8798b539a64c49ceb91a2013cafe72f0fbb678e6429f8ce7e0a523dfefda9aba

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2025-Dec-29 09:27:36
Detected languages English - United States
Debug artifacts E:\proj\AetherInjector\build\Release\AetherInjector.pdb

Plugin Output

Suspicious The PE is possibly packed. The PE only has 1 import(s).
Malicious VirusTotal score: 34/68 (Scanned on 2026-02-23 05:10:09) ALYac: Gen:Variant.Mikey.183853
APEX: Malicious
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Trojan.Mikey.D2CE2D
BitDefender: Gen:Variant.Mikey.183853
Bkav: W64.AIDetectMalware
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_90% (W)
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
Emsisoft: Gen:Variant.Mikey.183853 (B)
Fortinet: W32/PossibleThreat
GData: Gen:Variant.Mikey.183853
Google: Detected
Kaspersky: HEUR:Trojan.Win32.Generic
Kingsoft: Win32.Trojan.Generic.a
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.AI.161148948
MaxSecure: Trojan.Malware.7164915.susgen
McAfeeD: ti!8798B539A64C
MicroWorld-eScan: Gen:Variant.Mikey.183853
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Rising: Trojan.Generic!8.C3 (CLOUD)
Sangfor: Trojan.Win32.Agent.V3wg
Sophos: Mal/Generic-S
Tencent: Malware.Win32.Gencirc.14a6a39a
TrellixENS: Artemis!BA96449AE5C7
TrendMicro-HouseCall: TROJ_GEN.R002H09A126
VIPRE: Gen:Variant.Mikey.183853
Varist: W64/ABTrojan.DUHO-8833
ViRobot: Trojan.Win.Z.Agent.42496.DWO
Zillya: Trojan.Generic.Win32.1957983
alibabacloud: Trojan:Win/Wacatac.B9nj

Hashes

MD5 ba96449ae5c75776773861cab3e034fa
SHA1 0d34bf27ec56dd48e8d38d6741c0098f6563d87b
SHA256 8798b539a64c49ceb91a2013cafe72f0fbb678e6429f8ce7e0a523dfefda9aba
SHA3 24455e21f622d3f5e333de31ede6a7c996c34f5de170d82326b040110c2be773
SSDeep 768:zSgd9jPjyzqOuqus0CVgdBee22pf/RMGQwM1MQNo9i4:2g/jPjyzqjq3dVgXee22p3+GQwM1MQN
Imports Hash 9e5fd72b2604a9a1c15ba81c18c21ae2

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xc8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2025-Dec-29 09:27:36
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x8800
SizeOfInitializedData 0x2a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000018D0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x10000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 33f2798ae41bf3b6c72a848592f29869
SHA1 02bb850859b48063eb7cdadae69a18eecdb68325
SHA256 0e6fbe1af460045b0b4c3a72fc3a97fce0871e2fe8b0ecfce4983cfda1aba2eb
SHA3 a3ff611d594d15c60009880c05da914911d349c5df71b4e29f0d4faa651d93a2
VirtualSize 0x866c
VirtualAddress 0x1000
SizeOfRawData 0x8800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.40256

.rdata

MD5 fb4dbab9ab2741cfc90e76fb1caec1a1
SHA1 4621111c58036bd130e41a3993d7e3a2bb2b725f
SHA256 1c185dfcee66511553cad705d08457f8fa80407e572f6e01de6b6cb6fb99ef1b
SHA3 8b780315e78c9a20ca1397a23d5efb0aae8f3382443978bd1929cca0759611f1
VirtualSize 0x102a
VirtualAddress 0xa000
SizeOfRawData 0x1200
PointerToRawData 0x8c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.66232

.data

MD5 78529e855f219597ad745aff4ce9a9c3
SHA1 e13aaa2b4960e26dc918291723051721040e7541
SHA256 3a7f41de58a05773af8e1a9f135f252c9d9576a3a0212368a1a012286ec8b890
SHA3 61c921d37c71497a428dfe4e8de910e4435f9f945d8a201f0fe550195a5e9314
VirtualSize 0x1150
VirtualAddress 0xc000
SizeOfRawData 0x200
PointerToRawData 0x9e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.16299

.pdata

MD5 f73a296a23c44fe54441ab3453e01136
SHA1 5e773807acdb25c266a81e4301f663ad41dad2ab
SHA256 99eda8d895a702a4cc0934a1058c55f3397304ec8de034d4c2ade7d3eebc188e
SHA3 01b711d168ccf768334eca8bd8300af5e36b402fa4d6071972a5240ad783e5dd
VirtualSize 0x2b8
VirtualAddress 0xe000
SizeOfRawData 0x400
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.08285

.rsrc

MD5 d2057517f4274e044696a4ed6146e7c6
SHA1 4c3d92a6f28b22c2913983db16bfd4ac93ec2aa7
SHA256 3b47704262ffc79a2c1e090af6b498f3e745e6fa1cd8354c67997a57e5acd959
SHA3 50fd3ed3054c275e843ec913defa240c4cc8885f7681e029b83054c400a7cc47
VirtualSize 0x1e0
VirtualAddress 0xf000
SizeOfRawData 0x200
PointerToRawData 0xa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

Imports

KERNEL32.dll GetCurrentProcess

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Dec-29 09:27:36
Version 0.0
SizeofData 80
AddressOfRawData 0xa9ac
PointerToRawData 0x95ac
Referenced File E:\proj\AetherInjector\build\Release\AetherInjector.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2025-Dec-29 09:27:36
Version 0.0
SizeofData 20
AddressOfRawData 0xa9fc
PointerToRawData 0x95fc

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Dec-29 09:27:36
Version 0.0
SizeofData 308
AddressOfRawData 0xaa10
PointerToRawData 0x9610

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x9c8db2e5
Unmarked objects 0
Imports (33145) 3
Total imports 1
C++ objects (35221) 3
Resource objects (35221) 1
Linker (35221) 1

Errors

Leave a comment

No comments yet.