Manalyze report for 5a418d9f12f18fb3922224721ed7dee7603b3b0da5bf7887954fba14d456ae63

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-May-18 10:52:35
TLS Callbacks	2 callback(s) detected.

Plugin Output

Info	Cryptographic algorithms detected in the binary:	`Uses constants related to AES` `Uses constants related to Blowfish`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryExW` `Possibly launches other programs: CreateProcessW` `Can create temporary files: CreateFileW GetTempPathW` `Manipulates other processes: OpenProcess`
Suspicious	The PE is possibly a dropper.	`Resource 27 is possibly compressed or encrypted.` `Resources amount for 99.2468% of the executable.`
Malicious	VirusTotal score: 21/66 (Scanned on 2026-09-26 11:06:02)	`Bkav: W32.Malware.E126C24B` `CTX: exe.trojan.artemis` `CrowdStrike: win/malicious_confidence_70% (D)` `DeepInstinct: MALICIOUS` `Elastic: malicious (high confidence)` `Fortinet: W32/PossibleThreat` `Google: Detected` `Gridinsoft: Ransom.Win64.Sabsik.oa!s1` `Ikarus: Win32.SuspectCrc` `Jiangmin: Trojan.Redcap.de` `K7AntiVirus: Adware ( 006d9bef1 )` `K7GW: Adware ( 006d9bef1 )` `Lionic: Trojan.Win32.Generic.4!c` `McAfeeD: ti!5A418D9F12F1` `Paloalto: generic.ml` `SentinelOne: Static AI - Malicious PE` `Symantec: ML.Attribute.HighConfidence` `Trapmine: suspicious.low.ml.score` `TrellixENS: Artemis!6DF9E371B752` `TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101EK26ZN` `VirIT: Trojan.Win64.GenX.JUM`

Hashes

MD5	`6df9e371b752fef626c6f6a360cb4388` 🔍
SHA1	`19b14f6fb0301698e43b590e4d97a3adba6a3c86` 🔍
SHA256	`5a418d9f12f18fb3922224721ed7dee7603b3b0da5bf7887954fba14d456ae63` 🔍
SHA3	`37f06022375ec61a6bad8fc2ac8def8164aebe6589eb01707df23af91aab4fa3` 🔍
SSDeep	`393216:NROekA3ohxfLUwON1EX9QdgQEYplB/j0vrxuinlX09dfAtL+iA4REjFV:NRKnhxfQdoYgQEYplB/jirxXXOgLoUE` 🔍
Imports Hash	`fc3b0de2e7f988c46ed9c8e46a804071` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`12`
TimeDateStamp	2026-May-18 10:52:35
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x1f600`
SizeOfInitializedData	`0x138ba00`
SizeOfUninitializedData	`0x27e00`
AddressOfEntryPoint	`0x00000000000010F6 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x13bb000`
SizeOfHeaders	`0x400`
Checksum	`0x2ff90`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`dd1c5a315824eeaaabfb9e7e2dfafe96 🔍`
SHA1	`38081e1324bd8a6e54368d51837f7acdba846fe3 🔍`
SHA256	`9460a93bd4a980af741564171dc2978de8907ef6eff3d8c7489e3f44f22a9e01 🔍`
SHA3	`31ff9579b07007fafcb12f7ba8eafe8a3fbe9d5166fa80c0818d7a4ffa2f3edf 🔍`
VirtualSize	`0x1f468`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1f600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.32404`

.data

MD5	`ef2620b1a3c47e4e5b1adee2199681b5 🔍`
SHA1	`0490461c362acd3bfccb6f6a3e665a5ad3a70bad 🔍`
SHA256	`533f2ffa4f85bde7a4618ed35f6fb1a103a311b18be87434aa93500e3ac71c6d 🔍`
SHA3	`f263fa7922d0e2890b2a889eb0d979f7b0dbaae7f7a8d3d4893b2ff8ef6c1177 🔍`
VirtualSize	`0x130`
VirtualAddress	`0x21000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1fa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.34085`

.rdata

MD5	`8d132f058826fa7d3366abded27ae1c4 🔍`
SHA1	`113df310aba52006f05351f3291c0e2d5bbd9603 🔍`
SHA256	`55d741a357ad274bb2b39d1db76a0796c38701cb224a25e4c91bc341ba0ae4a5 🔍`
SHA3	`4fa43f7653f317b86b7a5b788fd0e11cd46df41198dc4e015c50ea637542ba05 🔍`
VirtualSize	`0x2eb0`
VirtualAddress	`0x22000`
SizeOfRawData	`0x3000`
PointerToRawData	`0x1fc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.20745`

.eh_fram

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x25000`
SizeOfRawData	`0x200`
PointerToRawData	`0x22c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`e6f433293997d5bf871918c4eacfc67a 🔍`
SHA1	`495c5fc5a03bb2f16eb39ae0e4c72a86ebad31ed 🔍`
SHA256	`b64822ab351cf1bcefb58aa10f943ea224869dfd188c242a9193788b3fe28e24 🔍`
SHA3	`b0c28bf0cd159f87ba47a90d024f06a5df353c0a8bd612f553caafa963fb8fdf 🔍`
VirtualSize	`0x954`
VirtualAddress	`0x26000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x22e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.98199`

.xdata

MD5	`e09c762b86f24fdbb7c929093e524cd8 🔍`
SHA1	`9d3bb9eb06b32d40958892bc83d728f548cbe03e 🔍`
SHA256	`564f3656b8bd58605083c71d2a282d8c8c37c094c392dc37184da0402562084b 🔍`
SHA3	`877e3faaedda6dfbd622b7c1ad70273daf9e4895c8795da00a984d57ff05dbd2 🔍`
VirtualSize	`0xb28`
VirtualAddress	`0x27000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x23800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.47797`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x27cd0`
VirtualAddress	`0x28000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`2ca3a8d0fa1c37927e3d2cda71e80bf2 🔍`
SHA1	`2271c2d85dd3d26c6001ac31dd39f2ad93ba995b 🔍`
SHA256	`a403ed7e6737394c1c9318148517bd1b40a62235d4fddb5c12fa183b0db710ab 🔍`
SHA3	`1fa5bd3a11763bef7c204d7f4b245b0b2e06c8a677528fee6661b3139261b8d1 🔍`
VirtualSize	`0xfe0`
VirtualAddress	`0x50000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x24400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.3282`

.CRT

MD5	`8cfce82edd33d98c828673c1411335a1 🔍`
SHA1	`27b86af289c7811250d4350faffcc7c488214e0e 🔍`
SHA256	`e2715a93ded165865fc47c932c53fa560bf69b4b43aa794add9819590db7abba 🔍`
SHA3	`fccb841191eba5998eb35273a82a6cb9ac8ae46a93122cabf00e6154c6b1931f 🔍`
VirtualSize	`0x60`
VirtualAddress	`0x51000`
SizeOfRawData	`0x200`
PointerToRawData	`0x25400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.292196`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x52000`
SizeOfRawData	`0x200`
PointerToRawData	`0x25600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`d24521788bdf51dc30b28e56e0e95f1c 🔍`
SHA1	`7f97a96b47d898f3d402247800508db262b96c4b 🔍`
SHA256	`2d31911bb4d113c3721bad2ce83bfe12e308c495899c850437669abcb526e951 🔍`
SHA3	`2af430b3459c2c0d3df4e5fb240c7723c772fa7abe961b985928dfaea074c496 🔍`
VirtualSize	`0x1366394`
VirtualAddress	`0x53000`
SizeOfRawData	`0x1366400`
PointerToRawData	`0x25800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99912`

.reloc

MD5	`323399cda2054631b0a4a3770dfe2267 🔍`
SHA1	`0e437c7d10dd2bb7483a9c64e0eb1b486c6c9357 🔍`
SHA256	`d8150d01e181f1974074f06860366d16ed3a3e3739868dc8772ecfa9cbbac119 🔍`
SHA3	`6e506b057177ba0cf3a5030dae23686bdd1f35d64e056f52f496c996d5d90f28 🔍`
VirtualSize	`0x94`
VirtualAddress	`0x13ba000`
SizeOfRawData	`0x200`
PointerToRawData	`0x138bc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`1.82682`

Imports

KERNEL32.dll	`AddDllDirectory` `CloseHandle` `CopyFileW` `CreateDirectoryW` `CreateFileMappingW` `CreateFileW` `CreateProcessW` `DeleteCriticalSection` `DeleteFileW` `EnterCriticalSection` `FindResourceA` `FormatMessageA` `FreeLibrary` `GenerateConsoleCtrlEvent` `GetCommandLineW` `GetCurrentProcessId` `GetEnvironmentVariableW` `GetExitCodeProcess` `GetFileAttributesW` `GetFileSize` `GetLastError` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleExA` `GetProcAddress` `GetProcessId` `GetShortPathNameW` `GetStartupInfoW` `GetStdHandle` `GetSystemTimeAsFileTime` `GetTempPathW` `InitializeCriticalSection` `IsDBCSLeadByteEx` `K32GetModuleFileNameExW` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryExW` `LoadResource` `LockResource` `MapViewOfFile` `MultiByteToWideChar` `OpenProcess` `ReadFile` `SetConsoleCtrlHandler` `SetEnvironmentVariableW` `SetUnhandledExceptionFilter` `SizeofResource` `Sleep` `TerminateProcess` `TlsGetValue` `UnmapViewOfFile` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WideCharToMultiByte` `WriteFile`
msvcrt.dll	`__C_specific_handler` `___lc_codepage_func` `___mb_cur_max_func` `__argc` `__iob_func` `__set_app_type` `__setusermatherr` `__wargv` `__wgetmainargs` `__winitenv` `_amsg_exit` `_cexit` `_commode` `_errno` `_fmode` `_initterm` `_lock` `_onexit` `_unlock` `_wcmdln` `_wcsdup` `_wcsicmp` `_wrename` `abort` `calloc` `exit` `fwprintf` `fprintf` `fputc` `fputwc` `free` `fwrite` `iswctype` `localeconv` `malloc` `mbstowcs` `memcpy` `memmove` `memset` `puts` `signal` `strerror` `strlen` `strncmp` `vfprintf` `wcschr` `wcscmp` `wcslen` `wcsncmp` `wcstoul`
SHELL32.dll	`CommandLineToArgvW` `SHFileOperationW` `SHGetFolderPathW`

Delayed Imports

27

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1365e00`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99912`
MD5	`5bd1015e8e703260e008217a8b7c3069 🔍`
SHA1	`6ce4cb218a0bfe2f9edbc88aca9976a1993a2913 🔍`
SHA256	`b99754bf0aa7154e27fcbbcf600f6922730d8bbaceb225814f3f87d8cd563c33 🔍`
SHA3	`a40298bedcc662d415f47e7afe5dfd1e2cc850973ca2c563f8d30177c065a171 🔍`

1

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x4f1`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.27584`
MD5	`9175a1fabff80fec23018fdfc1dc274b 🔍`
SHA1	`be8f32edef4e9f4aa514fa34f36ca9ee0204139b 🔍`
SHA256	`94b146eac0a80f5089ac9e57303515ddf9087d9d88fd4d47f27df8f3cf14cbb4 🔍`
SHA3	`934768e038a5727d347f31840aaab3de69c96e1d4bca3c9e726bae6be020edf3 🔍`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x140052000`
EndAddressOfRawData	`0x140052008`
AddressOfIndex	`0x14004f1c0`
AddressOfCallbacks	`0x140051038`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000140015C00` `0x0000000140015CC0`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.