7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-13 08:36:49
Detected languages English - United States
CompanyName Madium
FileDescription Madium Installer
FileVersion 1.1.0
InternalName Madium Installer
OriginalFilename Installer-1.1.0.exe
ProductName Madium Installer
ProductVersion 1.1.0

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Malicious The PE is possibly a dropper. Resource PAYLOAD_CAB detected as a CAB Installer file.
Resources amount for 98.456% of the executable.
Malicious VirusTotal score: 25/71 (Scanned on 2026-10-29 09:15:01) APEX: Malicious
AVG: FileRepMalware
Avast: FileRepMalware
CAT-QuickHeal: Trojan.Agent
DeepInstinct: MALICIOUS
Elastic: malicious (moderate confidence)
Fortinet: W32/PossibleThreat
Google: Detected
Gridinsoft: Trojan.Win64.Wacatac.bot
K7AntiVirus: Riskware ( 00584baa1 )
K7GW: Riskware ( 00584baa1 )
Lionic: Trojan.Win32.Generic.4!c
MaxSecure: Trojan.Malware.8328611.susgen
McAfeeD: ti!7D369EF21A49
Microsoft: Trojan:Win32/Malgent
Paloalto: generic.ml
Skyhigh: BehavesLike.Win64.Dropper.tc
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.high.ml.score
TrellixENS: Artemis!05F15A788B38
TrendMicro: Trojan.Win64.WACATAC.TL0101HN26ZV
TrendMicro-HouseCall: Trojan.Win64.WACATAC.TL0101HN26ZV
VBA32: Trojan.Malgent
Varist: W64/ABTrojan.QWHO-0864

Hashes

MD5 05f15a788b381191b0c021690ee60142 🔍
SHA1 f63593f46bbbff726733225869ce29a33eefc7ae 🔍
SHA256 7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249 🔍
SHA3 e2ca003e014c15fa564bc05a8971e9f7227f44c18d2ce56364e7f5eb3f362856 🔍
SSDeep 196608:p72MJ9yZ9AsAxGpA4mdlHRTabZU8iUa+Ls1TX5d0fLjdFF5OoFaQtuJ0K3:Z2MJl8pApdtwiUa6YTX5+rF5O0awK3 🔍
Imports Hash 99186799183134845e3e1dd8f17e7a37 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-13 08:36:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x16600
SizeOfInitializedData 0x9b1c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008674 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x9cc000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 23ab22c2edc2b7a704243efc6ae2de27 🔍
SHA1 f0d446b7cb4fcba101c46805bfd1bd587c1d19df 🔍
SHA256 50cafbd0465fe49a1e55452a982230e0115ffdb8c2532efe9958cb6a9020cfe4 🔍
SHA3 b7d313c2075e0d93ff7b539f3adc13f8d3b042972664e8db943242a0fc3e2f2b 🔍
VirtualSize 0x16580
VirtualAddress 0x1000
SizeOfRawData 0x16600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.41113

.rdata

MD5 d76f844667e4160323c1552b5274b098 🔍
SHA1 926fafddb816bdb60e0d57436be2015a0ecdc120 🔍
SHA256 dc5ef7badf55ea7c5746cbb344d598a1eeae7eac0204417bae97f2da923414dd 🔍
SHA3 8fc9f94239a1c475aafd5652a29bc78b357fac6f999b77023af3a96ef756653f 🔍
VirtualSize 0xca4c
VirtualAddress 0x18000
SizeOfRawData 0xcc00
PointerToRawData 0x16a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.69099

.data

MD5 ec4cc9f40897739d9fde579ffd1b6f24 🔍
SHA1 b7d0c7aff95f9cc7bdc28cb519db5249b4c41e0e 🔍
SHA256 55d88b3b5bba8ebe63040f612d25448d58bdaac86b1ba41c145e34051c2f9e6e 🔍
SHA3 14898f11b3fe0e2fe36baeaba590cf40852e4cbd16e29713c94857fc5582dbee 🔍
VirtualSize 0x1ed8
VirtualAddress 0x25000
SizeOfRawData 0xe00
PointerToRawData 0x23600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.47452

.pdata

MD5 188bb5b6e9cbdf5e9530c68043742bc6 🔍
SHA1 ac318d30f7c38eef85ade92aca7dd995e6d5d05f 🔍
SHA256 d56f505727118c4acb8a71187eedff5c5401b52d129fb25f24130b4c20a3ea48 🔍
SHA3 7bc19ea7ca9f6b9f1db1936dc02839c0f56db73dd230bf85d4c358c2acdcb458 🔍
VirtualSize 0x16b0
VirtualAddress 0x27000
SizeOfRawData 0x1800
PointerToRawData 0x24400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.99712

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x29000
SizeOfRawData 0x200
PointerToRawData 0x25c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 e0bce482ae06b71c7e4f065fa635e0ea 🔍
SHA1 6fe3afa37d48c0a74aab9dd1cf82636850e1d61a 🔍
SHA256 4f4d8361c7885eef7cada829459d612aa0e764bd4ccd82da8b76f93702d0c8f7 🔍
SHA3 6ff860a32af9524fc266939531935df6a049b8bea8ef267b8b72c4b6d1f7bb36 🔍
VirtualSize 0x9a0c68
VirtualAddress 0x2a000
SizeOfRawData 0x9a0e00
PointerToRawData 0x25e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99989

.reloc

MD5 bd33751f5a55cf6090304ce252e5f3c3 🔍
SHA1 593fec1943de4cafecf771112d2c37c7123ba58c 🔍
SHA256 a0b37c1ceedbb1d80887770cfac07d51c525f40e00ca9219fbf87911b736c878 🔍
SHA3 7a295ba258815ce6f4586f9e372b855cc4278ca6356d2c09b2134547e2524ad4 🔍
VirtualSize 0x768
VirtualAddress 0x9cb000
SizeOfRawData 0x800
PointerToRawData 0x9c6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.26187

Imports

ole32.dll CoTaskMemFree
CoCreateGuid
StringFromGUID2
SETUPAPI.dll SetupIterateCabinetW
SHELL32.dll SHGetKnownFolderPath
KERNEL32.dll GetSystemTimeAsFileTime
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
CreateFileW
WriteFile
GetTempPathW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
FormatMessageW
FlushFileBuffers
HeapReAlloc
HeapSize
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCPInfo
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
USER32.dll MessageBoxW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.35891
Detected Filetype PNG graphic file
MD5 5e81a9ace64009356dc6a77d38f15b8d 🔍
SHA1 27412b972349f357059bd6de6205aae6b74ff32c 🔍
SHA256 f85e26b3ad984f7875e0be6aa1117afc2f4d3d443d60106b092b677caff47765 🔍
SHA3 f3b28e9e288878794a84eba132e87200e3c8b15b4c80696f9c14d1004d72fbc4 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x354
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.59485
Detected Filetype PNG graphic file
MD5 28981e7375c29afac679019925c74e44 🔍
SHA1 911090164cde5f094c60621cda639c2d0e99364f 🔍
SHA256 7f182b2de61e1c1aee9ad6cb7f11759a20d51531d281b7b95c412085b66b9b6c 🔍
SHA3 003fc5d3b798ae21f313082ca1a9ffb1425bb4ce6d04288943155f153357f05c 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4de
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.71597
Detected Filetype PNG graphic file
MD5 650b67b0c820222c8521f989f335c7b5 🔍
SHA1 4eb7846cc085744f4bb8aac93e69a93b8c6710db 🔍
SHA256 11a70476f237d7067e33c2adb2356f07e9dd8c4ca9c9b74b2dd46a17e12dbb9e 🔍
SHA3 aa2fd0fb653f66878dc42141e9cd02ff206ff3c593bb325529fd27fa00af490c 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8c2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83025
Detected Filetype PNG graphic file
MD5 1fefa531027737a235dfb2380ba595c7 🔍
SHA1 a8a38136c6dcfc60ae6f80cebf3c44253d0ebf0d 🔍
SHA256 32bdfb7526ed13b9a57cd51c741eee3afb3e1e4f5d99fc997a08948f4484583b 🔍
SHA3 af7ef8168c99fb40fae7e8a8881e3d84abdaa28b590b9ee1e7f6196494ed9f84 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xd8a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89639
Detected Filetype PNG graphic file
MD5 224d99a1a75afd8495cc4c64761ae52d 🔍
SHA1 6b4e3e27a2dfed96328797daded31dc9f08ff384 🔍
SHA256 463b30e4c6fff3f5cb7e2ca3e50fbee8b88bd8e50e9be4ea8db8f5022e7bf2bf 🔍
SHA3 041ca44186128bd2ad0ad25166b11a8e3a71927575477ffd25bc9a4adfd9452a 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2960
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96573
Detected Filetype PNG graphic file
MD5 f41396166cc3887c6d65aaaadcdbee7e 🔍
SHA1 35ae644d5dd9deb13e89c1189137f56a0d696da9 🔍
SHA256 2fe6519dc4788ba0bdf899ae09f35f44b61f13beb726460523099db8ce2d00f3 🔍
SHA3 6b9d511b172248f9bc2a2ff9b570c100feb9e2c5531382cf34a55989b971496e 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x89f1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98333
Detected Filetype PNG graphic file
MD5 a5bdd087ec2652239b6f4652d435cbb3 🔍
SHA1 d4b81d3fbab116afc6c5113659c7274116ded175 🔍
SHA256 3afaa7c52c41b492a4789d7e8b2eb2ac996fb360db6a7801a40d5295cd91a667 🔍
SHA3 4350c2b5e0610b019f4f0ffad9f195be68116520b03661aa3587a0691f380320 🔍

PAYLOAD_CAB

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x993154
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99991
Detected Filetype CAB Installer file
MD5 4bade8950b6da23e4ca071c264f68254 🔍
SHA1 d102ba39afa8573fad12c7fc816486bb4fd71aeb 🔍
SHA256 13837b89c714f22907b4934dce256c569cd5a92ed392da358f80977962ab65e6 🔍
SHA3 ce7ac68561a3a396ce6a7568eee7292207997985ce2215fd2ea3559035bcb2db 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.85168
Detected Filetype Icon file
MD5 d9a266e6675bd99f642dab08e77169f1 🔍
SHA1 c25af2445b30e90c11103393018aeedb04c60afe 🔍
SHA256 826e26f3784b385845452d976343221b39858abda9359366f332cb90961b12a2 🔍
SHA3 c7cad0bc352c570467f9be06f17e6e75408a39de4d3ccaa8a214ff26cb1bcff7 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x28c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.24351
MD5 c2b7c8796787326be861a2f4c3310f1c 🔍
SHA1 0df877d58c6460402429e8c9902208a8b479ede1 🔍
SHA256 956af8ad069808bf2e3a4633000e113a7061ac39d8da0cfcad3050e6db8bb8f7 🔍
SHA3 23f268b4181dc01119aab09c7e61b6100f977557af787d16ba80bdee4a016b24 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.1.0.0
ProductVersion 1.1.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Madium
FileDescription Madium Installer
FileVersion (#2) 1.1.0
InternalName Madium Installer
OriginalFilename Installer-1.1.0.exe
ProductName Madium Installer
ProductVersion (#2) 1.1.0
Resource LangID English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-13 08:36:49
Version 0.0
SizeofData 840
AddressOfRawData 0x21f18
PointerToRawData 0x20918

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140025040

RICH Header

XOR Key 0x9efe119d
Unmarked objects 0
C++ objects (33145) 142
C objects (33145) 12
ASM objects (33145) 8
ASM objects (35207) 9
C objects (35207) 16
C++ objects (35207) 47
C objects (CVTCIL) (33145) 1
Imports (33145) 11
Total imports 130
C++ objects (35228) 1
Resource objects (35228) 1
151 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.