604ce55b0387346eabca6e8a32a9941c504d3229b43466ccabff5b145233602b

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Mar-28 14:52:18
Detected languages English - United States

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Unusual section name found: .#Ql
Unusual section name found: .o#c
Unusual section name found: .P7b
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Uses Microsoft's cryptographic API:
  • CryptEncrypt
 Leverages the raw socket API to access the Internet:
  • closesocket
Malicious VirusTotal score: 47/69 (Scanned on 2026-05-09 19:30:58) ALYac: QD:Trojan.GenericKDQ.0552399806
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Trojan/Win.Generic.R766835
Alibaba: Trojan:Win32/VMProtect.81800180
Antiy-AVL: Trojan/Win32.Sabsik
Arcabit: QD:Trojan.GenericQ.D20ECF3BE
Avast: Win64:MalwareX-gen [Misc]
BitDefender: QD:Trojan.GenericKDQ.0552399806
CTX: exe.trojan.vmprotect
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/Packed.VMProtect.ACI trojan
Elastic: malicious (high confidence)
Emsisoft: QD:Trojan.GenericKDQ.0552399806 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: W32/PossibleThreat
GData: QD:Trojan.GenericKDQ.0552399806
Google: Detected
Ikarus: Trojan.Win32.VMProtect
K7AntiVirus: Riskware ( 005cdde61 )
K7GW: Riskware ( 005cdde61 )
Kaspersky: Trojan.Win32.Agent.xcdfuy
Lionic: Trojan.Win32.GenericKDQ.4!c
Malwarebytes: Malware.AI.1917416458
MaxSecure: Trojan.Malware.345033516.susgen
McAfeeD: Real Protect-LS!6978FCC9875D
MicroWorld-eScan: QD:Trojan.GenericKDQ.0552399806
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.Agent!8.B1E (CLOUD)
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: Artemis
Sophos: Mal/Generic-S
Tencent: Win32.Trojan.Agent.Mgil
TrellixENS: Artemis!6978FCC9875D
TrendMicro: Trojan.Win64.VMPROTECT.USBLD226
TrendMicro-HouseCall: Trojan.Win64.VMPROTECT.USBLD226
VBA32: Trojan.Agent
VIPRE: QD:Trojan.GenericKDQ.0552399806
Varist: W64/ABTrojan.QYSH-9304
Yandex: Trojan.Agent!wOHt6hnj/oI
Zillya: Trojan.Agent.Win32.4487858
alibabacloud: Trojan:Win/Wacatac.C9nj

Hashes

MD5 6978fcc9875ddf154a91b9d50ff45299
SHA1 73b93593b2f5f17c366685ba359f7d0619b249e6
SHA256 604ce55b0387346eabca6e8a32a9941c504d3229b43466ccabff5b145233602b
SHA3 ee8314ab330dbb6e0aecaaafa53d11518bb50b179a1fab7c9550564859cf1b15
SSDeep 393216:Aznw18HTqg1o4MbqGMmQLXe8KdaS1y+P8rtB80Eqdyshlh6ncBv4qmLN6u3Z:ALVTM4gqHmTdOC84hq0mhYeQN6
Imports Hash ed3fdde7efb00b8db255e049b7aab380

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Mar-28 14:52:18
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x137800
SizeOfInitializedData 0xe0600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000001380069 (Section: .P7b)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2cb7000
SizeOfHeaders 0x400
Checksum 0x1a94528
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x137778
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x59986
VirtualAddress 0x139000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xc4bc
VirtualAddress 0x193000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xdbfc
VirtualAddress 0x1a0000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x100
VirtualAddress 0x1ae000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.#Ql

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x107a21c
VirtualAddress 0x1af000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.o#c

MD5 ed9792c160f885aef4a0d0ad5df7c230
SHA1 6764d38a94dda9b56f5ee02f6903a05cc5db514c
SHA256 27ce8956ed66d1aa337ac48055380c767e8b2aba568b31804683523370250809
SHA3 e1a4b87e88cdf56338d85d852063b7bcca09ef2d3c6705561dc03b7da7ecf965
VirtualSize 0xf68
VirtualAddress 0x122a000
SizeOfRawData 0x1000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.206042

.P7b

MD5 f40c2fb780e4d099c137519c5a42cd90
SHA1 3519be0052dcf13076aabfc68ed7e40402f43e66
SHA256 63289a4fb6858b096a1b8a700193657544a9a19c14e538b0d10c42090c1dab23
SHA3 7bb9f9b9e0b61583ee9c61f97251bcccc2d8b6bdc3606c8c0230b67689593fd5
VirtualSize 0x1a20160
VirtualAddress 0x122b000
SizeOfRawData 0x1a20200
PointerToRawData 0x1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.82051

.reloc

MD5 67eec5485456a96efd89fc1b963d4ee7
SHA1 61c6565c043e81edc057c094d3e3979c44f17bf4
SHA256 8eb9d2af1c881c98db6b6b27b78be06beb1950101e9c0fc47e6099000e5f187d
SHA3 e9aef27c9ae0c3efb423f0d9cc08e2e725b8e08573a103c820eb91510f41f359
VirtualSize 0x128
VirtualAddress 0x2c4c000
SizeOfRawData 0x200
PointerToRawData 0x1a21600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.82705

.rsrc

MD5 1f27dac7a235c6768d44d124de3c91ac
SHA1 66a29c41730f0d8ec6025dda6f10649968500af8
SHA256 2d7ed08b73a47097ac1920de882b0abd355ffec16a5bb7d3ba3c29e85615eee6
SHA3 cb496bc53031d799fd98f17c19dccb33a02f898c435ab809db41da61ddb83243
VirtualSize 0x69c8d
VirtualAddress 0x2c4d000
SizeOfRawData 0x69e00
PointerToRawData 0x1a21800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.64745

Imports

WS2_32.dll closesocket
WLDAP32.dll #167
CRYPT32.dll CertGetNameStringW
KERNEL32.dll ExitThread
USER32.dll GetCursorPos
GDI32.dll CreateRoundRectRgn
SHELL32.dll GetCurrentProcessExplicitAppUserModelID
ole32.dll CoTaskMemFree
ADVAPI32.dll CryptEncrypt
bcrypt.dll BCryptGenRandom
dwmapi.dll DwmSetWindowAttribute
KERNEL32.dll (#2) ExitThread
KERNEL32.dll (#3) ExitThread

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.38822
MD5 8d748450b6fc15c6197d336bcffc6873
SHA1 ced8ba261566f5aba3a75b378087a727e9f8d89d
SHA256 aa05d8a0e6b6d618f1676c6398072eb059307ca4494d084dd555ecdf007119c1
SHA3 977094bf73a6b58c8de434d62dab77022d822e5b20c15f6f70285d1e5a465dbd

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.43944
MD5 718b21f29d83e481a2599155bd34facb
SHA1 01f40888fbd7c88c5499e7c1efbc5b3ee98d69f4
SHA256 f052cd47cdbab5c2aef126c2e21e478d078c3f6697edad90e2419733a443d8cf
SHA3 c67b78b8c482abdfcf67d56c66bcdf3dec14b2a07dd2e1241add1571822b2319

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.49866
MD5 c4d7f77c90a216e0522d78c077294f2c
SHA1 79ad97d8d423ef8dd45f8eac2b0241451bc4da31
SHA256 8f38cddf372a3b3adab8aa64218b4f93e9ead273404c0de435512bbe5b1db4e0
SHA3 5929f32350b08217da7f261d6ccc8d7feb937a452d8d7d05cc32d4f66bc6a78f

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.53529
MD5 cf3cc224c248e0f1ae3a0c60cce7e857
SHA1 f61773bb9efadee51552281b1abd0f7f7193d1b3
SHA256 8b75bb0aa979af48964bcca9c0c502285247070aabc90d998344e07f9c6b8828
SHA3 0cd5d6e14f8afd7085a6756b347e5308597328f7b4a1fffd5e981bd41d6fc1c4

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.54431
MD5 7b5375f1d7526b43b3a2034d1e0f3704
SHA1 e20e843d2b937fb675282e1a62ba3ddb5ea51e3c
SHA256 a7a606e1b719e2bd89c9a1113edfa3d1961b19006663618b08645ababe405ab8
SHA3 0ef9b9c1283ba51c0d516008ea5ba0dcb93d9e905d1f502d977508b2499c81b0

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.55416
MD5 8020f74c1f935ed460adc77f3438fc44
SHA1 c9db9f4995ea04818d569f50f9de651d12905a92
SHA256 666edd12a3f40031fc21d85730d907edef6b51cfb0881d3bddb370fefe2bbccf
SHA3 a0400926d53783255b43081c254ef4971a3d9248b3cc080291286830f8ba72b6

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.5684
MD5 a1dd5e470e62e8eee2c4179c7b83030a
SHA1 a77d7c8161bbdcd1cf3e824c5c0d09ff874d5954
SHA256 848d6cef9dd025ea189ff40465bd5b6d82a7336ef7952108fa8a5e02a813d188
SHA3 da349970862f85648bc14ff37915df6d5945e9eba7a771602ee54516072bbde1

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.58108
MD5 cdef056a145f109e64fe494668f80b3d
SHA1 6bc0962897c40a431d2f9c1f6a5813a308a3cae0
SHA256 318fd082430b4afd6021b35d153a0fa8b74e43107457e6450b62fd0933347b42
SHA3 8633d1079946937bd1c26c8b81065314ac98f813e1b78c84c3b490268a370de5

9

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.66042
MD5 904f4418f145f302024fd7ece0c6844e
SHA1 43c30f0d6caa49dfdcdbd573ca6bddf1aa838974
SHA256 e82a2ef786c4e2b4c751560478ad5e6b279320f0b523e453ee57e1f5ab96acb8
SHA3 1b704457036db0f25cdbb88adef04a42228bec463e8d136c02f62e62c3c0d632

PHOTO_2026-01-10_19-25-45

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01226
Detected Filetype Icon file
MD5 8bd3cd6b83e995093febc060ec76aeb3
SHA1 b0338c581ad2beceda2bccbaa46d96383d3dc4a1
SHA256 4f16960f06a3608a7d49573795526ff6790c65d8015f0419d72a373e55ed8ac7
SHA3 dab5ecc0662f74eef0913882133480a1e4285be23cab87b03392d82bdce0c981

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140193700

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section .#Ql has a size of 0!
Leave a comment

No comments yet.