8c5d034173dd84417a3bf8e65bfec8fcaec4edc6627728e33e59aa0f7078ee01

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-30 11:45:13
Detected languages English - United States

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .fptable
Unusual section name found: .t{:
Unusual section name found: .=6u
Unusual section name found: .PSv
The PE only has 5 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • FindWindowW
 Can access the registry:
  • RegDeleteValueA
Malicious VirusTotal score: 17/71 (Scanned on 2026-05-08 23:09:41) APEX: Malicious
Bkav: W32.Malware.36CC4411
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.VMProtect.AC suspicious application
Elastic: malicious (high confidence)
Gridinsoft: Trojan.Heur!.022120A3
Malwarebytes: Malware.Heuristic.2108
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!D5D237860DC5
Microsoft: Trojan:Win32/Wacatac.B!ml
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score

Hashes

MD5 d5d237860dc5a8cb3af84edc2442386f
SHA1 ab41a22e70a3f19bd007febc8bff0cf6273617bd
SHA256 8c5d034173dd84417a3bf8e65bfec8fcaec4edc6627728e33e59aa0f7078ee01
SHA3 148c353fa26539d18f2340ec37e8d7a3cd1f9e3d15896f9db575dc4082980ed5
SSDeep 393216:VODpStoD/XgxpZ17yFxK40Zao2SbQUqCbf+ZRBENJWtecm8Td:VOk2D/wbZgKawkUmZRBENJr
Imports Hash 8a38c018ef59970acc379613d4e43682

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Apr-30 11:45:13
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x67200
SizeOfInitializedData 0x46e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000001AABF6D (Section: .PSv)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x23cb000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x67150
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x25f52
VirtualAddress 0x69000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1c214
VirtualAddress 0x8f000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x3a50
VirtualAddress 0xac000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x100
VirtualAddress 0xb0000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t{:

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xd59b41
VirtualAddress 0xb1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.=6u

MD5 429dda88ce343b08d953b86eea7f04c2
SHA1 6291de6c91bfd9416f09a9ea306bc4819d7354d7
SHA256 115ee43f6746b46a80be003822ac60ad8fe6d9f7a0c4ff1208f30b39d52ae7c5
SHA3 cfd8da8b03810ad4e4822d648ad7d1f8b5baf2290b0a5a0d9edb41e9afd05c52
VirtualSize 0x90
VirtualAddress 0xe0b000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.430259

.PSv

MD5 fe8f8c547544ccbf4831c9f9ec8ca1f1
SHA1 83f67aef99320590b1be96bc9dd097414271b210
SHA256 d1b25de582087fd78c50dc3c9c926b534ef91e26d9320e377a5f979dec631b88
SHA3 6fd2b130110f79c1c383376131b9f6a93ad0623ce3c7334cc3576665014e22ba
VirtualSize 0x15bcdd0
VirtualAddress 0xe0c000
SizeOfRawData 0x15bce00
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.70907

.rsrc

MD5 051326f1a3c9116ef603db7b8d4786ea
SHA1 1c26eb2a049911fd500a872ba856f206cbb92132
SHA256 a4e800473cacfc094b026a36c4298752ee70437e2f075e3a6b3bf63bcb4ffee1
SHA3 262b7e0da29aeba62a3541de4469cb7dd34ef6a0ea211ad8f833bb3bd4b2d617
VirtualSize 0x1e0
VirtualAddress 0x23c9000
SizeOfRawData 0x200
PointerToRawData 0x15bd400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.77846

.reloc

MD5 a68bf53dcc387fd02fa9ff1efe5a88da
SHA1 eb62e00b6ffb96ce01bc320c4324b87f54dd6a68
SHA256 e28212fd6134858d20bd5f873b07b27a918440d96f3f9924a211ac0f4740144d
SHA3 6af2af750f2d419a3badbb68532ec9c6123a7a4c4c67913ce4b91fc9a08e17e2
VirtualSize 0xbc
VirtualAddress 0x23ca000
SizeOfRawData 0x200
PointerToRawData 0x15bd600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.06346

Imports

KERNEL32.dll GetCurrentProcess
USER32.dll FindWindowW
ADVAPI32.dll RegDeleteValueA
IPHLPAPI.DLL GetAdaptersInfo
ntdll.dll RtlVirtualUnwind

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14008f140

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section .t{: has a size of 0!
Leave a comment

No comments yet.