| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-May-09 03:17:09 |
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 15/70 (Scanned on 2026-05-04 19:39:42) |
APEX:
Malicious
Antiy-AVL: Trojan/Win32.Agent CAT-QuickHeal: Trojan.Riskware CTX: exe.trojan.generic Cylance: Unsafe Fortinet: W32/PossibleThreat Gridinsoft: Trojan.Win32.Gen.cl K7AntiVirus: Riskware ( 0040eff71 ) K7GW: Riskware ( 0040eff71 ) MaxSecure: Trojan.Malware.3411146.susgen Rising: Trojan.Generic!8.C3 (CLOUD) Trapmine: malicious.moderate.ml.score TrellixENS: GenericRXAA-AA!2A64F1E0FBB0 VBA32: Trojan.Yomal Zillya: Adware.Generic.Win32.175573 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2023-May-09 03:17:09 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xfe00 |
| SizeOfInitializedData | 0x9200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001A93 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x11000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
RegCreateKeyExW
RegOpenKeyExW RegQueryValueExW RegSetValueExA RegSetValueExW RegCloseKey |
|---|---|
| USER32.dll |
MessageBoxA
|
| KERNEL32.dll |
WriteConsoleW
CreateFileW SetEnvironmentVariableW GetFileAttributesW GetFullPathNameW CloseHandle WaitForSingleObject GetCurrentProcessId TerminateProcess ResumeThread CreateProcessW GetModuleFileNameW GetModuleHandleW lstrcpyW lstrlenA lstrlenW GetPrivateProfileStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode DecodePointer RaiseException |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-May-09 03:17:09 |
| Version | 0.0 |
| SizeofData | 636 |
| AddressOfRawData | 0x16c7c |
| PointerToRawData | 0x15e7c |
| Size | 0x5c |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x418004 |
| SEHandlerTable | 0x416c70 |
| SEHandlerCount | 3 |
| XOR Key | 0x7f34f26c |
|---|---|
| Unmarked objects | 0 |
| ASM objects (26213) | 9 |
| C++ objects (26213) | 138 |
| C objects (26213) | 18 |
| ASM objects (24237) | 16 |
| C++ objects (24237) | 29 |
| C objects (24237) | 17 |
| Imports (26213) | 7 |
| Total imports | 96 |
| C++ objects (24245) | 1 |
| Linker (24245) | 1 |
No comments yet.