3420b2994b505cf26171f3e497609266f32cf064210d7b4a6bd9d75c2a7a1198

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-18 11:03:24
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • api.github.com
  • github.com
  • https://api.github.com
  • https://api.github.com/repos/
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Has Internet access capabilities:
  • WinHttpQueryHeaders
  • WinHttpReceiveResponse
  • WinHttpSendRequest
  • WinHttpAddRequestHeaders
  • WinHttpOpenRequest
  • WinHttpSetTimeouts
  • WinHttpReadData
  • WinHttpConnect
  • WinHttpCloseHandle
  • WinHttpOpen
  • WinHttpCrackUrl
 Can take screenshots:
  • GetDC
  • CreateCompatibleDC
  • BitBlt
Suspicious The PE is possibly a dropper. Resources amount for 85.7163% of the executable.
Malicious VirusTotal score: 5/70 (Scanned on 2026-09-19 07:58:10) APEX: Malicious
CrowdStrike: win/malicious_confidence_60% (D)
Elastic: malicious (high confidence)
Microsoft: Trojan:Win32/Wacatac.B!ml
Rising: Trojan.Kryptik@AI.80 (RDML:XxfjeV6CmjRhn6zfvrZPJQ)

Hashes

MD5 c6cf16bec140ca7a0ed49ca52fcb5046 🔍
SHA1 d8d78ea3dd0a0cf228326c4850860f56cc5db640 🔍
SHA256 3420b2994b505cf26171f3e497609266f32cf064210d7b4a6bd9d75c2a7a1198 🔍
SHA3 cb0b8fc7f8093829bf7e1c175648d5336b5268d03f0440c7f629558eedb77937 🔍
SSDeep 49152:FIFcsGzsmVPwtNodYMrXqpSJNYYPl+j9YxFop2tye2dvITtw6h76UgY:IcoiYt9MupSJ1dgdpvdMjui 🔍
Imports Hash 683fd38291d0737c97a48df63f908462 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-18 11:03:24
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x51000
SizeOfInitializedData 0x2c4000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000002B590 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x318000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f2810247222bdaf72077fcc33e2a00b1 🔍
SHA1 45fdd677d8ad3a7f87ad56138dc4b90d7277abbf 🔍
SHA256 d4e2e8a9184ee7a641033d61b562e6648857cea512615b97a554c5b3645f24a0 🔍
SHA3 72061e1e64eee60a39677b6cb6bdd978be0371ff330494eed9c8f07439aa6c5a 🔍
VirtualSize 0x50e6c
VirtualAddress 0x1000
SizeOfRawData 0x51000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.43294

.rdata

MD5 68bc1409b3a026a4a7ef053661df4cbd 🔍
SHA1 7e9721c86def06d2da8010c6f1199366b4289317 🔍
SHA256 7677a9a0876382f8a21c9a844ebba15de8a1de3eb376e9a468eba26954a78d81 🔍
SHA3 6a1e46d482e4ad9d067e6cd435fb14a4625a75f178d5f99dddcc1439c41a426e 🔍
VirtualSize 0x18d5e
VirtualAddress 0x52000
SizeOfRawData 0x18e00
PointerToRawData 0x51400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.18624

.data

MD5 4d6b0ea6af4a66e5511c6d86e452afdf 🔍
SHA1 cd63352b879c1e052089a8e20e466f9c5a83dbbf 🔍
SHA256 a4e3044b03ac525ec8c93460e1ee9df3d5bea9736fe9c6b67a37b4f94c349e56 🔍
SHA3 0a827629977dc6e51caa5bbfdf6702aad87d4bbca8d4b071a852fe43d5b394bd 🔍
VirtualSize 0x2de8
VirtualAddress 0x6b000
SizeOfRawData 0x1800
PointerToRawData 0x6a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.03655

.pdata

MD5 439db180e1cc3126ca345cc0ba8e1b69 🔍
SHA1 33fc1f55811a0622c8c564bf1ca87126162a8859 🔍
SHA256 bc032af5d9efa0f1a3a995492d896e8c34fbf9f374042b307f482bb8ae802793 🔍
SHA3 cdfa8625d4cac00b40a3c85251454492f19edbb4c9e268258e85485ab6b6c549 🔍
VirtualSize 0x3cfc
VirtualAddress 0x6e000
SizeOfRawData 0x3e00
PointerToRawData 0x6ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.65678

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x72000
SizeOfRawData 0x200
PointerToRawData 0x6f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 c81441c9a6b73929600306a36f55cddc 🔍
SHA1 cd39ea11d54a1dda48973d36156dbf3b138c3da7 🔍
SHA256 1c0a2e1e95ea6e3b5da9bc8ede5aa6430efc3bf1f125d1b19929d378d1b37133 🔍
SHA3 cbf6dca1b8592eb372a001a7eb788f9fc703b064d05129cd8d8100f7c9c284da 🔍
VirtualSize 0x2a37d8
VirtualAddress 0x73000
SizeOfRawData 0x2a3800
PointerToRawData 0x6fa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.9939

.reloc

MD5 04e4b68533c5f0737346ae7acdcbee9b 🔍
SHA1 a0cd19fcffc1e0cf41b000c5c08e0130478defa2 🔍
SHA256 27920f52c11a7d56728104f40ec0c26acef475d0f66899d7763fddec48a0a8e3 🔍
SHA3 e7d904a8b177532f47483e70422060ffcfca0fbbb8ac414b9c9a14acb1ad75c1 🔍
VirtualSize 0xa84
VirtualAddress 0x317000
SizeOfRawData 0xc00
PointerToRawData 0x313200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.17259

Imports

COMCTL32.dll #410
#413
InitCommonControlsEx
ole32.dll CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
WINHTTP.dll WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
KERNEL32.dll CreateProcessW
GetModuleHandleW
GetProcAddress
MulDiv
MultiByteToWideChar
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileW
DeleteFileW
WriteFile
GetLastError
MoveFileExW
GetModuleFileNameW
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CloseHandle
LoadLibraryExW
VirtualProtect
GetFileType
HeapAlloc
HeapFree
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
ExitProcess
GetCurrentProcess
GetStdHandle
IsProcessorFeaturePresent
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
ExitThread
CreateThread
RtlUnwind
FlsFree
FlsSetValue
SetEnvironmentVariableW
SetFilePointerEx
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
HeapSize
WriteConsoleW
LCMapStringW
LocalFree
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFinalPathNameByHandleW
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
GetFileInformationByHandleEx
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
SetEndOfFile
USER32.dll IsDialogMessageW
LoadIconW
LoadCursorW
SetWindowLongPtrW
GetWindowLongPtrW
InflateRect
FillRect
DrawFocusRect
AdjustWindowRect
GetClientRect
GetWindowTextW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SystemParametersInfoW
DrawTextW
GetSystemMetrics
EnableWindow
MsgWaitForMultipleObjects
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
UpdateWindow
GDI32.dll SetBrushOrgEx
SetTextColor
SetStretchBltMode
StretchDIBits
SetBkMode
SelectObject
SelectClipRgn
RoundRect
IntersectClipRect
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreatePen
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3a5
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.7206
Detected Filetype PNG graphic file
MD5 0c4b15f9e1573404eac75e5b7c90b31d 🔍
SHA1 6edd67cba991022f5bac3eeb04012b338054931e 🔍
SHA256 0a937673127ad2e524d4d818a5cb81c168e9eff7a60801200817f2a12d814287 🔍
SHA3 3dfcd961e3d6270f9b5febe1fc89b9026adeaf347ab4eac1e90259b6bc30d685 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x7a6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86143
Detected Filetype PNG graphic file
MD5 857d395601b6aaaa830f80edd0eae00b 🔍
SHA1 e31cf904cf37a5a6b8622b3bc021dc59e151ce97 🔍
SHA256 57585acfdce8998be6ffed932614ecdf0f87865f2d41a39ae98b2d86e9d3b8f1 🔍
SHA3 255ee8080728cd9ff2ed6b018e88c5e5c9f81d25270f7bc47915fd61d78988c6 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xd32
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91914
Detected Filetype PNG graphic file
MD5 88a0ea461bf8302c8548f7ba55e456fa 🔍
SHA1 a72f09a87f93a3c8a6623fbf133862f91e26188a 🔍
SHA256 9cdc1db89cc59474e75238d149aea84ea33629d6246f234c813f84c3e850c18e 🔍
SHA3 5bdbbe2cafda8a1a9bcbc06f4bb97e53368bf65d62ec5ae0632519a744c679c9 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1d13
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96402
Detected Filetype PNG graphic file
MD5 5095cb1ae4cf886f42846040ce3948c8 🔍
SHA1 3aab846f71ad3ead09b8266c2d3299e3a375b386 🔍
SHA256 4bcf99f216cd3261f5f05c623d1b007c9c5930a713b27334d543df31f9e9347a 🔍
SHA3 5284c0fd9ad395107a965aa699cc5a97b149500e18e405f6201f4a880d4b7bb7 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3327
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97598
Detected Filetype PNG graphic file
MD5 b6c0cec827c15a8b2d4fe5c877c92bae 🔍
SHA1 a0a7896cdcc506d5883fc77e5a82c2ad4b9983eb 🔍
SHA256 ed7619dcb5ee53ed1013ace7a08690cc9a378f2389ad2d9edd5e60bb5f7f9a7a 🔍
SHA3 7717c55e0d891b2c1eca83419e6f2e17a2ad13abe70ade46bcadd018814bb3d4 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xc5d1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98788
Detected Filetype PNG graphic file
MD5 ad988901b09113df22da7d04dcad8fd4 🔍
SHA1 b36161fae588912ccba103611ba2b14d66f14c67 🔍
SHA256 68486997299a96ff298c2991f5231a4c285a24c352bd35e0fd7bcebf3197f808 🔍
SHA3 b843c84d859d004c6ee2d3e903a7b6ca60be95ca506d5cc1c8ebf7f729d90f77 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2ee64
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99597
Detected Filetype PNG graphic file
MD5 4362d4ae1feff08080398675d2c1624c 🔍
SHA1 af81326636a1798d184cebc1b5e26646478a8ada 🔍
SHA256 4c4b86f6413689a658fd9bd2de68e283c684de1e76cab51a76a09ed70ea09406 🔍
SHA3 8f897eecb7500157e0f48b43f3a1982de32420bdae2f5a016728b73c2df1c9fd 🔍

101

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x2611d8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99248
Detected Filetype PNG graphic file
MD5 6756ea609c50a7ae34ae8fc767bf0b29 🔍
SHA1 129f9123b754c0b452ffa6cc96efb76767232690 🔍
SHA256 ca1b513dfc23aaa3fc53fe3e44351c3f60e793c0878cfd7fd25d228893d0789a 🔍
SHA3 a23ba70e1b822a2db119ea94b150ad0556b10721fa085b45657a0d5133c3feb6 🔍

102

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.98335
Detected Filetype Icon file
MD5 32bd572370bf3d4613a1aacf15cb2f0a 🔍
SHA1 fcac29aee42c95f0118d1cece93d3821a473d7be 🔍
SHA256 b51962b4d85f5f7785dd199767aa6c97f910e87f9520986407ff35bb2a64794a 🔍
SHA3 c6db0cddcaf15931ce9938b1d0db744553928f7a078e6a11a85e18e87775d3d1 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x639
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.14739
MD5 adab6dcbcb96f71de224b97a735f475c 🔍
SHA1 4e68cf7274ae7a929c03b364128d0fe705f52001 🔍
SHA256 f862b5e20b888c137b7983f3a26500e18563abb7aa8893a4bfc999d8e1062ee8 🔍
SHA3 63e0cef15c1c2e8ada5eab9059ba83e7ad0bddda3ce7cbfd0677956e65358905 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-18 11:03:24
Version 0.0
SizeofData 1032
AddressOfRawData 0x63570
PointerToRawData 0x62970

TLS Callbacks

StartAddressOfRawData 0x1400639c0
EndAddressOfRawData 0x1400639e8
AddressOfIndex 0x14006d0d0
AddressOfCallbacks 0x140052680
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14006b180

RICH Header

XOR Key 0x62727aec
Unmarked objects 0
C++ objects (33145) 175
ASM objects (33145) 7
253 (35721) 1
ASM objects (35721) 12
C objects (35721) 17
C++ objects (35721) 91
C objects (33145) 23
Imports (33145) 13
Total imports 213
C objects (36256) 1
C++ objects (36256) 9
Resource objects (36256) 1
Linker (36256) 1

Errors

Leave a comment

No comments yet.