5f515785c70500fcb03ef4b1f5eafe6b112194474842a1e892d8ce75ca05be98

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-18 11:03:24
Detected languages English - United States

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Malicious VirusTotal score: 4/67 (Scanned on 2026-09-19 08:01:14) APEX: Malicious
Bkav: W32.Malware.AC1584E1
CrowdStrike: win/malicious_confidence_60% (D)
Microsoft: Trojan:Win32/Wacatac.C!ml

Hashes

MD5 6a99537b269a55bab71be73d78c95565 🔍
SHA1 67590b23cb094d63eaf8c2b12ee7a036536ada6f 🔍
SHA256 5f515785c70500fcb03ef4b1f5eafe6b112194474842a1e892d8ce75ca05be98 🔍
SHA3 45b9947296c605498fcc6299367c8f3c7c9887e1326ea91fe65fb4d4bedb2f36 🔍
SSDeep 6144:HjOV56WYNzQYzHGZ5c3WBPe6rBJ0zDpNRCTBxU0+ExsYHwM6bWEqLZcMbqzhs/Z:DM5BYbGY3WEpW59s7MGWEBCshHp 🔍
Imports Hash 722f5c0a468f46b9001b3eca7ed3bc04 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-18 11:03:24
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x6ca00
SizeOfInitializedData 0x23a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000045FB0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x94000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0acd1ebddc37541e1d8c29d08a9cec96 🔍
SHA1 75df45e75790a471e083db16f7894be71763ee5b 🔍
SHA256 9510aefd1e02753686c0440e1a55782c43ec92e8cab710ea3195742075d18f90 🔍
SHA3 acf40c56eaf431c31e0715ed0905598b28e84fb94cbbf38195c0727e07c2209d 🔍
VirtualSize 0x6c97c
VirtualAddress 0x1000
SizeOfRawData 0x6ca00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.44462

.rdata

MD5 42dcb65be442e87f430ab8b2d2ccc9e2 🔍
SHA1 609dbfa2e5de32ee9d7d968638bfacae2a8a691e 🔍
SHA256 0d239cee1db9e028c609b607a01d80c1fe98b947db3f146c288691135a55df59 🔍
SHA3 8685907fa82472c77e39d90c2d26c0adc958a4a3dbe6e1f8311780f090f52815 🔍
VirtualSize 0x1acaa
VirtualAddress 0x6e000
SizeOfRawData 0x1ae00
PointerToRawData 0x6ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.24063

.data

MD5 2bca49fe5d694d2f75c81424902a7fcd 🔍
SHA1 3403048da21926c76b179e25a13257d8c84f46a1 🔍
SHA256 65a006f8c5bd0d4eca370c51b853843298cd84574d1871fc09ca3d9c3a3f72f4 🔍
SHA3 69416e38f49d5e0e1454ac369d3582cf57c1c3b2b497ba8cd7b3525359de7aee 🔍
VirtualSize 0x2c60
VirtualAddress 0x89000
SizeOfRawData 0x1c00
PointerToRawData 0x87c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.35999

.pdata

MD5 23526e0f4d13578dfe17d3304a9841b1 🔍
SHA1 a3bfe71513d3242418076c7656ecd45bea15bb7f 🔍
SHA256 3328b5c39218d060d9dce1f228fbd79906728e0774e539739129873c08506b41 🔍
SHA3 5e7ac27c88b44e5670dbe7785374c1d457eb1bdee3fafa6cb863c5b136fdd7be 🔍
VirtualSize 0x4d04
VirtualAddress 0x8c000
SizeOfRawData 0x4e00
PointerToRawData 0x89800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.64927

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x91000
SizeOfRawData 0x200
PointerToRawData 0x8e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 9d292d144d2c0212dffed8d6eeed2c96 🔍
SHA1 a36bd40606486b7129a919660513743c931deed7 🔍
SHA256 ff5ec14e62fdbaaf3e354e7acd3976190e8c55c4fa0e738902c95beb6562b475 🔍
SHA3 0b9ca9731ba65314ad4b9b39636a86c9bb47f5b9e77d752e485966060f7e32c5 🔍
VirtualSize 0x1e0
VirtualAddress 0x92000
SizeOfRawData 0x200
PointerToRawData 0x8e800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.70046

.reloc

MD5 f0ebb1fbafe8433e7d4d7c6e84f2a913 🔍
SHA1 e9109e823085847ff01e90d36f613d9816591bb9 🔍
SHA256 6e296742a4041a3a54d5d5ef21c792722e86265762c24f749a9ea798c961297f 🔍
SHA3 df7159b9e8e73a9e3f1c41f391ce5026ff7edc4c5958e149301abd18f0fbce82 🔍
VirtualSize 0xaa4
VirtualAddress 0x93000
SizeOfRawData 0xc00
PointerToRawData 0x8ea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.19457

Imports

USER32.dll TranslateMessage
LoadCursorW
SetWindowLongPtrW
GetWindowLongPtrW
AdjustWindowRect
GetClientRect
ReleaseDC
GetDC
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
GetAsyncKeyState
GDI32.dll StretchDIBits
SetStretchBltMode
KERNEL32.dll HeapSize
CreateFileW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEndOfFile
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
SetFilePointerEx
WriteConsoleW
GetCPInfo
GetTickCount64
WideCharToMultiByte
GetModuleHandleW
GetFileSizeEx
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
CloseHandle
GetLastError
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
RtlUnwind
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-18 11:03:24
Version 0.0
SizeofData 1052
AddressOfRawData 0x7fb00
PointerToRawData 0x7e900

TLS Callbacks

StartAddressOfRawData 0x14007ff68
EndAddressOfRawData 0x14007ff90
AddressOfIndex 0x14008afb8
AddressOfCallbacks 0x14006e488
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140089240

RICH Header

XOR Key 0x783eebfb
Unmarked objects 0
C++ objects (33145) 174
C objects (33145) 23
ASM objects (33145) 7
ASM objects (35721) 10
C objects (35721) 16
C++ objects (35721) 85
Imports (33145) 7
Total imports 140
C++ objects (36256) 45
Resource objects (36256) 1
Linker (36256) 1

Errors

Leave a comment

No comments yet.