531b94debcece427d3ae843cfdad64d41608b3f601de834631cdd99fb4b25e62

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-May-15 19:20:12
Detected languages English - United States

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Microsoft's Cryptography API
Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
The PE only has 7 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Uses Microsoft's cryptographic API:
  • CryptAcquireContextW
 Leverages the raw socket API to access the Internet:
  • WSACleanup
Malicious VirusTotal score: 42/67 (Scanned on 2026-07-14 19:40:21) ALYac: Gen:Variant.Lazy.710289
AVG: Win64:Evo-gen [Trj]
AhnLab-V3: Trojan/Win.Generic.R782775
Alibaba: Packed:Win64/Themida.cf1acfd7
Antiy-AVL: Trojan/Win32.Ravartar
Arcabit: Trojan.Lazy.DAD691
Avast: Win64:Evo-gen [Trj]
Avira: TR/W64.Evo
BitDefender: Gen:Variant.Lazy.710289
CAT-QuickHeal: Trojan.Ravartar
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_90% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/Packed.Themida.AE suspicious application
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Lazy.710289 (B)
F-Secure: Trojan.TR/W64.Evo
Fortinet: Riskware/Application
GData: Gen:Variant.Lazy.710289
Google: Detected
Gridinsoft: Trojan.Win64.Packed.sa
K7AntiVirus: Trojan ( 006d9bf01 )
K7GW: Trojan ( 006d9bf01 )
Kingsoft: Win32.Troj.ravartar.v
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.AI.1430581861
McAfeeD: ti!531B94DEBCEC
MicroWorld-eScan: Gen:Variant.Lazy.710289
Microsoft: Trojan:Win32/Ravartar!rfn
Paloalto: generic.ml
Panda: Trj/PhxIK.A
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win64.Dropper.tc
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!146A30AC8F26
TrendMicro: Trojan.Win32.ZYX.USBLG626
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLG626
VIPRE: Gen:Variant.Lazy.710289
Varist: W64/ABTrojan.GASI-0326

Hashes

MD5 146a30ac8f264f53153c6943194dee93
SHA1 e53d838dcdcf083f21bf214bd744d23186f65648
SHA256 531b94debcece427d3ae843cfdad64d41608b3f601de834631cdd99fb4b25e62
SHA3 ac039e4c2bb58a866b5718e87fd7fc7eba7bc87e8308fd85b90123d81e44cda8
SSDeep 98304:i+LunZAmdPKKv1yK1fhE/LHWZ4HVRvh8WcUxJLvK4RArq+cFaB:i+inZNPKK9yYf67WZ8RVcqvKprR
Imports Hash df70027ad4f231d854301ead9d87b83d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 16
TimeDateStamp 2026-May-15 19:20:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x374000
SizeOfInitializedData 0x4e7000
SizeOfUninitializedData 0x4e00
AddressOfEntryPoint 0x0000000000985005 (Section: .themida)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0xbac000
SizeOfHeaders 0x600
Checksum 0x5f5ca6
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 b0b19319fedee0079d88ff7e5b5cf9f8
SHA1 db6c401ba3a650d1bd1ede8c9c044fabb919aecb
SHA256 a7557a327998ff47f4c6016ee72513e666495dde179e0975732956a0f2ed9ce7
SHA3 b8fd60541e8a60226a1cf8fc820e64967e69e299056c2de540a2113299e0b9a2
VirtualSize 0x373f40
VirtualAddress 0x1000
SizeOfRawData 0x102600
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.99985

(#2)

MD5 9c54c5a82a678cab2c42ff4f34435277
SHA1 04df7f3fed64f575176245d039a75614d5148e2e
SHA256 70c1db45ae7e4f3318f2b56fa18a5308e42bbb730a548728401a05133d4dfc58
SHA3 49959d46841fdd3d34625b3f0c4bc3f899559e2864b34cea037ca0c3a00f83e0
VirtualSize 0x36e750
VirtualAddress 0x375000
SizeOfRawData 0x134400
PointerToRawData 0x102c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99984

(#3)

MD5 1ca8e7bb55e688e1cea71e2b8256fff1
SHA1 2705a9e30a0ca3363fdbbc2dd8f941bc4deee50c
SHA256 17ece4e959ee05e4112c945ba463f7771177173c5c63337c34fa7ec6309c4ddd
SHA3 c34d17a05bf4f010b74d58f090169bb4886afdc595e12c9930df07facb9e0de6
VirtualSize 0x2e180
VirtualAddress 0x6e4000
SizeOfRawData 0x28400
PointerToRawData 0x237000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99844

(#4)

MD5 a58ae77cf31189214a195ec0b8df886b
SHA1 d33fd5dfb88857f41216f4d828dfd638251eebe5
SHA256 d33374a3d16970333dd1bb54f50970b54f4b35e9cc7a78441021829c9fee6a88
SHA3 0e8d6cdc31d7bd2eb44c360cc68d36388ee7454f9d3744ea51e1ef3f47b53961
VirtualSize 0xdc8f0
VirtualAddress 0x713000
SizeOfRawData 0x31600
PointerToRawData 0x25f400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99878

(#5)

MD5 92ebd32645a39f3191157fcf1353e290
SHA1 4675e4bdc65ba2a3a0d4b0c69efc5011c3bfc42d
SHA256 7f7f023768f55d013f7471ea8f36a8ca0f31171c49b442b48eb97aaf2b4ca0c4
SHA3 012cb6bb10f937ab2f3255ce5fb6ab5c485d0a89b84d311fae33eb74617de5a2
VirtualSize 0x20730
VirtualAddress 0x7f0000
SizeOfRawData 0xa000
PointerToRawData 0x290a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.98038

(#6)

MD5 1ccde80898cd2b25a341a9e10682e1a2
SHA1 024a3c34df9fa06b5e2c1c47d0d0a0f82d450022
SHA256 67b1d5f657051a269489931edf234f854e0a154215f92fa215f9f313d765b3ca
SHA3 b04ae58a2ac3559a03872c8bf1abd6097a57d909c30b7c6fffa7d4dd729a7fe5
VirtualSize 0x1b5ac
VirtualAddress 0x811000
SizeOfRawData 0x2a00
PointerToRawData 0x29aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.95839

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x4d88
VirtualAddress 0x82d000
SizeOfRawData 0
PointerToRawData 0x29d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

(#7)

MD5 d9b71186c7af372c708d5f221e1eb961
SHA1 6fef39a32e92b5ae18f7627b5751dcb0999439a0
SHA256 53c3982f6ea136d21a21b118b82c6d4938b24659e49fde4d710ebe4cce03eda8
SHA3 2441b072c470f66fb506d8126f83f9556d7679ba87f06802f36f87182129f43d
VirtualSize 0x1ec8
VirtualAddress 0x832000
SizeOfRawData 0x200
PointerToRawData 0x29d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.13036

(#8)

MD5 f32ddd85992140c85fe55d0e7f6268c7
SHA1 1f846a578d69d1db4057e1a4051937fe4884032a
SHA256 e14d47e7f5d511b9f1b7bbcc79af1afdebf62b4c749328d9d29021e2aaf416cb
SHA3 2d44560ba371bcd1b4871219452ab4cca909667167bdc751fb149f0a1531e16f
VirtualSize 0x10
VirtualAddress 0x834000
SizeOfRawData 0x200
PointerToRawData 0x29d600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.395783

(#9)

MD5 85e761dcf9ee4bdf35cdea073bc32c4a
SHA1 6ee2943f4ecca2f5a8db11007c8d3e79fcd55b55
SHA256 2761aefddda8d6ef8b827c7edf4d59b481d31644e878ab965db1d4bc22bb0586
SHA3 6c07b8e24d6702f2289a40c45c58a9c0c4b868a663aafef1530a54bd4b52a815
VirtualSize 0x23b60
VirtualAddress 0x835000
SizeOfRawData 0x10c00
PointerToRawData 0x29d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99322

(#10)

MD5 80a918de5ce0f6fafe163007f0d3c3a3
SHA1 a7398efc20ab945962c82c16f2944afd243a6dc2
SHA256 8dc8c2563616a35f455d03bfc4f8b3cf08775c8178c233832fdd8d63b6c5d46d
SHA3 76722eccb68b79f3a86907639095648693ecd94bdd1b5ad0f862afbb5ff00d40
VirtualSize 0xbe14
VirtualAddress 0x859000
SizeOfRawData 0x2400
PointerToRawData 0x2ae400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.97188

.idata

MD5 0915461213bc61634bcb5ef91f8db7d2
SHA1 ea26b570d46c5b562b2a1a2788287f14a990b967
SHA256 4ff1dfb587978bb4d87df80c599f617b65997c9536b4fbb94ff56a6cf07f9b1c
SHA3 60ad5fe677f886eb5866b6e69db00ecda367888ab260c9c99963c05780836db0
VirtualSize 0x1000
VirtualAddress 0x865000
SizeOfRawData 0x200
PointerToRawData 0x2b0800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.60768

.tls

MD5 c5b60bbb316d4af5294a5d9331cce68a
SHA1 ef8093cce0b7f4067d8e21d5f6fe108f58854169
SHA256 62ec6b0b6bf2613ff847acc28ed40ff97f5cfc9dfb16cff63248c439e753a648
SHA3 7586fadf2507b3011a1c61998c15bdea988b44bfd161e6016a22706ac75ef2eb
VirtualSize 0x1000
VirtualAddress 0x866000
SizeOfRawData 0x200
PointerToRawData 0x2b0a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.32011

.rsrc

MD5 89f3639a832ff58804811b466faf9dcf
SHA1 db552299bde0c9d4673e72d462fa4db74bf8f078
SHA256 0cabc005abae27472f11b95fb901e8044ba9b03824cf400f6b0ad0f9124801b2
SHA3 6374d6451c01bc936d7e552f509780822d60889b415bd7dc38071c06c66b7bec
VirtualSize 0x23c00
VirtualAddress 0x867000
SizeOfRawData 0x23c00
PointerToRawData 0x2b0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.31507

.themida

MD5 502421a7914c7cc3e19d896d38664711
SHA1 66ebba6fb25d844c8b54e38be3e018bdbe38f816
SHA256 830b2364dbba8650fc2f44be4359e4f1608d654b67d53e15a8a63cb69532e981
SHA3 7fe62de92660fdebd2f74e8abe510743463ceab26701f8d41d38226a690f70fb
VirtualSize 0x320000
VirtualAddress 0x88b000
SizeOfRawData 0x320000
PointerToRawData 0x2d4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.38589

.reloc

MD5 e16b4c639a369d159736efbd08c168bc
SHA1 3e147a75e5d43ec1e114620b01097259ed1f6132
SHA256 3ab9b0c96cd86327e18a2638681a4b5081991c0f402613eaf83b730917309897
SHA3 cd5c3f0de0bd63c63ba7040ceb22133dbbe2cb5088dab94c0bca8812ab9de514
VirtualSize 0x1000
VirtualAddress 0xbab000
SizeOfRawData 0x10
PointerToRawData 0x5f4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 2.7744

Imports

kernel32.dll GetModuleHandleA
ADVAPI32.dll CryptAcquireContextW
CRYPT32.dll CertCloseStore
msvcrt.dll __C_specific_handler
SHELL32.dll SHFileOperationA
USER32.dll GetProcessWindowStation
WS2_32.dll WSACleanup

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xb450
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98891
Detected Filetype PNG graphic file
MD5 94775d97d628114848ce62c9cb2edc1f
SHA1 fff7d8b09e79b2e9a226153d23d849a11e57060d
SHA256 368d2540cb230617ba53fffa95b1d5e6122b28ba97c39360452ef43da30dd458
SHA3 bbe7757376c24b2669b060bee117f536de2f9d801f6c7ec2df9f22dd86a8c317

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.81079
MD5 ad42d76779e16e80c2526b510d31d9a3
SHA1 0781dafdebaf52e615614e65975184c9e8701c53
SHA256 56dd5915059e8029a1ad1f77cbb5dce84fa2a2742c3f81b0762a446898455b6a
SHA3 07509f818bfe86dc17642f65e57c9ab044fbef4026eb5934a0d2ac7fd65ab158

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.08059
MD5 20704931d0bf5a4341273f4d9ec70b38
SHA1 fa171bb78ae0257ee2e3826491766b59d1b30035
SHA256 b497b4a39387f82f29fa260dd67a52b3964a51b46177e073d5d112de46087a84
SHA3 6ef1ce4e010688426ba56ec0728b818fb5fd4bef2d187dcb08ea1db1e1d90109

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31489
MD5 410cbd621e5d2182c68bf6bfc4eac49f
SHA1 e09e1016c781df0fbfb740c18303fc80a56f1041
SHA256 e74d2f63d6704b10bbec845cb9cad8d8b4e90af3723903bc5aa508b0eef02ff4
SHA3 77f28899037329c285f366ef40c191c7acb5b219e80ef10f4081a9210c1e7411

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.60074
MD5 585136081d3094f3d85042c5674f8063
SHA1 4696bf9e3a59e108d63d07857f378c3a91fd2b16
SHA256 ed41f613fe169cfd6f09d76598867184eccf9207e7ca558b072d27eb79ca9b51
SHA3 dd79143697174c20149f67e4d5a3caa676e6e7076bafe0ea54fbbb52523863ee

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.8318
MD5 06c2b1e9639e86ea6c2e1f7a5bbacc94
SHA1 27f0b82503f800cead6cffd911815c9b1c53b870
SHA256 6ce8c398da3e5f6bc5a60d5a8223de73b005d1a1f9af0eb5f677ff483ac43d9e
SHA3 3947f0bb5836ee764ac55f101327819f45a2476c8053a38ee28dc8428fcfbc2f

ID_ICON1

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 51927093d03916fd54704c4d00ed00e1
SHA1 b319cba02aeac5b42717187f6e7053a79f73bb40
SHA256 1a767dde8472732882e55c2f986fc20e36bf2d91eeecc25481aa299929a52283
SHA3 fd397977845b2db1852520b857c022239f051dd36103ac379235da5f54da8813

Version Info

TLS Callbacks

StartAddressOfRawData 0x140866000
EndAddressOfRawData 0x140866008
AddressOfIndex 0x140866008
AddressOfCallbacks 0x140866010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.