6f9f697c38e604e4cd7047fc6be81d2bbe82f0b21c088af2491522da30a6e073

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jun-17 13:50:30

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • -ZZYy.de
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Unusual section name found: .(`<
Unusual section name found: .GEh
Unusual section name found: .Ou7
The PE only has 4 import(s).
Info The PE contains common functions which appear in legitimate applications. Uses Microsoft's cryptographic API:
  • CryptDestroyHash
Malicious VirusTotal score: 46/69 (Scanned on 2026-07-05 11:07:50) ALYac: Trojan.GenericKD.80587460
AVG: Win32:MalwareX-gen [Misc]
Alibaba: Trojan:Win32/VMProtect.6a57541e
Antiy-AVL: Trojan/Win32.DLLhijack
Arcabit: Trojan.Generic.D4CDAAC4
Avast: Win32:MalwareX-gen [Misc]
Avira: TR/W32.Agent
BitDefender: Trojan.GenericKD.80587460
Bkav: W32.Malware.CAC3F153
CTX: dll.trojan.dllhijack
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win32/Packed.VMProtect.BC suspicious application
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.80587460 (B)
F-Secure: Trojan.TR/W32.Agent
Fortinet: Riskware/Application
GData: Trojan.GenericKD.80587460
Google: Detected
Gridinsoft: Trojan.Heur!.022120A0
K7AntiVirus: Unwanted-Program ( 005ce2c11 )
K7GW: Unwanted-Program ( 005ce2c11 )
Kaspersky: Trojan.Win32.DLLhijack.ajfa
Lionic: Trojan.Win32.DLLhijack.4!c
MaxSecure: Trojan.Malware.613480129.susgen
McAfeeD: Real Protect-LS!6E33EC7A8FC7
MicroWorld-eScan: Trojan.GenericKD.80587460
Microsoft: Trojan:Win32/Ravartar!rfn
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.DLLhijack!8.1B50 (CLOUD)
Sangfor: Trojan.Win32.Dllhijack.Vwgh
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win32.Trojan.wc
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Win32.Trojan.Dllhijack.Gkjl
Trapmine: suspicious.low.ml.score
TrellixENS: Artemis!6E33EC7A8FC7
TrendMicro: Trojan.Win32.ZYX.USBLFK26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFK26
VBA32: Malware-Cryptor.Inject.gen
VIPRE: Trojan.GenericKD.80587460
Varist: W32/ABApplication.OOPJ-1497
alibabacloud: Trojan:Win/Ravartar.Gen

Hashes

MD5 6e33ec7a8fc7a947d1492a05d67723bb
SHA1 091c4200cb78bcb4c991c65a4b80d13f75b416a0
SHA256 6f9f697c38e604e4cd7047fc6be81d2bbe82f0b21c088af2491522da30a6e073
SHA3 7cc814fb31d4278e874e90e8b49f8cc2b867ba7299817574f0e42c9eb9955bd9
SSDeep 393216:0OIGx1R6GIs1fgBdvw0RUZH40c9yxNtjVuQswsZCj++:0OIGx1vIIgBdvFPEztRuQswsF
Imports Hash 0cf9cee94eb97e9647f99e35df2c7970

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 2026-Jun-17 13:50:30
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x4f000
SizeOfInitializedData 0xe600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x013D8100 (Section: .Ou7)
BaseOfCode 0x1000
BaseOfData 0x50000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1828000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x4ee0f
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x9fde
VirtualAddress 0x50000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1e74
VirtualAddress 0x5a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x80
VirtualAddress 0x5c000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.(`<

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x87d835
VirtualAddress 0x5d000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ

.GEh

MD5 3cf2ca25d985500664b8025f147d4dce
SHA1 0cdd637a9c70494958fd52dd32aa253852b4f331
SHA256 015cb55aca1877bd310b6a1056c229e1b16a2dabbfb4bfaab00e9b6d5859ec41
SHA3 6a46335f7cb0222e03a90ad5a1f2c6b3540b1bada3c8c3b6673755339dbe97e3
VirtualSize 0x3c
VirtualAddress 0x8db000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.380221

.Ou7

MD5 66bef434e7224a38e9825b5398370d84
SHA1 6fa0e2eeb58bceed658f36881c4c3f143b2e8566
SHA256 9fc4a8cbe7b28b977995bad4aaf6d21ac44a349e5e03a8db65dd647141157a71
SHA3 b4efff438280440ed2fe0e36dfd50a3111c871776d8fd3a9686a0826e79f2c18
VirtualSize 0xf4a598
VirtualAddress 0x8dc000
SizeOfRawData 0xf4a600
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.89794

.reloc

MD5 37c0c93a09da472be34654beaaf20abc
SHA1 4c7da9c33a27360c8c0e873897ec3dd910f65dc8
SHA256 12ff32a7808d972ba911db72d7f13a7ef064a420a344d5c7c2b0f66fcac8b63f
SHA3 395d9d11bdaacee3db963a6c35d8be76cdf746916a47b6d1fa09a15bca475a61
VirtualSize 0x798
VirtualAddress 0x1827000
SizeOfRawData 0x800
PointerToRawData 0xf4ac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.41795

Imports

SHLWAPI.dll StrCmpNIA
USER32.dll MessageBoxA
ADVAPI32.dll CryptDestroyHash
KERNEL32.dll WriteFile

Delayed Imports

SHGetFolderPathA

Ordinal 1
Address 0x1df0

SHGetFolderPathW

Ordinal 2
Address 0x1e00

Version Info

TLS Callbacks

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1005a200
SEHandlerTable 0x11826380
SEHandlerCount 134

RICH Header

Errors

[*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section .(`< has a size of 0!
Leave a comment

No comments yet.