41d98cccf0dd6791b4e6d7b1feccef24c8a6bc9650daaf535d3dbc79b88e7de9

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2010-Apr-14 22:06:53

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .kfmf
Section .kfmf is both writable and executable.
The PE only has 2 import(s).
Malicious VirusTotal score: 62/70 (Scanned on 2026-09-13 17:35:20) ALYac: Trojan.Rozena.32
APEX: Malicious
AVG: Win64:MetasploitEncod-A [Trj]
Acronis: suspicious
AhnLab-V3: Trojan/Win64.RL_Shelma.R298109
Alibaba: Trojan:Win64/Shelma.80434a5f
Antiy-AVL: Trojan/Win64.Rozena
Arcabit: Trojan.Rozena.32
Avast: Win64:MetasploitEncod-A [Trj]
Avira: TR/Crypt.XPACK.Gen7
BitDefender: Trojan.Rozena.32
Bkav: W32.Malware.7B0FDD7D
CAT-QuickHeal: HackTool.Metasploit.S9212471
CTX: exe.trojan.rozena
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: BackDoor.Shell.244
ESET-NOD32: Win64/Rozena.M trojan
Elastic: malicious (high confidence)
Emsisoft: Trojan.Rozena.32 (B)
F-Secure: Trojan.TR/Crypt.XPACK.Gen7
Fortinet: W64/Rozena.J!tr
GData: Win64.Trojan.Rozena.I
Google: Detected
Gridinsoft: Trojan.Win64.ShellCode.sd!s1
Jiangmin: Trojan.Shelma.nqf
K7AntiVirus: Trojan ( 004fae881 )
K7GW: Trojan ( 004fae881 )
Kaspersky: Trojan.Win64.Shelma.a
Kingsoft: Win32.Troj.Unknown.a
Lionic: Trojan.Win32.Shelma.W!c
Malwarebytes: Trojan.Dropper.Generic
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!65E3EB5CA301
MicroWorld-eScan: Trojan.Rozena.32
Microsoft: Trojan:Win64/Meterpreter.AMTB
NANO-Antivirus: Trojan.Win64.Shell.kxhxrq
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.Kryptik/x64!1.A2F4 (CLASSIC)
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Skyhigh: Trojan-FJIN!65E3EB5CA301
Sophos: ATK/Swrort-J
Symantec: Packed.Generic.539
Tencent: Hacktool.Win64.Rozena.a
Trapmine: malicious.high.ml.score
TrellixENS: Trojan-FJIN!65E3EB5CA301
TrendMicro: Trojan.Win64.SHELMA.SMA
TrendMicro-HouseCall: Trojan.Win64.SHELMA.SMA
VBA32: Trojan.Win64.Shelma
VIPRE: Trojan.Rozena.32
Varist: W64/Shelma.A
VirIT: Trojan.Win32.Generic.BZPS
Yandex: Trojan.GenAsa!RZuPNlUDbQk
Zillya: Trojan.Shelma.Win64.8689
ZoneAlarm: ATK/Swrort-J
Zoner: Probably Heur.ExeHeaderL
alibabacloud: Trojan:Win/Metasploit.A(dyn)
huorong: Trojan/Rozena.f

Hashes

MD5 65e3eb5ca3012baabab31a5af0afa625 🔍
SHA1 fe522356db216506973b4a79b7e720891d4dccc9 🔍
SHA256 41d98cccf0dd6791b4e6d7b1feccef24c8a6bc9650daaf535d3dbc79b88e7de9 🔍
SHA3 bf9d32318301dff486f7a0f36c7bd0c1f2e8c1fbbad1192d87f7ac5db6030419 🔍
SSDeep 24:eFGStrJ9u0/61m/nZd0BQAVSwfEDRbyx3GfRvIp1ipmB:is0Fb0BQnRbyxWftIpvB 🔍
Imports Hash b4c6fff030479aa3b12625be67bf4914 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xc8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 3
TimeDateStamp 2010-Apr-14 22:06:53
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 1.0
SizeOfCode 0x3000
SizeOfInitializedData 0x1000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000004000 (Section: .kfmf)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x42a0
SizeOfHeaders 0x248
Checksum 0x9c93
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a4a5deae25708a9e05f50bcad7075c86 🔍
SHA1 e66374a7f405687da2de82ab3fbcad13858fa6b2 🔍
SHA256 04bf20abd166f5ae804746ecaaef3a31eca367efd50703d95f74efecb7edcd49 🔍
SHA3 9f76b581c24ca555ae9bbe26f28849a52cd6ba5d3fd0e52bbed4e187825e6793 🔍
VirtualSize 0x104e
VirtualAddress 0x1000
SizeOfRawData 0x1200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 0.1681

.rdata

MD5 767c59cb3b731f4bcb8af76b20bfe136 🔍
SHA1 1c4d42f35ca3b596d476302d2a04b7aaee5023aa 🔍
SHA256 c6842c8cb204adf2c27e1bd5edc9606305dbb2938e4e3a51c6ddd8caea858b4e 🔍
SHA3 1ae8088fc36c4287b6a943268e948d26ebea7938d1ba00b311c5d8f1eeb50393 🔍
VirtualSize 0x84
VirtualAddress 0x3000
SizeOfRawData 0x200
PointerToRawData 0x1600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.963087

.kfmf

MD5 81f37c7d7777bd9265067778f2ce8e26 🔍
SHA1 dce63f53036b6f9ad1b66a5945324393084dd436 🔍
SHA256 470aa044b0a7e9c922685985e673824218067893d54ff7858feab0d03e4649b8 🔍
SHA3 8e9b52177061ffe7f34480b1dd0801171ea374e21f6a3656e2e7ec303f6201bf 🔍
VirtualSize 0x2a0
VirtualAddress 0x4000
SizeOfRawData 0x400
PointerToRawData 0x1800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.2794

Imports

KERNEL32.dll VirtualAlloc
ExitProcess

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x8e7f457d
Unmarked objects 0
Imports (VS2012 build 50727 / VS2005 build 50727) 3
Total imports 2
ASM objects (VS2008 SP1 build 30729) 1
Resource objects (VS2008 SP1 build 30729) 1

Errors

Leave a comment

No comments yet.