26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2016-Jan-09 12:11:59 |
| Detected languages |
English - United States
|
| Debug artifacts |
GoogleCrashHandler_unsigned.pdb
|
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA1
Uses constants related to SHA256 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 66/70 (Scanned on 2026-06-15 00:50:51) |
ALYac:
Trojan.Ransom.Petya
APEX: Malicious AVG: Other:Malware-gen [Trj] AhnLab-V3: Trojan/Win32.Ransom.R177575 Alibaba: Ransom:Win32/Petya.8d8 Antiy-AVL: Trojan[Ransom]/Win32.Petya.aa Arcabit: Trojan.Ransomware.BM Avast: Other:Malware-gen [Trj] Avira: TR/Malware BitDefender: Trojan.Ransomware.BM Bkav: W32.LuckiiQwufsR.Trojan CAT-QuickHeal: Ransom.Petya.S5 CTX: exe.trojan.petya ClamAV: Win.Trojan.Petya-5637914-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.Ransom.369 ESET-NOD32: Win32/Diskcoder.Petya.A trojan Elastic: malicious (high confidence) Emsisoft: Trojan.Ransomware.BM (B) F-Secure: Trojan:W32/Petya.A Fortinet: W32/Petya.EOB!tr.ransom GData: Win32.Trojan.Agent.IT92BA Google: Detected Gridinsoft: Ransom.Win32.Gen.cc!s1 Jiangmin: TrojanRansom.Petya.a K7AntiVirus: Ransomware ( 005d115b1 ) K7GW: Ransomware ( 005d115b1 ) Kaspersky: Trojan-Ransom.Win32.Petr.a Kingsoft: malware.kb.a.984 Lionic: Trojan.Win32.Petya.j!c Malwarebytes: Petya.Ransom.MBRLock.DDS MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Trojan:Win/Petya.B MicroWorld-eScan: Trojan.Ransomware.BM Microsoft: Ransom:Win32/Filecoder.DLK!MTB NANO-Antivirus: Trojan.Win32.Crypted.ebffer Paloalto: generic.ml Panda: Trj/RansomCrypt.E Rising: Ransom.Petr!1.B334 (CLASSIC) SUPERAntiSpyware: Ransom.Petya/Variant Sangfor: Suspicious.Win32.Save.ins SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win32.NetLoader.dh Sophos: ATK/Shellter-AC Symantec: Trojan Horse TACHYON: Ransom/W32.Petya.230912 Tencent: Malware.Win32.Gencirc.10be8de3 Trapmine: malicious.high.ml.score TrellixENS: Generic .jy TrendMicro: Ransom_PETYA.A TrendMicro-HouseCall: Ransom_PETYA.A VBA32: Trojan.Ransom VIPRE: Trojan.Ransomware.BM Varist: W32/Trojan.NREO-5105 ViRobot: Trojan.Win32.Z.Petya.230912.A VirIT: Trojan.Win32.CryptoPetya.A Xcitium: Malware@#16w0g1hhe70i6 Yandex: Trojan.Petr!74zaaTOl8KA ZoneAlarm: Troj/Ransom-CPS Zoner: Trojan.Win32.40474 alibabacloud: RansomWare huorong: Ransom/Petya.c tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2016-Jan-09 12:11:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 12.0 |
| SizeOfCode | 0x27000 |
| SizeOfInitializedData | 0x14200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001716F (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x28000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x45c45 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| KERNEL32.dll |
GetCurrentThreadId
GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CreateSemaphoreW FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind LCMapStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW SizeofResource LockResource LoadResource FindResourceW FindResourceExW LocalFree CreateDirectoryW DeleteFileW GetCurrentThread WaitForMultipleObjects LoadLibraryW WaitForSingleObject GetExitCodeProcess DuplicateHandle ReleaseMutex GetEnvironmentVariableW lstrcmpiW VirtualQuery GetTempPathW GetLocalTime OutputDebugStringA GetPrivateProfileIntW GetPrivateProfileStringW lstrcmpW lstrlenW SetFilePointer CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent ResetEvent GetFileAttributesExW SetLastError VerifyVersionInfoW VerSetConditionMask MoveFileExW GetFileTime ReadFile DeviceIoControl SetProcessWorkingSetSize OpenProcess CreateProcessW ReadProcessMemory lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree CreateThread DebugActiveProcess GetThreadContext DebugActiveProcessStop VirtualQueryEx GetProcessId GetSystemInfo ContinueDebugEvent WaitForDebugEvent WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW ExitProcess IsProcessorFeaturePresent GetCommandLineW EncodePointer LeaveCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState RtlCaptureContext ReleaseSemaphore EnterCriticalSection OutputDebugStringW DeleteCriticalSection DecodePointer HeapSize GetProcAddress GetLastError RaiseException HeapDestroy InitializeCriticalSectionAndSpinCount GetProcessHeap GetModuleHandleW HeapFree IsDebuggerPresent GetUserDefaultLangID GetSystemDefaultLangID GetComputerNameExW GetOverlappedResult ConnectNamedPipe CreateNamedPipeW DisconnectNamedPipe UnregisterWait GetProcessTimes UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc HeapAlloc RemoveDirectoryW HeapReAlloc |
|---|---|
| USER32.dll |
SetClipboardData
EmptyClipboard OpenClipboard GetProcessWindowStation CloseDesktop CloseClipboard CharUpperW CharLowerW PostThreadMessageW DispatchMessageW GetMessageW PeekMessageW EnumWindows IsWindowVisible GetWindowThreadProcessId SetThreadDesktop CreateWindowStationW CloseWindowStation GetThreadDesktop SetProcessWindowStation CreateDesktopW wvsprintfW wsprintfW MessageBoxW |
| ADVAPI32.dll |
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW OpenThreadToken RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityDescriptorSacl GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids TraceEvent SetTokenInformation |
| ole32.dll |
CoCreateGuid
StringFromGUID2 |
| SHELL32.dll |
SHGetFolderPathW
|
| NETAPI32.dll |
NetApiBufferFree
NetWkstaGetInfo |
| RPCRT4.dll |
UuidCreate
|
| SHLWAPI.dll |
PathRemoveExtensionW
PathRemoveFileSpecW PathStripPathW PathCanonicalizeW PathIsRelativeW SHQueryValueExW PathAppendW |
| USERENV.dll |
UnloadUserProfile
|
| VERSION.dll |
GetFileVersionInfoW
VerQueryValueW GetFileVersionInfoSizeW |
Delayed Imports
1
100
1 (#2)
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2016-Jan-09 12:11:59 |
| Version | 0.0 |
| SizeofData | 56 |
| AddressOfRawData | 0x32000 |
| PointerToRawData | 0x31400 |
| Referenced File | GoogleCrashHandler_unsigned.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2016-Jan-09 12:11:59 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x32038 |
| PointerToRawData | 0x31438 |
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x435980 |
| SEHandlerTable | 0x4323a0 |
| SEHandlerCount | 7 |
RICH Header
| XOR Key | 0x7dfef65c |
|---|---|
| Unmarked objects | 0 |
| C++ objects (VS2013 build 21005) | 73 |
| ASM objects (VS2013 build 21005) | 30 |
| C objects (VS2013 build 21005) | 201 |
| C++ objects (20806) | 2 |
| C objects (65501) | 4 |
| Imports (65501) | 33 |
| Total imports | 468 |
| 229 (VS2013 UPD2 build 30501) | 101 |
| Resource objects (VS2013 build 21005) | 1 |
| Linker (VS2013 UPD2 build 30501) | 1 |
Errors
Leave a comment
No comments yet.