| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Aug-13 08:36:49 |
| Detected languages |
English - United States
|
| CompanyName | Madium |
| FileDescription | Madium Installer |
| FileVersion | 1.1.0 |
| InternalName | Madium Installer |
| OriginalFilename | Installer-1.1.0.exe |
| ProductName | Madium Installer |
| ProductVersion | 1.1.0 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. |
Resource PAYLOAD_CAB detected as a CAB Installer file.
Resources amount for 98.456% of the executable. |
| Malicious | VirusTotal score: 25/71 (Scanned on 2026-10-29 09:15:01) |
APEX:
Malicious
AVG: FileRepMalware Avast: FileRepMalware CAT-QuickHeal: Trojan.Agent DeepInstinct: MALICIOUS Elastic: malicious (moderate confidence) Fortinet: W32/PossibleThreat Google: Detected Gridinsoft: Trojan.Win64.Wacatac.bot K7AntiVirus: Riskware ( 00584baa1 ) K7GW: Riskware ( 00584baa1 ) Lionic: Trojan.Win32.Generic.4!c MaxSecure: Trojan.Malware.8328611.susgen McAfeeD: ti!7D369EF21A49 Microsoft: Trojan:Win32/Malgent Paloalto: generic.ml Skyhigh: BehavesLike.Win64.Dropper.tc Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrellixENS: Artemis!05F15A788B38 TrendMicro: Trojan.Win64.WACATAC.TL0101HN26ZV TrendMicro-HouseCall: Trojan.Win64.WACATAC.TL0101HN26ZV VBA32: Trojan.Malgent Varist: W64/ABTrojan.QWHO-0864 |
| MD5 | 05f15a788b381191b0c021690ee60142 🔍 |
|---|---|
| SHA1 | f63593f46bbbff726733225869ce29a33eefc7ae 🔍 |
| SHA256 | 7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249 🔍 |
| SHA3 | e2ca003e014c15fa564bc05a8971e9f7227f44c18d2ce56364e7f5eb3f362856 🔍 |
| SSDeep | 196608:p72MJ9yZ9AsAxGpA4mdlHRTabZU8iUa+Ls1TX5d0fLjdFF5OoFaQtuJ0K3:Z2MJl8pApdtwiUa6YTX5+rF5O0awK3 🔍 |
| Imports Hash | 99186799183134845e3e1dd8f17e7a37 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Aug-13 08:36:49 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x16600 |
| SizeOfInitializedData | 0x9b1c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000008674 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x9cc000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 23ab22c2edc2b7a704243efc6ae2de27 🔍 |
|---|---|
| SHA1 | f0d446b7cb4fcba101c46805bfd1bd587c1d19df 🔍 |
| SHA256 | 50cafbd0465fe49a1e55452a982230e0115ffdb8c2532efe9958cb6a9020cfe4 🔍 |
| SHA3 | b7d313c2075e0d93ff7b539f3adc13f8d3b042972664e8db943242a0fc3e2f2b 🔍 |
| VirtualSize | 0x16580 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x16600 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.41113 |
| MD5 | d76f844667e4160323c1552b5274b098 🔍 |
|---|---|
| SHA1 | 926fafddb816bdb60e0d57436be2015a0ecdc120 🔍 |
| SHA256 | dc5ef7badf55ea7c5746cbb344d598a1eeae7eac0204417bae97f2da923414dd 🔍 |
| SHA3 | 8fc9f94239a1c475aafd5652a29bc78b357fac6f999b77023af3a96ef756653f 🔍 |
| VirtualSize | 0xca4c |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0xcc00 |
| PointerToRawData | 0x16a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.69099 |
| MD5 | ec4cc9f40897739d9fde579ffd1b6f24 🔍 |
|---|---|
| SHA1 | b7d0c7aff95f9cc7bdc28cb519db5249b4c41e0e 🔍 |
| SHA256 | 55d88b3b5bba8ebe63040f612d25448d58bdaac86b1ba41c145e34051c2f9e6e 🔍 |
| SHA3 | 14898f11b3fe0e2fe36baeaba590cf40852e4cbd16e29713c94857fc5582dbee 🔍 |
| VirtualSize | 0x1ed8 |
| VirtualAddress | 0x25000 |
| SizeOfRawData | 0xe00 |
| PointerToRawData | 0x23600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.47452 |
| MD5 | 188bb5b6e9cbdf5e9530c68043742bc6 🔍 |
|---|---|
| SHA1 | ac318d30f7c38eef85ade92aca7dd995e6d5d05f 🔍 |
| SHA256 | d56f505727118c4acb8a71187eedff5c5401b52d129fb25f24130b4c20a3ea48 🔍 |
| SHA3 | 7bc19ea7ca9f6b9f1db1936dc02839c0f56db73dd230bf85d4c358c2acdcb458 🔍 |
| VirtualSize | 0x16b0 |
| VirtualAddress | 0x27000 |
| SizeOfRawData | 0x1800 |
| PointerToRawData | 0x24400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.99712 |
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x100 |
| VirtualAddress | 0x29000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x25c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
| MD5 | e0bce482ae06b71c7e4f065fa635e0ea 🔍 |
|---|---|
| SHA1 | 6fe3afa37d48c0a74aab9dd1cf82636850e1d61a 🔍 |
| SHA256 | 4f4d8361c7885eef7cada829459d612aa0e764bd4ccd82da8b76f93702d0c8f7 🔍 |
| SHA3 | 6ff860a32af9524fc266939531935df6a049b8bea8ef267b8b72c4b6d1f7bb36 🔍 |
| VirtualSize | 0x9a0c68 |
| VirtualAddress | 0x2a000 |
| SizeOfRawData | 0x9a0e00 |
| PointerToRawData | 0x25e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.99989 |
| MD5 | bd33751f5a55cf6090304ce252e5f3c3 🔍 |
|---|---|
| SHA1 | 593fec1943de4cafecf771112d2c37c7123ba58c 🔍 |
| SHA256 | a0b37c1ceedbb1d80887770cfac07d51c525f40e00ca9219fbf87911b736c878 🔍 |
| SHA3 | 7a295ba258815ce6f4586f9e372b855cc4278ca6356d2c09b2134547e2524ad4 🔍 |
| VirtualSize | 0x768 |
| VirtualAddress | 0x9cb000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x9c6c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.26187 |
| ole32.dll |
CoTaskMemFree
CoCreateGuid StringFromGUID2 |
|---|---|
| SETUPAPI.dll |
SetupIterateCabinetW
|
| SHELL32.dll |
SHGetKnownFolderPath
|
| KERNEL32.dll |
GetSystemTimeAsFileTime
WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP CreateFileW WriteFile GetTempPathW CloseHandle GetLastError SetLastError WaitForSingleObject GetExitCodeProcess CreateProcessW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW LocalFree FormatMessageW FlushFileBuffers HeapReAlloc HeapSize FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCPInfo GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap |
| USER32.dll |
MessageBoxW
|
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x200 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.35891 |
| Detected Filetype | PNG graphic file |
| MD5 | 5e81a9ace64009356dc6a77d38f15b8d 🔍 |
| SHA1 | 27412b972349f357059bd6de6205aae6b74ff32c 🔍 |
| SHA256 | f85e26b3ad984f7875e0be6aa1117afc2f4d3d443d60106b092b677caff47765 🔍 |
| SHA3 | f3b28e9e288878794a84eba132e87200e3c8b15b4c80696f9c14d1004d72fbc4 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x354 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.59485 |
| Detected Filetype | PNG graphic file |
| MD5 | 28981e7375c29afac679019925c74e44 🔍 |
| SHA1 | 911090164cde5f094c60621cda639c2d0e99364f 🔍 |
| SHA256 | 7f182b2de61e1c1aee9ad6cb7f11759a20d51531d281b7b95c412085b66b9b6c 🔍 |
| SHA3 | 003fc5d3b798ae21f313082ca1a9ffb1425bb4ce6d04288943155f153357f05c 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4de |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.71597 |
| Detected Filetype | PNG graphic file |
| MD5 | 650b67b0c820222c8521f989f335c7b5 🔍 |
| SHA1 | 4eb7846cc085744f4bb8aac93e69a93b8c6710db 🔍 |
| SHA256 | 11a70476f237d7067e33c2adb2356f07e9dd8c4ca9c9b74b2dd46a17e12dbb9e 🔍 |
| SHA3 | aa2fd0fb653f66878dc42141e9cd02ff206ff3c593bb325529fd27fa00af490c 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x8c2 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.83025 |
| Detected Filetype | PNG graphic file |
| MD5 | 1fefa531027737a235dfb2380ba595c7 🔍 |
| SHA1 | a8a38136c6dcfc60ae6f80cebf3c44253d0ebf0d 🔍 |
| SHA256 | 32bdfb7526ed13b9a57cd51c741eee3afb3e1e4f5d99fc997a08948f4484583b 🔍 |
| SHA3 | af7ef8168c99fb40fae7e8a8881e3d84abdaa28b590b9ee1e7f6196494ed9f84 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xd8a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.89639 |
| Detected Filetype | PNG graphic file |
| MD5 | 224d99a1a75afd8495cc4c64761ae52d 🔍 |
| SHA1 | 6b4e3e27a2dfed96328797daded31dc9f08ff384 🔍 |
| SHA256 | 463b30e4c6fff3f5cb7e2ca3e50fbee8b88bd8e50e9be4ea8db8f5022e7bf2bf 🔍 |
| SHA3 | 041ca44186128bd2ad0ad25166b11a8e3a71927575477ffd25bc9a4adfd9452a 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2960 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.96573 |
| Detected Filetype | PNG graphic file |
| MD5 | f41396166cc3887c6d65aaaadcdbee7e 🔍 |
| SHA1 | 35ae644d5dd9deb13e89c1189137f56a0d696da9 🔍 |
| SHA256 | 2fe6519dc4788ba0bdf899ae09f35f44b61f13beb726460523099db8ce2d00f3 🔍 |
| SHA3 | 6b9d511b172248f9bc2a2ff9b570c100feb9e2c5531382cf34a55989b971496e 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x89f1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.98333 |
| Detected Filetype | PNG graphic file |
| MD5 | a5bdd087ec2652239b6f4652d435cbb3 🔍 |
| SHA1 | d4b81d3fbab116afc6c5113659c7274116ded175 🔍 |
| SHA256 | 3afaa7c52c41b492a4789d7e8b2eb2ac996fb360db6a7801a40d5295cd91a667 🔍 |
| SHA3 | 4350c2b5e0610b019f4f0ffad9f195be68116520b03661aa3587a0691f380320 🔍 |
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x993154 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99991 |
| Detected Filetype | CAB Installer file |
| MD5 | 4bade8950b6da23e4ca071c264f68254 🔍 |
| SHA1 | d102ba39afa8573fad12c7fc816486bb4fd71aeb 🔍 |
| SHA256 | 13837b89c714f22907b4934dce256c569cd5a92ed392da358f80977962ab65e6 🔍 |
| SHA3 | ce7ac68561a3a396ce6a7568eee7292207997985ce2215fd2ea3559035bcb2db 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x68 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.85168 |
| Detected Filetype | Icon file |
| MD5 | d9a266e6675bd99f642dab08e77169f1 🔍 |
| SHA1 | c25af2445b30e90c11103393018aeedb04c60afe 🔍 |
| SHA256 | 826e26f3784b385845452d976343221b39858abda9359366f332cb90961b12a2 🔍 |
| SHA3 | c7cad0bc352c570467f9be06f17e6e75408a39de4d3ccaa8a214ff26cb1bcff7 🔍 |
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x28c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.24351 |
| MD5 | c2b7c8796787326be861a2f4c3310f1c 🔍 |
| SHA1 | 0df877d58c6460402429e8c9902208a8b479ede1 🔍 |
| SHA256 | 956af8ad069808bf2e3a4633000e113a7061ac39d8da0cfcad3050e6db8bb8f7 🔍 |
| SHA3 | 23f268b4181dc01119aab09c7e61b6100f977557af787d16ba80bdee4a016b24 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.1.0.0 |
| ProductVersion | 1.1.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Madium |
| FileDescription | Madium Installer |
| FileVersion (#2) | 1.1.0 |
| InternalName | Madium Installer |
| OriginalFilename | Installer-1.1.0.exe |
| ProductName | Madium Installer |
| ProductVersion (#2) | 1.1.0 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Aug-13 08:36:49 |
| Version | 0.0 |
| SizeofData | 840 |
| AddressOfRawData | 0x21f18 |
| PointerToRawData | 0x20918 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140025040 |
| XOR Key | 0x9efe119d |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 142 |
| C objects (33145) | 12 |
| ASM objects (33145) | 8 |
| ASM objects (35207) | 9 |
| C objects (35207) | 16 |
| C++ objects (35207) | 47 |
| C objects (CVTCIL) (33145) | 1 |
| Imports (33145) | 11 |
| Total imports | 130 |
| C++ objects (35228) | 1 |
| Resource objects (35228) | 1 |
| 151 | 1 |
| Linker (35228) | 1 |
No comments yet.