17ed3880ed1c3a22f7cb46e3f986b30c63943463393b680d6f4ed2f6c453bd90
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Feb-01 20:22:18 |
Plugin Output
| Info | Matching compiler(s): | MASM/TASM - sig2(h) |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource 7482870DF6B44BF7738BA894F6AD4140 is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 34/67 (Scanned on 2026-11-09 10:59:04) |
AhnLab-V3:
Trojan/Win32.Agent.R259682
Alibaba: Trojan:Win32/Kryptik.1e80d601 Antiy-AVL: Trojan/Win32.Agent CrowdStrike: win/malicious_confidence_70% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.MulDrop28.60980 Elastic: malicious (high confidence) Fortinet: W32/Agent.MAZDI!tr GData: Win32.Trojan.Agent.W4TNY4 Google: Detected Gridinsoft: Trojan.Win32.Agent.vb!s1 Jiangmin: RiskTool.Generic.kkp K7AntiVirus: Trojan ( 005d9b921 ) K7GW: Trojan ( 005d9b921 ) Lionic: Trojan.Win32.Dapato.tsra Malwarebytes: Malware.AI.4231750508 MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!17ED3880ED1C Microsoft: Trojan:Win32/Wacatac.C!ml NANO-Antivirus: Trojan.Win32.Scrop.eytdxi Paloalto: generic.ml Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Suspicious PE Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score VBA32: Trojan.Agent Varist: W32/Trojan.MNUQ-5487 VirIT: Trojan.Win32.Genus.XWT Webroot: W32.Malware.Gen Yandex: Trojan.GenAsa!xeYOOG2tugU Zillya: Trojan.Shelma.Win32.1656 |
Hashes
| MD5 | c3176519edae0aba14a87de864e57fac 🔍 |
|---|---|
| SHA1 | a5e804f116954ebfa6a41c0f9ba492d6058c87cc 🔍 |
| SHA256 | 17ed3880ed1c3a22f7cb46e3f986b30c63943463393b680d6f4ed2f6c453bd90 🔍 |
| SHA3 | c0af6f7062105848995f4448a2fc600df2dd036856d83619ffab798fe23659c8 🔍 |
| SSDeep | 1536:tk7fTsqBbFkvQ21/ipICdckP+o1Ll5PlNg1qkXTcIOlnToIf6vG9pq9T1OT:MwqhFkv93CSk5DJkXTSNTBf6e9pq9m 🔍 |
| Imports Hash | 2adb28da7b9fece4b360fc7188d2f05c 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2018-Feb-01 20:22:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xfe00 |
| SizeOfInitializedData | 0x8000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x12000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
| MD5 | b729b25a916638015e2caaa79da47f5d 🔍 |
|---|---|
| SHA1 | 444fda36e2ea77a77ad347403b6289b943699d0a 🔍 |
| SHA256 | 5c623154a52940c24002446e3abc7a4112947dd195de0f4eac32b40af3531ed7 🔍 |
| SHA3 | 9f9743f130b704a9daf48b830211f586634af3f1c1b0c2caf14dd48bfdf90060 🔍 |
| VirtualSize | 0x3018 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x3200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.51797 |
.text
| MD5 | 1fa7311f693f1815cedfcd8d90089d6e 🔍 |
|---|---|
| SHA1 | 4d178fb5b957aeed89734127977582d3d8e26ea9 🔍 |
| SHA256 | 0afcafe9cbb93806cdca177e6ed458822d78f3e4d52a43efce303e6f1231e7d0 🔍 |
| SHA3 | 2def0924d98ce9bfff8ffa43fbd4ab122340e3902fa7d8692a7a8afa5b894b75 🔍 |
| VirtualSize | 0xcaa2 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0xcc00 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.58019 |
.rdata
| MD5 | 6784f513fac4815ca52b2a1098c59370 🔍 |
|---|---|
| SHA1 | 3aef23f6fc51062b5d1ded994c194b02300ac51f 🔍 |
| SHA256 | c921d0b441a0daec25616a445930b1a356217220055d11969409024c45cf3182 🔍 |
| SHA3 | 8f3c70a202ef020a7abb7742bc9cfcbf61399a4aa0371e29c5a1e6b74679adad 🔍 |
| VirtualSize | 0x33a0 |
| VirtualAddress | 0x12000 |
| SizeOfRawData | 0x3400 |
| PointerToRawData | 0x10200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.109 |
.data
| MD5 | f001a9b61758bdde3e4ae6335deffae9 🔍 |
|---|---|
| SHA1 | 857f1ae7a49190d3b12a5106af11ff233d418c61 🔍 |
| SHA256 | 274aefd844164a62182a63b156f4581d3443cc8596e5816d59ea040f92e9553f 🔍 |
| SHA3 | 23ec2feb27958f82f48a5a1aaf54426fc1b84fff4c990adb29563582fa13364d 🔍 |
| VirtualSize | 0x16c4 |
| VirtualAddress | 0x16000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x13600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.28685 |
.rsrc
| MD5 | 59c704d527daac8c8a9d088f570f612c 🔍 |
|---|---|
| SHA1 | dd38e02d1bba669fe751976e4aece763b5c13337 🔍 |
| SHA256 | 16f42d35430410df870f311ae4ba2f916a674ed5a083a852b200b8637f6e7339 🔍 |
| SHA3 | c8a0e6f838e19a4bceda1b9199f29a2b12bbfdea987aac6519d123bd4c9f5ba8 🔍 |
| VirtualSize | 0x3ae4 |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x3c00 |
| PointerToRawData | 0x14600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.22017 |
Imports
| MSVCRT.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc free |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetTempFileNameW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW SendMessageW PostMessageW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathQuoteSpacesW
PathAddBackslashW PathRemoveBackslashW PathRemoveArgsW PathRenameExtensionW |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.13487 |
| MD5 | 57c473d0e2a0fed02a495dba6521641c 🔍 |
| SHA1 | 4c7331cf9f0886e966f5df7e9bd993d6c947e81a 🔍 |
| SHA256 | 8a69b1f49015b3e1e303ecc4848dd8d412767cc00b7dcf2f93d483f037f12651 🔍 |
| SHA3 | be9ff962c1a57717a808031dfc7d448e514ab4f5cd51ccf5c321488ce8b7c626 🔍 |
5E4EDBC0AABAF4D0985B3DBA36A35B92CAE506A2
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x10 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4 |
| MD5 | b14865269274e0db0681be25e72f82aa 🔍 |
| SHA1 | 81e6d7100b96fa84497e640f75d84b84c930f40f 🔍 |
| SHA256 | 84b38429c531badf31ac7ab1b9508b6c6a2f5f3e11b9673d2e035d7951d9a307 🔍 |
| SHA3 | 93473e20ef8eca774731ea73d2985a7e8978c82bdc7e465be10f78be69f24c8b 🔍 |
7482870DF6B44BF7738BA894F6AD4140
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xff1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.95507 |
| MD5 | 50da184710a71559586e397d44ee1166 🔍 |
| SHA1 | 9821660f527bd90d55425b08a5595fbf64ff60ff 🔍 |
| SHA256 | 17949a4c1a36654182dba1bae62a13757f68564742e5cc0c45b2caf0463193ec 🔍 |
| SHA3 | 1d7965f15f83e67c8c7b2679063bd8897b48a8deb4d50f92b4d91755994fd477 🔍 |
BCA7FAF3F507E7DCE20C765F3CA2FA95
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xe |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.23593 |
| MD5 | 7bb55e591962edd967c9a3039407256c 🔍 |
| SHA1 | e84642313805d66ef70fdada202992d040a1c2cc 🔍 |
| SHA256 | 8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91 🔍 |
| SHA3 | 116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91 🔍 |
F5CDF44339
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | 55a54008ad1ba589aa210d2629c1df41 🔍 |
| SHA1 | bf8b4530d8d246dd74ac53a13471bba17941dff7 🔍 |
| SHA256 | 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a 🔍 |
| SHA3 | 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.91924 |
| Detected Filetype | Icon file |
| MD5 | 6da8e7d5ae1d5d15e0230a67a7c16c6d 🔍 |
| SHA1 | 678db52cbe5d617c33c6269bfd4b6d8d1a17f956 🔍 |
| SHA256 | 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396 🔍 |
| SHA3 | 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x263 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.92322 |
| MD5 | 841795bb3b61ebd511249778aa26af77 🔍 |
| SHA1 | 59f426938522ef9906b0740821e8cc270d1ca897 🔍 |
| SHA256 | be809cba9d14bfb52a969d766992832b10e99e133babcdd99dc6d1bba5597cf7 🔍 |
| SHA3 | 5fa5c36711cc5c3661248b1180ce35543201ff1dc77d158129b844f03a2144c9 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.