| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Aug-03 01:51:43 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .Bn)
The PE only has 3 import(s). |
| Info | The PE is digitally signed. |
Signer: voices38
Issuer: voices38 |
| Malicious | VirusTotal score: 5/71 (Scanned on 2026-09-06 05:31:16) |
Bkav:
W32.Malware.C1D10836
CrowdStrike: win/malicious_confidence_90% (D) Cynet: Malicious (score: 100) Elastic: malicious (moderate confidence) Microsoft: Trojan:Win32/Wacatac.B!ml |
| MD5 | f65fbe1a24a409e2d2c50a5ff32eebef 🔍 |
|---|---|
| SHA1 | c9aabbb0302ede0d8337f4941b40392db8150fef 🔍 |
| SHA256 | 29448424b1280effc72af6fc46f085598210c48fcd02c331da644b24e2b73a1b 🔍 |
| SHA3 | d624cbc99dd678b5168aec1648e60f02b3e127bec60525e2d02923eaec21c900 🔍 |
| SSDeep | 98304:wXLKAFbKthKYL5jmIcpKBQt279xvSTJlsFDSGJ/fG:0/qsW7cpKiUK1lsZDXG 🔍 |
| Imports Hash | 94032798abbebf36aa837112a84e94e7 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2026-Aug-03 01:51:43 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x33200 |
| SizeOfInitializedData | 0x10a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001500 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x3b400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x457000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x4579ad |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 3f1c223e54ce575ccdba007dbf6b8179 🔍 |
|---|---|
| SHA1 | 51e8bdbb72f32e2354186f85e684d3a380cf8de3 🔍 |
| SHA256 | 1841e1188bc23df8f3b8a61e731c3dfbf46284cd4691c72ac7b0b81b15548dd3 🔍 |
| SHA3 | 02629e1d4ae0205080912b492a3abb6777ed911ecf84f071e635e0e8c5fb1671 🔍 |
| VirtualSize | 0x33030 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x33200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 2.83717 |
| MD5 | c213e729dc8732755d834f2f2262def7 🔍 |
|---|---|
| SHA1 | b2dbf1bfd6d809565484dd226383632027263ab2 🔍 |
| SHA256 | 65ff41fbf7e7de45203a477e8b991cdfa1d3c89d69b75ef88fb7ffe310f4787d 🔍 |
| SHA3 | 4c88d5422f17947ecb905a6a635816b100d25e84627f212c40053f4a423cb8de 🔍 |
| VirtualSize | 0x10000 |
| VirtualAddress | 0x35000 |
| SizeOfRawData | 0x10000 |
| PointerToRawData | 0x33600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.90418 |
| MD5 | 871d73682e53f4ae45bcb57f5c2abbd0 🔍 |
|---|---|
| SHA1 | 994e96589cc71a94ede89a0487f4eea9bb1f0f13 🔍 |
| SHA256 | 8f293f6b900a17e652d341becffa3564e45fd4f87b26903a42c8be16cc378ea6 🔍 |
| SHA3 | dd95a6300a059f1b3673fd3ee0270d026baee2d4c7175442c90815dfe11ea58c 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x45000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x43600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.434165 |
| MD5 | 41f421d844f0f31daca5342b14e757f1 🔍 |
|---|---|
| SHA1 | 00d3af6bbfd9655fd1da8a4d256b97ba28684827 🔍 |
| SHA256 | f0f727e86cd25517513ed6916ceae6cafae71e93ee0e1f21f4a1c3a7cdfbb594 🔍 |
| SHA3 | d9b2ad4052ec71a18ec3c08ec925ce1cac0317d9497c734ec64c5ce11a262782 🔍 |
| VirtualSize | 0x18 |
| VirtualAddress | 0x46000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x43800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.483985 |
| MD5 | bfedd79b8d8ac737b2ca31f621c1856a 🔍 |
|---|---|
| SHA1 | 398de5c4de6ebced85658ba87ab0918198650e6f 🔍 |
| SHA256 | 434297d0d838aaaef7a7b939a06d26377c6329d35139c043d384dd244888675e 🔍 |
| SHA3 | d254280c112813ffd9c987049c811b3c38afab89eaa58b5de4e1a28f650c05b9 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x47000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x43a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.190489 |
| MD5 | cdd9812ce9cf4ad6c02a324eceb21967 🔍 |
|---|---|
| SHA1 | c8351472542d40dddc2213ebbdeb241ba88d702f 🔍 |
| SHA256 | 0b56449ed161877c48dd5b9ae7ff51f1605b48e1a9a5cc834b6f4ff65eeec5b3 🔍 |
| SHA3 | b881316278b2e5ca1f88555dc273d271b0591d8f28d2bc3d2da4db3fb59957fe 🔍 |
| VirtualSize | 0x4f |
| VirtualAddress | 0x48000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x43c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.91193 |
| MD5 | 14613016ca8aa3d2d1a1342cf1822fdb 🔍 |
|---|---|
| SHA1 | b97e80d4856da21bdd1cd21ebbe4005ce27f301f 🔍 |
| SHA256 | 12e16439363eaed4c37aa1289160ed35447833a65f8f8317bd5cd3e259afe0ae 🔍 |
| SHA3 | 122720be024acb52516cf3437970598aa00d2c01016bcc6cf3cfecf025639288 🔍 |
| VirtualSize | 0xe8 |
| VirtualAddress | 0x49000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x43e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.74222 |
| MD5 | a9fcfad12e896b4ec2c1fe670b3bbbcd 🔍 |
|---|---|
| SHA1 | a25af10e1439b3c7e23a4d4b2313c3792004c9a0 🔍 |
| SHA256 | 7343b4eba1c8912547576e51700b8c4fcaf26bf77f0563f6c1547068af1a5137 🔍 |
| SHA3 | dfe634d7655d47380db2c9e2c8c470ce33a19dff2729a907fae07ee195abb01c 🔍 |
| VirtualSize | 0x40b0ac |
| VirtualAddress | 0x4a000 |
| SizeOfRawData | 0x40b200 |
| PointerToRawData | 0x44000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
|
| Entropy | 7.51111 |
| MD5 | 42fd0be3f63f2a1a9662d7e499824b6e 🔍 |
|---|---|
| SHA1 | 18851a7f801de9e333a8c5e8612309d440fba813 🔍 |
| SHA256 | 1406974138768ea65cf843672b89a8e09a8a6c7059ea82dc08c524e45640be39 🔍 |
| SHA3 | 2db07178bdd4e7328c36755218e5e3759cc88e47d56c8a92eddb75d42b862a5d 🔍 |
| VirtualSize | 0xc4 |
| VirtualAddress | 0x456000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x44f200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.7579 |
| KERNEL32.dll |
ExitProcess
VirtualProtect |
|---|---|
| USER32.dll |
MessageBoxA
|
| Ordinal | 1 |
|---|---|
| Address | 0x1000 |
No comments yet.