| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-May-03 01:23:14 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 14/70 (Scanned on 2026-05-05 01:00:51) |
Bkav:
W64.AIDetectMalware
CrowdStrike: win/malicious_confidence_90% (D) Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Google: Detected Malwarebytes: Malware.Heuristic.2518 McAfeeD: ti!3359A111D341 Paloalto: generic.ml Sangfor: Trojan.Win32.Save.a Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101E426ZY Varist: W64/ABRisk.RZDN-5647 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-May-03 01:23:14 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2a400 |
| SizeOfInitializedData | 0x18800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000000A24C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x47000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| SHELL32.dll |
ShellExecuteExA
ShellExecuteA |
|---|---|
| ADVAPI32.dll |
GetTokenInformation
OpenProcessToken |
| KERNEL32.dll |
CreateFileW
WriteConsoleW FlsAlloc GetFileAttributesA GetFullPathNameA CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess TerminateProcess CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryW SetConsoleTitleA CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead HeapSize RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError RtlUnwind FlsGetValue FlsSetValue FlsFree ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-03 01:23:14 |
| Version | 0.0 |
| SizeofData | 900 |
| AddressOfRawData | 0x3b3b0 |
| PointerToRawData | 0x39bb0 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14003f080 |
| XOR Key | 0x3752c807 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 167 |
| C objects (33145) | 17 |
| ASM objects (33145) | 7 |
| ASM objects (35403) | 10 |
| C objects (35403) | 16 |
| C++ objects (35403) | 80 |
| Imports (33145) | 7 |
| Total imports | 115 |
| C++ objects (35730) | 1 |
| Linker (35730) | 1 |
No comments yet.