3f935e2ba7f7d4e5f8a0b6cabdbbdaaaf5d80d68838980196cbff1eb331991e0

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Oct-05 23:11:28
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 8.0
MASM/TASM - sig1(h)
Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • CreateProcessW
Info The PE's resources present abnormal characteristics. Resource 101 is possibly compressed or encrypted.
Malicious VirusTotal score: 11/68 (Scanned on 2026-11-14 16:31:52) APEX: Malicious
Bkav: W32.Malware.1BEE4CF9
CrowdStrike: win/malicious_confidence_100% (W)
DeepInstinct: MALICIOUS
Elastic: malicious (high confidence)
Google: Detected
Ikarus: Trojan.Win64.Rozena
Microsoft: Trojan:Win32/Wacatac.B!ml
Rising: Trojan.Kryptik@AI.88 (RDML:VM79awid5c0D13QwD6lLaw)
SentinelOne: Static AI - Suspicious PE
Trapmine: malicious.moderate.ml.score

Hashes

MD5 99b1e387180abf3325aa88340f8f9529 🔍
SHA1 bedaaee2c186c71ac3e5fc4aaffc9141b80428c8 🔍
SHA256 3f935e2ba7f7d4e5f8a0b6cabdbbdaaaf5d80d68838980196cbff1eb331991e0 🔍
SHA3 2ccc0cd1eedc86becc1c72c16cb159338f8e3081d071e71642c3f34db1eacbc8 🔍
SSDeep 768:320v6EQu/dTtLkC/3x/Er3m3aNym+T14:G0lQunPp/em3pmw14 🔍
Imports Hash 096e6cf7fc5839566ead107d0bc17f6c 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Oct-05 23:11:28
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2e00
SizeOfInitializedData 0x6000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000003140 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xd000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dfe81ce13c03ce13b2d4a951e1d194ac 🔍
SHA1 4b467ae548d4dc75f8acd23b0da6af3b45fd0e03 🔍
SHA256 f007243ee0f9f7de8add1e3abae7d6bf97939ad3c896299df8c8a15de397458a 🔍
SHA3 e41291b67edc4fa52188838107c6b94e9a952f3824038f362e5f10949a87661b 🔍
VirtualSize 0x2c2c
VirtualAddress 0x1000
SizeOfRawData 0x2e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.17872

.rdata

MD5 c78defaa2f41d54dde5f16466032d1e2 🔍
SHA1 9deeb70b22ce6801defc458cfc3b71eaecbc9431 🔍
SHA256 b023474ced5715e194494b96efe2381cb7e23b88c944f8332d203ab0b77382b6 🔍
SHA3 05a4458093be4d4792a2afd532f44582343632f58de40f297a88ea0898a3ed0f 🔍
VirtualSize 0x1480
VirtualAddress 0x4000
SizeOfRawData 0x1600
PointerToRawData 0x3200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.18055

.data

MD5 1c3b8ea3c34144e7a14bd945b131a256 🔍
SHA1 9c6184ad1e5a05dd0d71ac0061ba4c9171668682 🔍
SHA256 0b1ce44239213efc024791c78cbc9b904bca20c693718d0ae0b07aa143ffbdee 🔍
SHA3 2647c605c3cdb46f147dff56d6779cf56cad337864dd0b1f06d4add46eb27517 🔍
VirtualSize 0x6b8
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.444405

.pdata

MD5 a15ba34264b40e39576fa73efdedfdf4 🔍
SHA1 bcf6c338b0d6c839284fa741efba5686fb4be49b 🔍
SHA256 8d67a93edc990a6a44bdd71a8c267b43bdefcfc4dbbe5d7526e01588625bdefe 🔍
SHA3 f95d06a4ea8e311ef2569acbe2bf18d421b0e5af1bc9296cc7d87d1f6397c844 🔍
VirtualSize 0x21c
VirtualAddress 0x7000
SizeOfRawData 0x400
PointerToRawData 0x4a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.38506

.rsrc

MD5 490329b36f0903f3ab12ed182339ee81 🔍
SHA1 a417fcbb9a3c712f750fd1e9ed1151234b684ffc 🔍
SHA256 aa735e6336c45471da380741d11fc96309efa9f4f258158237296294f6b51fd3 🔍
SHA3 be2dcbc011e80dc309059cc61a9802bc600293035f6859cd90c11141f6d3b46a 🔍
VirtualSize 0x3a50
VirtualAddress 0x8000
SizeOfRawData 0x3c00
PointerToRawData 0x4e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.90103

.reloc

MD5 702906c8ed0394428233decf664b9bf4 🔍
SHA1 5036e9e209a9e3ca9cb292ce115d6f0be4c56940 🔍
SHA256 858b5853eff8f203d232724ea4a8eb90e1917b746f84efd0ffa229076781498b 🔍
SHA3 4abe275927dcc43539ca781cdadf76625c6c0a968a55c1c52d27fb9da9400605 🔍
VirtualSize 0x30
VirtualAddress 0xc000
SizeOfRawData 0x200
PointerToRawData 0x8a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.71282

Imports

KERNEL32.dll HeapAlloc
GetProcessHeap
SizeofResource
GetTempPathW
LockResource
CloseHandle
LoadResource
FindResourceW
GetProcAddress
CreateProcessW
GetModuleHandleW
GetTempFileNameW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
RtlCaptureContext
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
InitializeSListHead
USER32.dll wsprintfW
VCRUNTIME140.dll __C_specific_handler
memcpy
__current_exception
__current_exception_context
memset
wcsrchr
api-ms-win-crt-string-l1-1-0.dll _wcsdup
api-ms-win-crt-heap-l1-1-0.dll free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0.dll _register_onexit_function
_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initialize_onexit_table
exit
_c_exit
__p___argv
__p___argc
_set_app_type
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_cexit
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

101

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x3830
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9884
MD5 572ae6097893df8d334d66d226d589f7 🔍
SHA1 2d903411e49f0a931399af956d4d14fb234fc311 🔍
SHA256 f47066c91045b6a023a68083e25d409ab5d3a751a9771ce98b058378432764f9 🔍
SHA3 d9c6ebe43300c7dbf898524db8ca19fc8fb67c846174b63213f86326c3b63065 🔍

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-05 23:11:28
Version 0.0
SizeofData 644
AddressOfRawData 0x475c
PointerToRawData 0x395c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Oct-05 23:11:28
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140006008

RICH Header

XOR Key 0x5d59ae51
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 12
Imports (32420) 2
C++ objects (32420) 19
C objects (32420) 10
ASM objects (32420) 3
Imports (29395) 7
Total imports 70
C objects (LTCG) (VS2022 Update 6 (17.6.4) compiler 32537) 2
Resource objects (VS2022 Update 6 (17.6.4) compiler 32537) 1
151 1
Linker (VS2022 Update 6 (17.6.4) compiler 32537) 1

Errors

Leave a comment

No comments yet.