| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Sep-22 04:09:01 |
| TLS Callbacks | 1 callback(s) detected. |
| Suspicious | The PE is possibly packed. |
Section .data is both writable and executable.
Section .text is both writable and executable. The PE only has 6 import(s). |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 22/71 (Scanned on 2026-10-03 17:35:16) |
APEX:
Malicious
AVG: Win64:Evo-gen [Trj] AhnLab-V3: Trojan/Win.Evo-gen.R799103 Avast: Win64:Evo-gen [Trj] Avira: TR/W64.Evo Bkav: W32.Malware.4B4E6E89 CrowdStrike: win/malicious_confidence_90% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win64/GenKryptik_AGen.FWV trojan Elastic: malicious (high confidence) F-Secure: Trojan.TR/W64.Evo Kaspersky: VHO:Trojan.Win32.SelfDel.gen MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!32F082754B5B Microsoft: Trojan:Win32/Wacatac.B!ml Rising: Trojan.Kryptik@AI.83 (RDML:meeVPeU7F0/tRWeF9twamA) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score |
| MD5 | a428be446be6e14fb34559d970d1339c 🔍 |
|---|---|
| SHA1 | 26eba8fc4a08755d466ec975b8fbf405a538f011 🔍 |
| SHA256 | 32f082754b5bd8360a3d52022d7a14f5b6707875d08fe2e6ffd7124d467196d5 🔍 |
| SHA3 | 4434af1c7979b3b4d489163e7ca23509e6027d0cbdbaa752fb4e691d9247ce56 🔍 |
| SSDeep | 768:Xw5SbDRvJHLd5tIqSmPXV+Ed+b2kaGIR+zTj568Nyu78hwZT+Ouu:XI+DTJnIqBX1dzkaGjo80e8uZyhu 🔍 |
| Imports Hash | b920d0991f4648fe46f38cb48270d268 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 2026-Sep-22 04:09:01 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xc000 |
| SizeOfInitializedData | 0x1000 |
| SizeOfUninitializedData | 0x13000 |
| AddressOfEntryPoint | 0x000000000001F090 (Section: .text) |
| BaseOfCode | 0x14000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x21000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x13000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | a297d2af9bcea730d79a819da526c98f 🔍 |
|---|---|
| SHA1 | 2e8b02abe16ecd718c94fcbc70ba91c29a434a62 🔍 |
| SHA256 | b073380b78ad6bea2debaa6a6f3c9f1a7a71a3a281ea32f552c3b7b49adb87c9 🔍 |
| SHA3 | 79b6ca6345387387f922337f09fbdaa7bdfc68b9498b18834ed027eee4c23ad6 🔍 |
| VirtualSize | 0xc000 |
| VirtualAddress | 0x14000 |
| SizeOfRawData | 0xb400 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.86927 |
| MD5 | 1172a454cbde8989b178d9f4ab8e5f5e 🔍 |
|---|---|
| SHA1 | 57bc920228172c141592db33aeba039546ad2012 🔍 |
| SHA256 | 58ff5ce03f020f885473f1c6ecc582d264c91f3a90f38334c3632fbf80ad5f90 🔍 |
| SHA3 | 1a566246cafd348a2aa4d170ea4000192cdb4c21053dfacb64637cbb06736389 🔍 |
| VirtualSize | 0x1000 |
| VirtualAddress | 0x20000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xb600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.12063 |
| KERNEL32.DLL |
LoadLibraryA
ExitProcess GetProcAddress VirtualProtect |
|---|---|
| msvcrt.dll |
exit
|
| WS2_32.dll |
bind
|
| StartAddressOfRawData | 0x14001f358 |
|---|---|
| EndAddressOfRawData | 0x14001f360 |
| AddressOfIndex | 0x14001a08c |
| AddressOfCallbacks | 0x14001f360 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x000000014001F304
|
No comments yet.