14b5dd95adc937a34a7018b5bb8cc20d09b691a476fc8f8860923e3d3c7a3b55

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-29 17:19:15
Detected languages English - United States

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Suspicious The file contains overlay data. 353820 bytes of data starting at offset 0x22a00.
The overlay data has an entropy of 7.99943 and is possibly compressed or encrypted.
Malicious VirusTotal score: 16/71 (Scanned on 2026-09-22 04:56:26) APEX: Malicious
Antiy-AVL: Trojan/Win32.Agent
Bkav: W32.Malware.CB1A53D0
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_90% (D)
Cynet: Malicious (score: 100)
Elastic: malicious (high confidence)
Fortinet: W32/PossibleThreat
McAfeeD: ti!14B5DD95ADC9
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Rising: Trojan.Kryptik@AI.86 (RDML:sFnKJZbr7M5/LALuTBzyDA)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!632984D0B42A

Hashes

MD5 632984d0b42a7b5f66d94e00e0063bf4 🔍
SHA1 8639132b7f18514a261f42b50db9bd60c4a05465 🔍
SHA256 14b5dd95adc937a34a7018b5bb8cc20d09b691a476fc8f8860923e3d3c7a3b55 🔍
SHA3 9f762dac280439f66180c712c9de8caafc91fde43d12df02e5d3189a37421a3f 🔍
SSDeep 12288:iGm0OrOUVAVWiKL6f8QtrUZRv3PupMbkm54iw:iGmgZKqrUXubm5o 🔍
Imports Hash 1b83b56846b92a7800106e386acbf7f2 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-29 17:19:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x14c00
SizeOfInitializedData 0xe400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000002880 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x28000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ac675f3616ec47ad213d993918e739cc 🔍
SHA1 3add85883efd5f0230e0b603087f988d02457eeb 🔍
SHA256 2e8932db164798c3ad07bb23d801baa021f08f5f871958ac696750d09e553f88 🔍
SHA3 0c14aa880072f92b61d7e7ff3894873ab2a53dc93af58edb15611904dc364511 🔍
VirtualSize 0x14a80
VirtualAddress 0x1000
SizeOfRawData 0x14c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.49125

.rdata

MD5 1c3373014bec95656f9f9d4bb366a61b 🔍
SHA1 9cc34e70eac2f87db8efafa8dd7fd428867c0716 🔍
SHA256 e514392f0c2123a96be7c50875e0df7b9de214d5bc18ca9e0abe67666ca4c301 🔍
SHA3 087e68ae364a7b56a4b41aa5a01ce87e4fc38d543075e7534e6e71fcc4a89348 🔍
VirtualSize 0xadfe
VirtualAddress 0x16000
SizeOfRawData 0xae00
PointerToRawData 0x15000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.99091

.data

MD5 2eb91d18f66eb2b5aa53d34c96aaeed0 🔍
SHA1 9825cc256fd11f10b9d5627de2dddfc8071ca07f 🔍
SHA256 1c9720f8b234ae76d3410183b48ddec56aab6ceb21bf01960247418bbc380803 🔍
SHA3 c7dc3ac3aeb2920ca7930f98183a1fdf2bb71e41086155f060c626aacc8b8edf 🔍
VirtualSize 0x15f8
VirtualAddress 0x21000
SizeOfRawData 0xc00
PointerToRawData 0x1fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.07185

.pdata

MD5 e524ee39f03dfc9993ea9ced7476dad6 🔍
SHA1 41a344a444aa3d04dfeec5121578b8d9463e2bdd 🔍
SHA256 2fe1371aeb422803e6e1c7491f9c431c68341215624d23c8121ab08ce86ada1c 🔍
SHA3 fb3ce67b107411273cd0d108d9a37229b00290a2f43c9a70af6b6d4cb8aad64a 🔍
VirtualSize 0x135c
VirtualAddress 0x23000
SizeOfRawData 0x1400
PointerToRawData 0x20a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.94966

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x25000
SizeOfRawData 0x200
PointerToRawData 0x21e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 427f554a3525eb742c0443df523fadba 🔍
SHA1 283f3a10d73caef1bdb726707053fad157efd0b9 🔍
SHA256 f33f286a120e5312fcd9f6ccdce915cf210210489bb5182ed9ce4fdfbf2d7183 🔍
SHA3 7619ca681f4c9fa5579dbfb3a7df0b8dfb0344e2c1f8ba842488953abb505fac 🔍
VirtualSize 0x1e0
VirtualAddress 0x26000
SizeOfRawData 0x200
PointerToRawData 0x22000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71377

.reloc

MD5 4e3b9f4939b91f252413542978a4ae03 🔍
SHA1 ef43db334918aff1a074928dfff24d7b2b235c7d 🔍
SHA256 8ed0f278c346eecc52ff8a880b930654afae30637900e29fcbc5c85ba11f490d 🔍
SHA3 53070d5e93657dff3135e02a8adafcb0b3d94a25e474a1fe125b25c147e6d7c5 🔍
VirtualSize 0x690
VirtualAddress 0x27000
SizeOfRawData 0x800
PointerToRawData 0x22200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.95376

Imports

KERNEL32.dll CreateFileW
DeleteFileW
GetFileSize
ReadFile
WriteFile
GetTempPathW
IsDebuggerPresent
CloseHandle
WaitForSingleObject
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThreadId
CreateProcessW
GetTickCount64
GetModuleFileNameW
WriteConsoleW
GetConsoleMode
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
GetStdHandle
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
USER32.dll MessageBoxW

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-29 17:19:15
Version 0.0
SizeofData 840
AddressOfRawData 0x1ed40
PointerToRawData 0x1dd40

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140021000

RICH Header

XOR Key 0x40b35a84
Unmarked objects 0
C++ objects (33145) 142
C objects (33145) 12
ASM objects (33145) 6
ASM objects (35721) 9
C objects (35721) 16
C++ objects (35721) 42
Imports (33145) 5
Total imports 94
C++ objects (36252) 1
Resource objects (36252) 1
Linker (36252) 1

Errors

Leave a comment

No comments yet.