33fcb34e896dd0cc3f52a83140ef08660b97fbc726b05e1cf155ee260efc7b66
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Oct-31 20:13:19 |
| Detected languages |
English - United States
|
| FileVersion | 0.1.0 |
| CompanyName | Bunni |
| ProductVersion | 0.1.0 |
| ProductName | Bunni |
| FileDescription | Bunni |
Plugin Output
| Suspicious | PEiD Signature: | MoleBox v2.0 |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .cl}
Unusual section name found: .J8' Unusual section name found: .-Y> |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Can access the registry:
|
| Malicious | VirusTotal score: 46/71 (Scanned on 2026-11-11 06:07:26) |
ALYac:
QD:Trojan.GenericKDQ.022B31A374
AVG: Win64:MalwareX-gen [Misc] Alibaba: Trojan:Win64/VMProtect.1af669a6 Antiy-AVL: Trojan/Win32.Ravartar Arcabit: QD:Trojan.GenericQ.022B31A374 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: QD:Trojan.GenericKDQ.022B31A374 Bkav: W32.Malware.849101E6 CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe Cynet: Malicious (score: 99) ESET-NOD32: Win64/Packed.VMProtect.AC suspicious application Elastic: malicious (high confidence) Emsisoft: QD:Trojan.GenericKDQ.022B31A374 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: Riskware/Application GData: QD:Trojan.GenericKDQ.022B31A374 Google: Detected Gridinsoft: Trojan.Heur!.02212023 Ikarus: PUA.VMProtect K7AntiVirus: Riskware ( 005cde2a1 ) K7GW: Riskware ( 005cde2a1 ) Kingsoft: Win32.Troj.ravartar.v Lionic: Trojan.Win32.GenericKDQ.4!c Malwarebytes: Malware.Heuristic.2108 MaxSecure: Trojan.Malware.613480200.susgen McAfeeD: ti!33FCB34E896D MicroWorld-eScan: QD:Trojan.GenericKDQ.022B31A374 Microsoft: Trojan:Win32/Ravartar!rfn Paloalto: generic.ml Panda: Trj/CI.A Rising: Trojan.Kryptik@AI.88 (RDML:ezKG1JRvEz60dlis6kGCfA) Sangfor: Trojan.Win64.VMProtect.V9du SentinelOne: Static AI - Suspicious PE Skyhigh: Artemis Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrellixENS: Artemis!74FB179E7A78 TrendMicro: TROJ_GEN.R002C0DK726 TrendMicro-HouseCall: TROJ_GEN.R002C0DK726 VIPRE: QD:Trojan.GenericKDQ.022B31A374 Varist: W64/ABApplication.VNQD-0513 alibabacloud: VirTool:Win/Packed.VMProtect.AW |
Hashes
| MD5 | 74fb179e7a78f64394be92e6dcc6c57e 🔍 |
|---|---|
| SHA1 | 0774fc2f55fd4a707589683a94f46f10c24ee485 🔍 |
| SHA256 | 33fcb34e896dd0cc3f52a83140ef08660b97fbc726b05e1cf155ee260efc7b66 🔍 |
| SHA3 | b93ff3f636ce8bc9efeb9be1590856a26fd9928606798b27ef254711821c1b0b 🔍 |
| SSDeep | 393216:PBW3Y/NpXOocYztcNUzmsshWdWmM55YX7TovMjqX5lsDtGW+Q5/AG:PsuN0IztyCmspddM55YYvwKNKI 🔍 |
| Imports Hash | eec41be41bdb4e333f2c058b5926485f 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Oct-31 20:13:19 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xa34a00 |
| SizeOfInitializedData | 0x615200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000026904C8 (Section: .-Y>) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x34f0000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xa34960 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x56b116 |
| VirtualAddress | 0xa36000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x34b8 |
| VirtualAddress | 0xfa2000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.pdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x95844 |
| VirtualAddress | 0xfa6000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.cl}
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xbc9d6b |
| VirtualAddress | 0x103c000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.J8'
| MD5 | 940403c650adfd7dc25169deee6eac84 🔍 |
|---|---|
| SHA1 | 78bf3d5ac32d025008e153580934c12740c65b2a 🔍 |
| SHA256 | 38ca5db47ee6a2d68e27e39ebd08eb97499b22ff882c32d00297bee65ad968c8 🔍 |
| SHA3 | f215e0e23bee71abe0edc35b0c8db759b66459f46597f7733ebf7a5861364e0e 🔍 |
| VirtualSize | 0x3b8 |
| VirtualAddress | 0x1c06000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.07194 |
.-Y>
| MD5 | 591666c1dfbc5946a6e6de499fd3b8df 🔍 |
|---|---|
| SHA1 | bf24ee835d6426412d63cb80469144600a634070 🔍 |
| SHA256 | f076f68067db0636947e6111e5607c35a7ca6d9fdd712fb2583aeadb422abab8 🔍 |
| SHA3 | 4a93bc604ca98c087fee594f790390889e59b59a2e97cc4bcafb1efb4908449e 🔍 |
| VirtualSize | 0x18dd77c |
| VirtualAddress | 0x1c07000 |
| SizeOfRawData | 0x18dd800 |
| PointerToRawData | 0x800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
|
| Entropy | 7.78182 |
.rsrc
| MD5 | d8371388b4fa455f0204338197be62ad 🔍 |
|---|---|
| SHA1 | c8e7c2f20a83ea28f096692cc7405fafe90625ed 🔍 |
| SHA256 | 018a27fd981d01cb2bfb422ff7a51345d269e890cbaf7f4952b8a581e017cce6 🔍 |
| SHA3 | 14c250b3990e639ef705b71577023b223f2f5f3ed0b24470399fba2a55914c93 🔍 |
| VirtualSize | 0xa1d6 |
| VirtualAddress | 0x34e5000 |
| SizeOfRawData | 0xa200 |
| PointerToRawData | 0x18de000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.9243 |
Imports
| kernel32.dll |
AcquireSRWLockExclusive
|
|---|---|
| user32.dll |
SetCursorPos
|
| comctl32.dll |
RemoveWindowSubclass
|
| shell32.dll |
SHOpenFolderAndSelectItems
|
| ole32.dll |
CoTaskMemAlloc
|
| shlwapi.dll |
SHCreateMemStream
|
| oleaut32.dll |
SetErrorInfo
|
| ntdll.dll |
NtDeviceIoControlFile
|
| gdi32.dll |
CreateSolidBrush
|
| dwmapi.dll |
DwmEnableBlurBehindWindow
|
| api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
|
| bcryptprimitives.dll |
ProcessPrng
|
| CRYPT32.dll |
CryptUnprotectData
|
| kernel32.dll (#2) |
AcquireSRWLockExclusive
|
| ws2_32.dll |
WSAStartup
|
| advapi32.dll |
RegCloseKey
|
| bcrypt.dll |
BCryptGenRandom
|
| api-ms-win-crt-math-l1-1-0.dll |
round
|
| api-ms-win-crt-string-l1-1-0.dll |
wcscmp
|
| api-ms-win-crt-convert-l1-1-0.dll |
_ultow_s
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_initialize_onexit_table
|
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x617 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.64948 |
| Detected Filetype | PNG graphic file |
| MD5 | b5cd51e63c05d0fd00cd48db4dc30f87 🔍 |
| SHA1 | 5958bc0753f591d24d4b8f350c3b757fe429f1a1 🔍 |
| SHA256 | 2373fab7512f0db1c4d4500519ab9160c2e54720fa7eee29b895668803f562ae 🔍 |
| SHA3 | 35392c16b04c6764b6e104d3d98069cd2ac494192882e705301903e8afa9bbf6 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x260 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.44307 |
| Detected Filetype | PNG graphic file |
| MD5 | 26c0a9e44e1d2eba952bd32a78ab73ff 🔍 |
| SHA1 | 7297e3286de9c041b762fd3cf71caf0bf10bb8d1 🔍 |
| SHA256 | 9757ecf4f0bd182b2f5b928606a597e058082e12ecaca1233b49fd0623d4c88c 🔍 |
| SHA3 | 62ee9160ee6352b4e96a7a948fba6f145995f96e4d238d46ff6fd03f46b14810 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x415 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.61749 |
| Detected Filetype | PNG graphic file |
| MD5 | af84bdd25add79c45344df986b4eb1a0 🔍 |
| SHA1 | 75f540bb7cb79b1447ed65dff854c87953b1b012 🔍 |
| SHA256 | b1307541bfc0d6a124b54a261151b2e4c89881f270aee8d629721d6425f3c1ea 🔍 |
| SHA3 | d99eceb7f1c0f8aa503605afcce0372fb66b34bbbf6973c8412eedcb46175c80 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xaa7 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.69167 |
| Detected Filetype | PNG graphic file |
| MD5 | ad5046023b36a69183e318e2473c87f6 🔍 |
| SHA1 | 106b130bb0b2c810048b5217d57e7e4f7980e80a 🔍 |
| SHA256 | 31e6d4ca858cf310bf0fa8f4c608a6b9cb2589a0c365272e1193d76352fc79f5 🔍 |
| SHA3 | de9ced6305039f0271091bd9c8b8eae4e0a0de306868ef5ac31d5d77bb9b1379 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xff3 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.70921 |
| Detected Filetype | PNG graphic file |
| MD5 | 85afd1fb0e73a726426315b375efed40 🔍 |
| SHA1 | 545adca8d1490f6c1740d1f4d0d60f28d776c83a 🔍 |
| SHA256 | e04e6f5f946fc6c3db88bdadbda19f109aff1f80a1cc5043f2b62553bf13e48f 🔍 |
| SHA3 | cbcbb96c2c5a850589609c2b0c476e5c3098baa6d95315f78e3a465abf99933b 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x750d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.97673 |
| Detected Filetype | PNG graphic file |
| MD5 | e9aa3ed4e569f6e29acc3a77b6430810 🔍 |
| SHA1 | 582e102df7595606ab97e6fd5636ea38d9438bed 🔍 |
| SHA256 | 500b1372bf48c982ec857343ee9fbf3a9fb39508089713b202fb3a99ed54f1d4 🔍 |
| SHA3 | 4a03f1c72f1e2517f60ec7a636459007bf3fc840e15d9c492752beceec4061b3 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.79371 |
| Detected Filetype | Icon file |
| MD5 | 04fe87d7fd2d3c66b11ae83a12eeefcb 🔍 |
| SHA1 | 727d3f4342a3c18474a5320e8c5d1c92f428fa5b 🔍 |
| SHA256 | 230478c4ee2c54b1b542bb068110ca03d754dedb74fa823887361d767bfa3466 🔍 |
| SHA3 | c4fd3524bbe236d258abe4e5d5d1466d5f3b613f2300e31ab3137baa9c363094 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x1c4 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.06258 |
| MD5 | 19e117d9c0b25eb367cac9434b1100b5 🔍 |
| SHA1 | e4584a1ffb374df3b24895cfe9ea66b1456941ec 🔍 |
| SHA256 | 2e1d6513e3d6b79c9b5e31d1d1dee60702ca924a3532f7d27930f90b0ad0fb67 🔍 |
| SHA3 | d57fce7ac74eef20dbb51f17f3f8dcf413789b91db649061eade081964ce1d4c 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.96056 |
| MD5 | 01e4c8c046a47771f13cd120b53303e7 🔍 |
| SHA1 | 2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9 🔍 |
| SHA256 | b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8 🔍 |
| SHA3 | 680120ec819e7ba66519d9a8a3e446973c4cb28aa0146c91cceaa8c8fadc90ae 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.1.0.0 |
| ProductVersion | 0.1.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileVersion (#2) | 0.1.0 |
| CompanyName | Bunni |
| ProductVersion (#2) | 0.1.0 |
| ProductName | Bunni |
| FileDescription | Bunni |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140fa2e00 |
RICH Header
Errors
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .pdata has a size of 0!
[*] Warning: Section .cl} has a size of 0!
Leave a comment
No comments yet.