4867d941f00e03fbcc7411bbee8d77f24a281ba3b3c74fa90cbfcfa341805980
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Feb-01 20:22:18 |
Plugin Output
| Info | Matching compiler(s): | MASM/TASM - sig2(h) |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource AF1291AE59387B123A65A382669BB40E is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 56/71 (Scanned on 2026-11-09 10:58:14) |
ALYac:
Trojan.Generic.40743811
AVG: PwrSh:Mayhem-A [Trj] AhnLab-V3: Trojan/Win32.Agent.R259682 Alibaba: Trojan:PowerShell/Powersploit.07a6dea9 Antiy-AVL: Trojan/Win32.Agent Arcabit: Trojan.Generic.D26DB383 Avast: PwrSh:Mayhem-A [Trj] Avira: TR/Mayhem.A BitDefender: Trojan.Generic.40743811 Bkav: W32.Malware.33F6D28E CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_70% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.MulDrop28.60980 ESET-NOD32: PowerShell/KillMBR.B trojan Elastic: malicious (high confidence) Emsisoft: Trojan.Generic.40743811 (B) F-Secure: Trojan.TR/Mayhem.A Fortinet: W32/Agent.MAZDI!tr GData: Trojan.Generic.40743811 Google: Detected Gridinsoft: Trojan.Win32.Agent.vb!s1 Jiangmin: RiskTool.Generic.kkp K7AntiVirus: Trojan ( 005d9b921 ) K7GW: Trojan ( 005d9b921 ) Kaspersky: HEUR:Trojan.PowerShell.Agent.gen Lionic: Trojan.Win32.Dapato.tsra Malwarebytes: Malware.AI.4231750508 McAfeeD: ti!4867D941F00E MicroWorld-eScan: Trojan.Generic.40743811 Microsoft: Trojan:Win32/Wacatac.B!ml NANO-Antivirus: Trojan.Win32.Scrop.eytdxi Paloalto: generic.ml Panda: Trj/PhxGD.A Rising: Trojan.Kryptik!8.8 (TFE:5:lMYerF3OYHJ) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Infected.ch Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Win32.Trojan.Agent.Cnhl Trapmine: malicious.high.ml.score TrellixENS: Artemis!7996973BFAB7 TrendMicro: TROJ_GEN.R002C0DK626 TrendMicro-HouseCall: TROJ_GEN.R002C0DK626 VBA32: Trojan.Agent VIPRE: Trojan.Generic.40743811 Varist: W32/Trojan.MNUQ-5487 VirIT: Trojan.Win32.Genus.XWT Webroot: W32.Malware.gen Yandex: Trojan.GenAsa!xeYOOG2tugU Zillya: Trojan.Shelma.Win32.1656 alibabacloud: Trojan:Win/KillMBR.B huorong: Trojan/KillMBR.bx |
Hashes
| MD5 | 7996973bfab74fdaf7ef784058442807 🔍 |
|---|---|
| SHA1 | fb03c044986c59ee8259d3312180a0fc34105f38 🔍 |
| SHA256 | 4867d941f00e03fbcc7411bbee8d77f24a281ba3b3c74fa90cbfcfa341805980 🔍 |
| SHA3 | b3ecd2842d8bf0675671e4e502d2c0907023fbb84a1945a3010fb30774f477ac 🔍 |
| SSDeep | 1536:37fTsqBbFkvQ21/ipICdckP+o1Ll5PlNg1qkXTcIOlnToIfHvCnm5msjKDoxalFH:rwqhFkv93CSk5DJkXTSNTBfHKNywTb3 🔍 |
| Imports Hash | 2adb28da7b9fece4b360fc7188d2f05c 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2018-Feb-01 20:22:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xfe00 |
| SizeOfInitializedData | 0x17000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x12000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
| MD5 | b729b25a916638015e2caaa79da47f5d 🔍 |
|---|---|
| SHA1 | 444fda36e2ea77a77ad347403b6289b943699d0a 🔍 |
| SHA256 | 5c623154a52940c24002446e3abc7a4112947dd195de0f4eac32b40af3531ed7 🔍 |
| SHA3 | 9f9743f130b704a9daf48b830211f586634af3f1c1b0c2caf14dd48bfdf90060 🔍 |
| VirtualSize | 0x3018 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x3200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.51797 |
.text
| MD5 | 1fa7311f693f1815cedfcd8d90089d6e 🔍 |
|---|---|
| SHA1 | 4d178fb5b957aeed89734127977582d3d8e26ea9 🔍 |
| SHA256 | 0afcafe9cbb93806cdca177e6ed458822d78f3e4d52a43efce303e6f1231e7d0 🔍 |
| SHA3 | 2def0924d98ce9bfff8ffa43fbd4ab122340e3902fa7d8692a7a8afa5b894b75 🔍 |
| VirtualSize | 0xcaa2 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0xcc00 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.58019 |
.rdata
| MD5 | 6784f513fac4815ca52b2a1098c59370 🔍 |
|---|---|
| SHA1 | 3aef23f6fc51062b5d1ded994c194b02300ac51f 🔍 |
| SHA256 | c921d0b441a0daec25616a445930b1a356217220055d11969409024c45cf3182 🔍 |
| SHA3 | 8f3c70a202ef020a7abb7742bc9cfcbf61399a4aa0371e29c5a1e6b74679adad 🔍 |
| VirtualSize | 0x33a0 |
| VirtualAddress | 0x12000 |
| SizeOfRawData | 0x3400 |
| PointerToRawData | 0x10200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.109 |
.data
| MD5 | 5d74d29328a78386862e2bac2d9b1e06 🔍 |
|---|---|
| SHA1 | 666e9528f65bf50d65fbc6b3ffad0f317051374e 🔍 |
| SHA256 | 5ae2c1ce7a534d9d3f80e7f2311aeff5ce3d232ce80e9055fc2cbaed19f53829 🔍 |
| SHA3 | b61b0a85b93fd7adbb29b78ba342ff32cbd483755ccdcda50be191f220ff5ad1 🔍 |
| VirtualSize | 0x16c4 |
| VirtualAddress | 0x16000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x13600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.28719 |
.rsrc
| MD5 | 488056f6c79c828a578e7811fd4c61cb 🔍 |
|---|---|
| SHA1 | 3bd5abd77461d1f429ebee243a36b91464da00e5 🔍 |
| SHA256 | 8546ce393fc2b4a8eb4e2ca0c3fa7605229a214375bd28697e094cc5bd12d284 🔍 |
| SHA3 | b36c562165f7362c697e79649c4f8528a7004860748fe305d4d5f530af850d93 🔍 |
| VirtualSize | 0x12a64 |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x12c00 |
| PointerToRawData | 0x14600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.06433 |
Imports
| MSVCRT.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc free |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetTempFileNameW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW SendMessageW PostMessageW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathQuoteSpacesW
PathAddBackslashW PathRemoveBackslashW PathRemoveArgsW PathRenameExtensionW |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xe228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.44328 |
| MD5 | 8f31a0a4aec3e5b9b406b88533c963e5 🔍 |
| SHA1 | 9394b1e1dadb9631acb28439e741a88a330aa861 🔍 |
| SHA256 | 0e45e1b8577cd3889b0b6ad9ff99d89dde5b39fe7e0e4387a136d7708637e4cc 🔍 |
| SHA3 | 295f1ce8437d827d43506138e2d8e70f86213a54128ea377265209fa2960223e 🔍 |
5A1BA8D23CFE873B56E4040D6B7896BE
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xe |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.23593 |
| MD5 | 7bb55e591962edd967c9a3039407256c 🔍 |
| SHA1 | e84642313805d66ef70fdada202992d040a1c2cc 🔍 |
| SHA256 | 8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91 🔍 |
| SHA3 | 116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91 🔍 |
64FA813B87BA6D9E01E203A4EAE10C168365181F
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x10 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.875 |
| MD5 | 229a3e4a7e4762aaa34ec1c78809b3c1 🔍 |
| SHA1 | 1f50489054ec5d1f9994ce8b97d6d3809c96b19c 🔍 |
| SHA256 | 0657d664040b4b0b6afd0f377e187aba1150681f00c0ba49eb99e70ed2f1d224 🔍 |
| SHA3 | 2e305a2fdc34728d95debd9988852eab246dd8c80b9d5dd36185731cc300ce64 🔍 |
AF1291AE59387B123A65A382669BB40E
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x42b8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.98921 |
| MD5 | 90f252f704ed28ecd99a81ed5b37f0ba 🔍 |
| SHA1 | 97132a17e6aefe1e2dafeba454173f540a9ba22e 🔍 |
| SHA256 | 074e9c806c1ddd078393271223e00245be8102594ce31daccdae457f72568473 🔍 |
| SHA3 | 3fecec47cb934031b62c821667470b01609ccc271d0c5b0feef7668f81a554db 🔍 |
E30807CD7E
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | 55a54008ad1ba589aa210d2629c1df41 🔍 |
| SHA1 | bf8b4530d8d246dd74ac53a13471bba17941dff7 🔍 |
| SHA256 | 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a 🔍 |
| SHA3 | 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.01924 |
| Detected Filetype | Icon file |
| MD5 | 359cd0accc84b984d4479e1334e89b2d 🔍 |
| SHA1 | 667fdcd49489d7ae4f275f422ba99e296f52bb5a 🔍 |
| SHA256 | d3bdab5b13fe46e978d2b44597a0c8b3a47fb47583b459adad20d7f47839729e 🔍 |
| SHA3 | 2fc954715b4601645c08c1e55d55ace66a4f8f037ec6356619d21c3ee9690b03 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x2a0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.08821 |
| MD5 | ffd3b06250ba95d239365ef050b3627b 🔍 |
| SHA1 | 16e3981245d8dbd44f33d93b203c02a44f3c2b95 🔍 |
| SHA256 | 1c3703755b6e9a690e8eafaa0cc318f667cd5d4c06935b6e3cd07296df9e9dcd 🔍 |
| SHA3 | 2c6baa84c172762978837565c2b2ed4f7716c0edaab79bda3a3ef74724426773 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.