7fcc66372d540a8c8dbbb097209c9464094f4bb4c11c82cf533204563691c303

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Comments McAfee Security Shield
CompanyName McAfee
FileDescription McAfee Security Shield
FileVersion 1.0.0.0
InternalName OFFICE_XP_SP6
LegalCopyright Copyright © McAfee 2012
LegalTrademarks
OriginalFilename OFFICE_XP_SP6.exe
ProductName McAfee
ProductVersion 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • netstat.exe
  • procexp.exe
  • procmon.exe
  • taskmgr.exe
 Contains references to security software:
  • nod32.exe
 May have dropper capabilities:
  • CurrentVersion\Run
 Accesses the WMI:
  • root\CIMV2
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • Backdoor
  • cmd.exe
Malicious The program tries to mislead users about its origins. The PE pretends to be from McAfee but is not signed!
Malicious VirusTotal score: 44/71 (Scanned on 2026-11-04 08:32:10) ALYac: Gen:Variant.Lazy.731611
APEX: Malicious
AVG: Win32:MalwareX-gen [Misc]
Alibaba: Trojan:MSIL/MalwareX.68400ea8
Antiy-AVL: Trojan[Backdoor]/MSIL.Small
Arcabit: Trojan.Lazy.DB29DB
Avast: Win32:MalwareX-gen [Misc]
Avira: TR/W32.Agent
BitDefender: Gen:Variant.Lazy.731611
Bkav: W32.Malware.3388D3E2
CTX: exe.unknown.generic
CrowdStrike: win/malicious_confidence_90% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: MSIL/Small.FN trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Lazy.731611 (B)
F-Secure: Trojan.TR/W32.Agent
Fortinet: MSIL/Small.FN!tr
GData: Gen:Variant.Lazy.731611
Google: Detected
Ikarus: Trojan.MSIL.Small
K7AntiVirus: Backdoor ( 006e37381 )
K7GW: Backdoor ( 006e37381 )
Kingsoft: malware.kb.c.756
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Generic.Malware/Suspicious
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!7FCC66372D54
MicroWorld-eScan: Gen:Variant.Lazy.731611
Microsoft: Backdoor:MSIL/Small!MTB
Paloalto: generic.ml
Rising: Backdoor.Small!8.21B (CLOUD)
Sangfor: Backdoor.Msil.Small.Vgvs
SentinelOne: Static AI - Suspicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.14b2a72c
Trapmine: malicious.moderate.ml.score
TrellixENS: Artemis!BDE4D394022E
VBA32: TScope.Trojan.MSIL
VIPRE: Gen:Variant.Lazy.731611
Varist: W32/ABTrojan.ZHOL-5132
alibabacloud: Backdoor:MSIL/Small.FT

Hashes

MD5 bde4d394022edc33fa7c6830357a44ed 🔍
SHA1 57c596e0a9254398988c86df98e111c750a88ee8 🔍
SHA256 7fcc66372d540a8c8dbbb097209c9464094f4bb4c11c82cf533204563691c303 🔍
SHA3 2ec96d12833fb9141f92342b185f9bf58cd82f7d0fd22f7052db7cec8b7a1fb1 🔍
SSDeep 1536:seMn/DulKb31utYE7jR+1UzOgVQgB6umOm:seMnqlKbY+lgWgB6umOm 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0xcc00
SizeOfInitializedData 0x9800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000EA2E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x10000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x1e000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a2df9b6fc090695dbeb81270ee63afd7 🔍
SHA1 e2260d247a459e3e671a94146ce1828eb7c85105 🔍
SHA256 fc982a64ecbf31eace93e5ef5adc767361980b7a9a94b95ae7f4eb94c6107141 🔍
SHA3 ffbe73241e765ea2af1ee08214a65d3faef08bf6ef631d5f86230dc85a3b7dfd 🔍
VirtualSize 0xca34
VirtualAddress 0x2000
SizeOfRawData 0xcc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.47729

.sdata

MD5 8b618524a9e8e5b05eacde9457e45fd4 🔍
SHA1 e18d19b08b02527963779e882add8376356d9fb7 🔍
SHA256 7f97deb8ae8610a665b4bf72bd2e8d6c6e31dcccc8ddfcc5e168ac960c026805 🔍
SHA3 5b5fe31618e68483cec43ee1379a0971a5624d1185835ed4f7c1f8ddea7fb4e2 🔍
VirtualSize 0x9200
VirtualAddress 0x10000
SizeOfRawData 0x9200
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.21008

.rsrc

MD5 328c991d1cf1822e5b8d24943e9e72d1 🔍
SHA1 ced50ce6a0d2ce34a41b810a0e44fdd7c2bde73a 🔍
SHA256 8ff9ca6d66d84169b0273edc1831b9d34b6f8e5a8134ddc562db58d21b002b39 🔍
SHA3 1995acb9b1746ab15959cb5a09595d1c93b94fc73c7755d42304d48aa6d0e661 🔍
VirtualSize 0x3a0
VirtualAddress 0x1a000
SizeOfRawData 0x400
PointerToRawData 0x16200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.00492

.reloc

MD5 62e0c67f2815293cf843b2553afe9cad 🔍
SHA1 378c49e58dd5d268338b7d68096193713235ef6c 🔍
SHA256 c1d2ff2f4810010df9f4e0b8043c82651356c5254707332c4ac0c7c5378b793b 🔍
SHA3 d5ad6837493c1f02ef5cd5d01c6b4c465e49aefbdc871dd3019de2f431720e2d 🔍
VirtualSize 0xc
VirtualAddress 0x1c000
SizeOfRawData 0x200
PointerToRawData 0x16600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x348
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37105
MD5 faf1c762d7cff3b6fc7c29651087b939 🔍
SHA1 63586227488f266edd96ffecdcb773e1aeff66c3 🔍
SHA256 25cba50617b748f880bd1384f0ec2eba72878f19dd560677e5efa95147b9a759 🔍
SHA3 5118b692ec5184ded71291944df6baa29ed0834d2fc7466bbd4fe3e147951f5b 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_DLL
Language UNKNOWN
Comments McAfee Security Shield
CompanyName McAfee
FileDescription McAfee Security Shield
FileVersion (#2) 1.0.0.0
InternalName OFFICE_XP_SP6
LegalCopyright Copyright © McAfee 2012
LegalTrademarks
OriginalFilename OFFICE_XP_SP6.exe
ProductName McAfee
ProductVersion (#2) 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.