Manalyze report for 7701a631c502e01b64327f6a3262d64fde34506805f17dbd968048e2a7e060c5

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2015-Feb-25 06:12:18
Detected languages	English - United States

Plugin Output

Suspicious	The PE is packed with UPX	`Unusual section name found: NPX0` `Section NPX0 is both writable and executable.` `Unusual section name found: UPX1` `Section UPX1 is both writable and executable.`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: LoadLibraryA GetProcAddress` `Can access the registry: RegFlushKey` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Has Internet access capabilities: InternetOpenA` `Leverages the raw socket API to access the Internet: WS2_32.dll`
Malicious	VirusTotal score: 55/72 (Scanned on 2025-04-01 17:27:23)	`ALYac: Trojan.GenericKD.41929002` `APEX: Malicious` `AVG: Win32:Agent-BCKN [Trj]` `AhnLab-V3: Trojan/Win64.Ransomlock.R266454` `Alibaba: Ransom:Win32/Blocker.c3da58e5` `Antiy-AVL: Trojan[Ransom]/Win32.Blocker` `Arcabit: Trojan.Generic.D27FC92A` `Avast: Win32:Agent-BCKN [Trj]` `Avira: HEUR/AGEN.1314235` `BitDefender: Trojan.GenericKD.41929002` `Bkav: W64.AIDetectMalware` `CAT-QuickHeal: Trojan.Ghanarava.1551994336934987` `CTX: exe.trojan.generic` `CrowdStrike: win/malicious_confidence_100% (D)` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.Encoder.27924` `ESET-NOD32: a variant of Win64/Agent.HQ` `Elastic: malicious (moderate confidence)` `Emsisoft: Trojan.GenericKD.41929002 (B)` `F-Secure: Heuristic.HEUR/AGEN.1314235` `FireEye: Generic.mg.4a97769c16cc6c0c` `Fortinet: W64/Agent.HQ!tr` `GData: Trojan.GenericKD.41929002` `Google: Detected` `Gridinsoft: Trojan.Heur!.032120EB` `Ikarus: Trojan.Win64.Agent` `Jiangmin: Trojan.Blocker.pro` `K7AntiVirus: Riskware ( 0040eff71 )` `K7GW: Riskware ( 0040eff71 )` `Kaspersky: Trojan-Ransom.Win32.Blocker.lxul` `Kingsoft: malware.kb.b.911` `Lionic: Trojan.Win32.Blocker.4!c` `Malwarebytes: Generic.Malware/Suspicious` `MaxSecure: Trojan.Malware.1129961.susgen` `McAfee: Artemis!4A97769C16CC` `MicroWorld-eScan: Trojan.GenericKD.41929002` `Microsoft: Trojan:Win32/Ymacco.AA77` `NANO-Antivirus: Trojan.Win64.Blocker.fpohit` `Paloalto: generic.ml` `Panda: Trj/CI.A` `Rising: Ransom.Blocker!8.12A (TFE:5:Kx56VXT5kmM)` `SentinelOne: Static AI - Malicious PE` `Skyhigh: BehavesLike.Win64.Generic.nc` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `Tencent: Win32.Trojan.Blocker.Pqil` `Trapmine: malicious.moderate.ml.score` `VBA32: TrojanRansom.Blocker` `VIPRE: Trojan.GenericKD.41929002` `Xcitium: Malware@#2ljy7zyhi4e7g` `Yandex: Trojan.Blocker!uDrodFzx39s` `Zillya: Trojan.Blocker.Win32.43485` `alibabacloud: Ransomware:Win/Blocker.aff4231a`

Hashes

MD5	`4a97769c16cc6c0c2b69c78cd6934987` 🔍
SHA1	`05375e31dbf641f73cfb4b3fe3a1dbf5400587a2` 🔍
SHA256	`7701a631c502e01b64327f6a3262d64fde34506805f17dbd968048e2a7e060c5` 🔍
SHA3	`c7e6ee904fb9f572fa5a031a0421b4515088a98b6826131ba84f9dd664d30a39` 🔍
SSDeep	`768:T/at+/UnTeesPcQaxXVphhygESmU/MdeupNpaursy:T6+8ncPgVphhwSmPeupD9rsy` 🔍
Imports Hash	`49471bd8fd2a676bd59403175df5f7d9` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xe8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`3`
TimeDateStamp	2015-Feb-25 06:12:18
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`10.0`
SizeOfCode	`0x9000`
SizeOfInitializedData	`0x1000`
SizeOfUninitializedData	`0x11000`
AddressOfEntryPoint	`0x000000000001A4A0 (Section: UPX1)`
BaseOfCode	`0x12000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`5.2`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x1c000`
SizeOfHeaders	`0x1000`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

NPX0

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x11000`
VirtualAddress	`0x1000`
SizeOfRawData	`0`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

UPX1

MD5	`1fd7e43f058ced9dc36862fc3d5eab7b 🔍`
SHA1	`4717b41b5e405e1175cb1601ee5c81906d828389 🔍`
SHA256	`ae88262b2ea2ca56982fe1dbf7ed68cf0c764da18bbc241500e238a12e77c1ac 🔍`
SHA3	`804c96cbf21d0a895f2029b01571cabe4062e2d378dcd385d675d6033a324b77 🔍`
VirtualSize	`0x9000`
VirtualAddress	`0x12000`
SizeOfRawData	`0x8800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.89234`

.rsrc

MD5	`070cd68086c42d2d69e582d2ebb03d57 🔍`
SHA1	`9e44327abd6999d095f94b0fe60d56ecca800fca 🔍`
SHA256	`45e397ff71e326be3bedb0c2b7800fd0893403a7cf7d42baee3b1087a14a9666 🔍`
SHA3	`b27a5abb5c3e059bbe74f09919ea3e39a374c51579679e7c2f495aadf5784775 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x1b000`
SizeOfRawData	`0x400`
PointerToRawData	`0x8c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.05925`

Imports

KERNEL32.DLL	`LoadLibraryA` `GetProcAddress` `VirtualProtect` `VirtualAlloc` `VirtualFree` `ExitProcess`
ADVAPI32.dll	`RegFlushKey`
USER32.dll	`GetDC`
WININET.dll	`InternetOpenA`
WS2_32.dll	`gethostname`

Delayed Imports

101

Type	`CONFIG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x49`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.90551`
MD5	`851035dee190a13114344c1a3d868dbf 🔍`
SHA1	`419d683de42214baa0601b3a73f53179f37d0794 🔍`
SHA256	`a0e5400b3bb16b078d1bbe6b922a7b6a99a00ee6f8c7715ce824e301a700a1b6 🔍`
SHA3	`7b37a5a74f176d74b27aa0a3d209007b1a6f652236450b698ae312faa39f12bc 🔍`

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xfe2e1a17`
Unmarked objects	`0`
C++ objects (VS2010 build 30319)	`25`
C objects (VS2010 build 30319)	`92`
ASM objects (VS2010 build 30319)	`11`
Imports (VS2008 SP1 build 30729)	`11`
Total imports	`127`
175 (VS2010 build 30319)	`5`
Resource objects (VS2010 build 30319)	`1`
Linker (VS2010 build 30319)	`1`

Errors

[*] Warning: Section NPX0 has a size of 0!

Leave a comment

No comments yet.