| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Nov-02 06:49:02 |
| TLS Callbacks | 3 callback(s) detected. |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Tries to detect virtualized environments:
|
| Suspicious | The PE is possibly packed. | Unusual section name found: .xdata |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
22624 bytes of data starting at offset 0xfee00.
The overlay data has an entropy of 7.47259 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 10/69 (Scanned on 2026-06-12 16:11:58) |
APEX:
Malicious
Bkav: W32.Malware.F2DE97A5 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) Elastic: malicious (moderate confidence) McAfeeD: ti!4D0667067804 SentinelOne: Static AI - Suspicious PE Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2017-Nov-02 06:49:02 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xc7800 |
| SizeOfInitializedData | 0x37200 |
| SizeOfUninitializedData | 0xe00 |
| AddressOfEntryPoint | 0x0000000000001420 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x105000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
CloseEventLog
CloseServiceHandle EnumServicesStatusExA GetNumberOfEventLogRecords OpenEventLogA OpenSCManagerA RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA |
|---|---|
| GDI32.dll |
GetDeviceCaps
|
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| KERNEL32.dll |
BuildCommDCBAndTimeoutsA
CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateFileA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA GetCPInfo GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentVariableA GetFileAttributesA GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemDefaultLCID GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultUILanguage GetVolumeInformationA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent K32EnumDeviceDrivers K32GetDeviceDriverFileNameW LeaveCriticalSection LoadLibraryW LocalFree Module32FirstW Module32NextW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte |
| MFPlat.DLL |
MFShutdown
MFStartup MFTEnumEx |
| msvcrt.dll |
iswctype
_assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _setjmp _setmode _time64 _vscprintf _vsnprintf abort atexit calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _strdup _read _fileno |
| ole32.dll |
CoCreateInstance
CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize |
| OLEAUT32.dll |
SysAllocString
SysFreeString VariantClear VariantInit |
| SETUPAPI.dll |
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo SetupDiGetClassDevsA |
| USER32.dll |
EnumWindows
GetCursorPos GetDC GetLastInputInfo GetSystemMetrics GetWindowTextA IsClipboardFormatAvailable IsWindowVisible ReleaseDC |
| WININET.dll |
HttpOpenRequestA
HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile |
| StartAddressOfRawData | 0x140102000 |
|---|---|
| EndAddressOfRawData | 0x140102018 |
| AddressOfIndex | 0x1400ff07c |
| AddressOfCallbacks | 0x1400e3130 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000140011860
0x0000000140011840 0x0000000140020920 |
No comments yet.