14d44d2677b35487c3b0b183091eba3f9bf933803eea7eef6615ae87d498913e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-13 00:42:26
Detected languages English - United States

Plugin Output

Suspicious PEiD Signature: PeStubOEP v1.x
Suspicious The PE is possibly packed. Unusual section name found: .^6K
Unusual section name found: .s,e
Unusual section name found: .O[r
Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • ShellExecuteW
Malicious VirusTotal score: 38/65 (Scanned on 2026-09-05 05:01:50) ALYac: Trojan.GenericKD.81197940
APEX: Malicious
Alibaba: Packed:Win64/VMProtect.6322fbc3
Antiy-AVL: Trojan/Win64.GenKryptik
Arcabit: Trojan.Generic.D4D6FB74
Avira: TR/W64.Agent
BitDefender: Trojan.GenericKD.81197940
Bkav: W32.Malware.F300C954
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.VMProtect.AC suspicious application
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.81197940 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: Riskware/Application
GData: Trojan.GenericKD.81197940
Google: Detected
Gridinsoft: Trojan.Heur!.02212023
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.AI.3115456036
McAfeeD: Real Protect-LS!B3CFE1DA59B1
MicroWorld-eScan: Trojan.GenericKD.81197940
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Rising: Trojan.Kryptik@AI.83 (RDML:SB+z1FdTFBHTMKg6DqGDNA)
Sangfor: Trojan.Win64.Packed.V0tu
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win64.Dropper.tc
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
VIPRE: Trojan.GenericKD.81197940
Varist: W64/ABApplication.RJWD-4756
Zillya: Trojan.VMProtect.Win64.29216
alibabacloud: VirTool:Win/Wacatac.B9nj
tehtris: Generic.Malware

Hashes

MD5 b3cfe1da59b156ee60078db998753502 🔍
SHA1 74390e0a5db238d30a1be12c1c6e7617f5ba7042 🔍
SHA256 14d44d2677b35487c3b0b183091eba3f9bf933803eea7eef6615ae87d498913e 🔍
SHA3 3b257700c4b055bccafb6056ee1683792136518e8e2c7ecfd414884310b2e371 🔍
SSDeep 196608:y49xYP6D/+4e/TOFpptLV59+RJBordwRPUB99dP/MLK/w9AEU/8FPdi0:yS7de/CFZn9+RJmxLdF/aAsPM0 🔍
Imports Hash f515b1c31422a5f6b82f3f56f6ecaef8 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2026-Aug-13 00:42:26
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x11a000
SizeOfInitializedData 0x100a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000B9BF6C (Section: .O[r)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1709000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x119e81
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xf2134
VirtualAddress 0x11b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2800
VirtualAddress 0x20e000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xb370
VirtualAddress 0x211000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.^6K

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x7cb18f
VirtualAddress 0x21d000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.s,e

MD5 f10bb601062f9eb6b74ea257df298a9b 🔍
SHA1 c370be55d7aae456b8e0a0727fb2120532222315 🔍
SHA256 26bf44ac7d912c3019ee90780810b0018e0d589f87518cc688d94e83ab77e24b 🔍
SHA3 60c9336098fbf400b9e73bad98642516241eb1d66361be703da2a155232ef9fa 🔍
VirtualSize 0x1b0
VirtualAddress 0x9e9000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.56671

.O[r

MD5 f980d76f0aa7aa9e7355944f93cb2e98 🔍
SHA1 3daf51144ddc8a7587e5f7e5980cdf8a95570363 🔍
SHA256 1857629a7d327d25f8a8bdeb1a3692891ebe8c4db10e67fdac96f65e444918f3 🔍
SHA3 86b6a8e6c77d64800fec44c27eeb528f335c017fff594c2014eb550b6df9aa11 🔍
VirtualSize 0xd1c6ec
VirtualAddress 0x9ea000
SizeOfRawData 0xd1c800
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.80272

.rsrc

MD5 ee8271ec608e2b8ab41367548ddd0d62 🔍
SHA1 dfb205d14ee7c6244b3926714b0203acf94c4025 🔍
SHA256 e1bc73a5bdae8c67e8483430fb477c2f0682ae83a4ad310156bac2b6d7fa3984 🔍
SHA3 a013db2cd1fc4523288961693da6b61c194bda2a838b889bdd0f5dff43caf627 🔍
VirtualSize 0x1d5
VirtualAddress 0x1707000
SizeOfRawData 0x200
PointerToRawData 0xd1ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.72231

.reloc

MD5 11f64250590e7d33547fde282dc41a0c 🔍
SHA1 722ac4231edeb9ffefa473eb47748e62e90cdc39 🔍
SHA256 7e8e78f4a8ecf4553f22af5610e19994eb90e109b77f70f55b385d00e5167210 🔍
SHA3 948d42e8753ec5f820374809d8493c470cca2a6b5ed0b5539bf4ebcdb9ec818b 🔍
VirtualSize 0xbc
VirtualAddress 0x1708000
SizeOfRawData 0x200
PointerToRawData 0xd1d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.05039

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
dwmapi.dll DwmGetWindowAttribute
COMDLG32.dll GetOpenFileNameW
ntdll.dll ZwWriteVirtualMemory
KERNEL32.dll GetModuleHandleW
USER32.dll GetKeyState
SHELL32.dll ShellExecuteW
MSVCP140.dll _Thrd_join
IMM32.dll ImmSetCandidateWindow
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __intrinsic_setjmp
api-ms-win-crt-stdio-l1-1-0.dll fwrite
api-ms-win-crt-string-l1-1-0.dll strcpy_s
api-ms-win-crt-runtime-l1-1-0.dll _initialize_onexit_table
api-ms-win-crt-filesystem-l1-1-0.dll rename
api-ms-win-crt-convert-l1-1-0.dll atoi
api-ms-win-crt-heap-l1-1-0.dll realloc
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-math-l1-1-0.dll sqrt
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-environment-l1-1-0.dll getenv

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14020e040

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .^6K has a size of 0!
Leave a comment

No comments yet.