Manalyze report for 6e53c3b3e0a2421b6c4668269b15ed806494382a1b6e106e63bf421187ebc5a1

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2019-Jul-30 08:52:45

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig2(h)`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: LoadLibraryExW GetProcAddress LoadLibraryW` `Possibly launches other programs: CreateProcessW` `Can create temporary files: GetTempPathW CreateFileW`
Info	The PE's resources present abnormal characteristics.	`Resource 7AAD6935B8D8F0ABE43C64E69E235C72 is possibly compressed or encrypted.`
Malicious	VirusTotal score: 18/70 (Scanned on 2026-10-19 18:48:29)	`Bkav: W32.Malware.A0E9171` `CrowdStrike: win/malicious_confidence_70% (D)` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `Elastic: malicious (high confidence)` `Google: Detected` `Jiangmin: Riskware.PEEPOCheck.aq` `Kingsoft: malware.kb.a.811` `Malwarebytes: Malware.Heuristic.2159` `MaxSecure: Trojan.Malware.300983.susgen` `McAfeeD: Real Protect-LS!B6635D9F8975` `Sangfor: Trojan.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: BehavesLike.Win32.Dropper.cc` `Sophos: Generic ML PUA (PUA)` `TrellixENS: GenericRXWU-PN!B6635D9F8975` `Varist: W32/Agent.MEW2.gen!Eldorado`

Hashes

MD5	`b6635d9f897577cc0b896bdf9bd1a098` 🔍
SHA1	`1804e4988c5cce873f251aa8fa1b46447ee1c903` 🔍
SHA256	`6e53c3b3e0a2421b6c4668269b15ed806494382a1b6e106e63bf421187ebc5a1` 🔍
SHA3	`8c980bcf126ba75f7914213300d25ea01b4dd06fdbf73a04974ca5d75c0958c5` 🔍
SSDeep	`3072:97DhdC6kzWypvaQ0FxyNTBf5koZdlMpRx4ZTk2+:9BlkZvaF4NTBRIX4Z2` 🔍
Imports Hash	`2c5f2513605e48f2d8ea5440a870cb9e` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2019-Jul-30 08:52:45
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`2.0`
SizeOfCode	`0x11400`
SizeOfInitializedData	`0x13200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001000 (Section: .code)`
BaseOfCode	`0x1000`
BaseOfData	`0x13000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x28000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.code

MD5	`46da2c5018752470fd3127bf22d63b95 🔍`
SHA1	`79689d07d23e494c8a40e425f6b58b6fcfcee935 🔍`
SHA256	`dde5c88b25500cafc481c699e30ea58342b107228ef6f3a08d3361a60203430b 🔍`
SHA3	`dae8493b3d4a31fe01cf730bafbd7390586ff0f116fa5ded8284d0382b858c3e 🔍`
VirtualSize	`0x387e`
VirtualAddress	`0x1000`
SizeOfRawData	`0x3a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.52922`

.text

MD5	`e1a026e66953c410d7f60b1f1e3c560f 🔍`
SHA1	`838d55d26dd9efd6b0506c9c55f064f69bff3a1d 🔍`
SHA256	`97f61efc9684f623eae30fcce8a8b3035003d341200579275f19f5468d496a75 🔍`
SHA3	`cf24a88fe26c2aa2d32468714671eaf669efc73ed42178d15681551c2967b390 🔍`
VirtualSize	`0xd962`
VirtualAddress	`0x5000`
SizeOfRawData	`0xda00`
PointerToRawData	`0x3e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.56249`

.rdata

MD5	`a16842a34a5da6feda9533bb3e83c3c1 🔍`
SHA1	`597bcd6908d7d29b813201e8506c5ae636de4377 🔍`
SHA256	`e7aa3b9a2637a54058211b802f96742faf19c341e604e483c54b9da022bf7a4d 🔍`
SHA3	`054e5f2439e80e489d6f8f42717ee344b2492bc8230b9d42ef3816c922b51cc1 🔍`
VirtualSize	`0x33a5`
VirtualAddress	`0x13000`
SizeOfRawData	`0x3400`
PointerToRawData	`0x11800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.11184`

.data

MD5	`d0f8b293e808040f7d2e8554a1c1ef3d 🔍`
SHA1	`b905814325f38d1e768db42e69926e89507ebf8b 🔍`
SHA256	`7218d34f9286658e4a12275a3bace491e38c1f092b4160e0e3808568df569bf5 🔍`
SHA3	`48db1358515b325086d7bd3c2d7899f0f5fb12e39052bd483b18159897efafcb 🔍`
VirtualSize	`0x178c`
VirtualAddress	`0x17000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x14c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.10069`

.rsrc

MD5	`91669b51adcf80b87ee7e1fb3bcddcee 🔍`
SHA1	`1488cb79c41b21cba145d760b37f9494645bfc14 🔍`
SHA256	`e9f6b48cef2a2a3f47ac87550211b637e5df6b9ad489c93eec3b71e6b5ec0ad3 🔍`
SHA3	`a100778c4747ac49caaaa1d8f881aa9ab4ea173da90d0ca4b94d110413eef34d 🔍`
VirtualSize	`0xeb60`
VirtualAddress	`0x19000`
SizeOfRawData	`0xec00`
PointerToRawData	`0x15e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99169`

Imports

MSVCRT.dll	`memset` `wcsncmp` `memmove` `wcsncpy` `wcsstr` `_wcsnicmp` `_wcsdup` `free` `_wcsicmp` `wcslen` `wcscpy` `wcscmp` `wcscat` `memcpy` `tolower` `malloc`
KERNEL32.dll	`GetModuleHandleW` `HeapCreate` `GetStdHandle` `SetConsoleCtrlHandler` `HeapDestroy` `ExitProcess` `WriteFile` `GetTempFileNameW` `LoadLibraryExW` `EnumResourceTypesW` `FreeLibrary` `RemoveDirectoryW` `EnumResourceNamesW` `GetCommandLineW` `LoadResource` `SizeofResource` `FreeResource` `FindResourceW` `GetNativeSystemInfo` `GetShortPathNameW` `GetWindowsDirectoryW` `GetSystemDirectoryW` `EnterCriticalSection` `CloseHandle` `LeaveCriticalSection` `InitializeCriticalSection` `WaitForSingleObject` `TerminateThread` `CreateThread` `GetProcAddress` `GetVersionExW` `Sleep` `WideCharToMultiByte` `HeapAlloc` `HeapFree` `LoadLibraryW` `GetCurrentProcessId` `GetCurrentThreadId` `GetModuleFileNameW` `PeekNamedPipe` `TerminateProcess` `GetEnvironmentVariableW` `SetEnvironmentVariableW` `GetCurrentProcess` `DuplicateHandle` `CreatePipe` `CreateProcessW` `GetExitCodeProcess` `SetUnhandledExceptionFilter` `HeapSize` `MultiByteToWideChar` `CreateDirectoryW` `SetFileAttributesW` `GetTempPathW` `DeleteFileW` `GetCurrentDirectoryW` `SetCurrentDirectoryW` `CreateFileW` `SetFilePointer` `TlsFree` `TlsGetValue` `TlsSetValue` `TlsAlloc` `HeapReAlloc` `DeleteCriticalSection` `InterlockedCompareExchange` `InterlockedExchange` `GetLastError` `SetLastError` `UnregisterWait` `GetCurrentThread` `RegisterWaitForSingleObject`
USER32.DLL	`CharUpperW` `CharLowerW` `MessageBoxW` `DefWindowProcW` `DestroyWindow` `GetWindowLongW` `GetWindowTextLengthW` `GetWindowTextW` `UnregisterClassW` `LoadIconW` `LoadCursorW` `RegisterClassExW` `IsWindowEnabled` `EnableWindow` `GetSystemMetrics` `CreateWindowExW` `SetWindowLongW` `SendMessageW` `SetFocus` `CreateAcceleratorTableW` `SetForegroundWindow` `BringWindowToTop` `GetMessageW` `TranslateAcceleratorW` `TranslateMessage` `DispatchMessageW` `DestroyAcceleratorTable` `PostMessageW` `GetForegroundWindow` `GetWindowThreadProcessId` `IsWindowVisible` `EnumWindows` `SetWindowPos`
GDI32.DLL	`GetStockObject`
COMCTL32.DLL	`InitCommonControlsEx`
SHELL32.DLL	`ShellExecuteExW` `SHGetFolderLocation` `SHGetPathFromIDListW`
WINMM.DLL	`timeBeginPeriod`
OLE32.DLL	`CoInitialize` `CoTaskMemFree`
SHLWAPI.DLL	`PathAddBackslashW` `PathRenameExtensionW` `PathQuoteSpacesW` `PathRemoveArgsW` `PathRemoveBackslashW`

Delayed Imports

26888F9DD5

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x1`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0`
MD5	`55a54008ad1ba589aa210d2629c1df41 🔍`
SHA1	`bf8b4530d8d246dd74ac53a13471bba17941dff7 🔍`
SHA256	`4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a 🔍`
SHA3	`2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7 🔍`

65C106AAE754B2DA8BC9C3980812B999

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xe`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.23593`
MD5	`7bb55e591962edd967c9a3039407256c 🔍`
SHA1	`e84642313805d66ef70fdada202992d040a1c2cc 🔍`
SHA256	`8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91 🔍`
SHA3	`116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91 🔍`

7AAD6935B8D8F0ABE43C64E69E235C72

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xe6b9`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99705`
MD5	`e27e4bf4ef684164c550282910ea0d54 🔍`
SHA1	`a05ee67484399bf2d9ead7d62650e9367eb8591d 🔍`
SHA256	`75bd4f42d02e09c83bcd544e792256bd9a5c919a743c263d1e99aae40335b6fa 🔍`
SHA3	`393da38825674d95db08007b6309378751e1a574a1468c2d8496aafa03f396ba 🔍`

EE918F1A49F5A5615268A33C10C2224E806CAC12

Type	`RT_RCDATA`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xf`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.77356`
MD5	`31c66434c58339dc51e3c50f1d7c5269 🔍`
SHA1	`dcd462e55d206cd371dc6e4e7878bf411c558c28 🔍`
SHA256	`206a4a84abf948add48d2d79652161de213d1ae5e4ed4e418617aeda1ed99f7d 🔍`
SHA3	`033b548941c7ecab8770d2cf6186557582a3d00a13b8122ffd95276fd22a4ae5 🔍`

1

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x263`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.92322`
MD5	`841795bb3b61ebd511249778aa26af77 🔍`
SHA1	`59f426938522ef9906b0740821e8cc270d1ca897 🔍`
SHA256	`be809cba9d14bfb52a969d766992832b10e99e133babcdd99dc6d1bba5597cf7 🔍`
SHA3	`5fa5c36711cc5c3661248b1180ce35543201ff1dc77d158129b844f03a2144c9 🔍`

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.