSize 0x348
VirtualAddress 0x9000
SizeOfRawData 0x200
PointerToRawData 0x4a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.1952

(#5)

MD5 e54a372716e053fc22e9f059e7e8aec5 🔍
SHA1 7e1bd23052d83f4fd7425cf6ea9fc6e00363e32a 🔍
SHA256 26dbc1e21364c73b04c2d5a8dd94d1539aa4485e948af4c9d230dfcab1413f4a 🔍
SHA3 bcd61ae4b6da79577a0f07803f003a12653b7dfc1b120fe1597265d676345d8b 🔍
VirtualSize 0x1e0
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x4c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.63524

(#6)

MD5 9d8b7a873dcfc9c093aa4d2a0abb41cd 🔍
SHA1 4d83283bf3d26821fe374a7a2e0093247b92bcbd 🔍
SHA256 f606dc7f2f5a16fe6f43ca9a6ee17d8ef0b452b297e57eb6cf83bb5da6cef3db 🔍
SHA3 4927f959bd2de9985a4751354437ca2251d69387812936a3db0977c4e2584ebd 🔍
VirtualSize 0x30
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x4e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.10829

.idata

MD5 de0f2d57ad006e02ca5a506584fa1fec 🔍
SHA1 bab599edd684e486b399fdc847191f5ae3c1aa5f 🔍
SHA256 1bd7475b3099dd606d711d237c3d5f8af615cdaf1bc4bf36b389979969929bbe 🔍
SHA3 8e58e4b46afcde68421afebcc43e289c61e9a7c141ee966f3a869fae01943e24 🔍
VirtualSize 0x1000
VirtualAddress 0xc000
SizeOfRawData 0x400
PointerToRawData 0x5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.22823

.rsrc

MD5 2ef32d4b9bd93c572a4b92be5bdd3112 🔍
SHA1 59f85b8b45f1b4b15aa4dd04ec6644ae18cb6f4b 🔍
SHA256 271455d50b50f532f3dec218e21224e36bb0efdbb69b0165f7e4d82d28dd03c9 🔍
SHA3 dd4a5bfcbb026a8e2a10ede35f66fc14926e8ba83359f1e9788668176c553ded 🔍
VirtualSize 0x1000
VirtualAddress 0xd000
SizeOfRawData 0x200
PointerToRawData 0x5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x4b0000
VirtualAddress 0xe000
SizeOfRawData 0
PointerToRawData 0x5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 f68a740d6a2aaffe454ccb6be41e8aa1 🔍
SHA1 eb5487ac18ad3d1e3bef6f15681dda60629e8881 🔍
SHA256 fa763df92f243d7c7c5e173bf15961e8797a13dea2574c3ef0fba5994361ee12 🔍
SHA3 93d2dc71aa8b7c590d111cff53dadb8845f3199e0c034f4c2cbbc6cb19a41123 🔍
VirtualSize 0x2ce000
VirtualAddress 0x4be000
SizeOfRawData 0x2ce000
PointerToRawData 0x5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.95877

Imports

kernel32.dll GetModuleHandleA
VCRUNTIME140.dll __current_exception
api-ms-win-crt-utility-l1-1-0.dll srand
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
api-ms-win-crt-string-l1-1-0.dll toupper
api-ms-win-crt-runtime-l1-1-0.dll _initterm
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x901de250
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
Imports (35207) 2
ASM objects (35207) 4
C objects (35207) 10
C++ objects (35207) 19
Imports (33145) 3
Total imports 71
C++ objects (LTCG) (35214) 4
Resource objects (35214) 1
Linker (35214) 1

Errors

[*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.