8e7dff8e12405414f1ada932036651085970738ff34f4a03fa8eba8a4550a3e1

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-07 21:12:00
Detected languages English - United States
CompanyName 32
FileDescription 32
FileVersion 2.20.7764.10417
InternalName 32
LegalCopyright Copyright (C) 2026
OriginalFilename 32_setup_6_011.exe
ProductName 32
ProductVersion 2.20.7764.10417

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Accesses the WMI:
  • root\cimv2
 Miscellaneous malware strings:
  • cmd.exe
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • OpenProcessToken
 Manipulates other processes:
  • Process32FirstW
  • Process32NextW
Suspicious The file contains overlay data. 30207335 bytes of data starting at offset 0x37000.
The overlay data has an entropy of 7.99999 and is possibly compressed or encrypted.
Overlay data amounts for 99.2597% of the executable.
Malicious VirusTotal score: 10/70 (Scanned on 2026-09-10 11:12:38) APEX: Malicious
Bkav: W32.Malware.6012771D
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
ESET-NOD32: Win64/TrojanDropper.Agent.AES trojan
Elastic: malicious (moderate confidence)
Gridinsoft: Trojan.Heur!.02012423
Malwarebytes: Malware.AI.2660083793
Microsoft: Trojan:Win32/Sonbokli.A!cl
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 1730bf6297fb3ba61518435c64c60d80 🔍
SHA1 152ed600a793102d9a84a72da2a3562baa48d1fb 🔍
SHA256 8e7dff8e12405414f1ada932036651085970738ff34f4a03fa8eba8a4550a3e1 🔍
SHA3 a81e9fb7dc5776aff9471c54b6030c3bc1a85404372f24555846e131c9291196 🔍
SSDeep 786432:Xmd9VyBxYA1RkfCL+j5+6oeWKB3RvMSt9zjU:WxeYouj5+6oetZRRt5jU 🔍
Imports Hash ace66efe0d7d3e3b558fdeda87339823 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-07 21:12:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.20
SizeOfCode 0x1cc00
SizeOfInitializedData 0x1a000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000E794 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 2.14
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3c000
SizeOfHeaders 0x400
Checksum 0x427a8
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b30d480089b129b27757e711a3ecf0a1 🔍
SHA1 e176fc2b621786ebf532de423eccccb78be8ec5a 🔍
SHA256 6fc851d3d695202f426c682f6f1d5bbce612a19e2d7973fae837ce485ea89d53 🔍
SHA3 99855f10dfe91d81de13c483bb67497d3cb1f3d07af48ad66f296990ac0371ce 🔍
VirtualSize 0x1caf0
VirtualAddress 0x1000
SizeOfRawData 0x1cc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.39663

.rdata

MD5 87a54e5cc3027f31fa7497edc3db322d 🔍
SHA1 75b1fe12d5a4bfcabc7fdf2fea402c1531420862 🔍
SHA256 1d751870417471814da470091db04751c8fcdf20a1a2edf797e2477e3e8b5fcb 🔍
SHA3 1fde07fe55b1f12cf4d7ae440919dcc9c4a030df32ad38d38860ee269af44f5b 🔍
VirtualSize 0xd1ec
VirtualAddress 0x1e000
SizeOfRawData 0xd200
PointerToRawData 0x1d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.75643

.data

MD5 64ec6cc5d2591644168203db44ccec66 🔍
SHA1 209debedeb58d88106e152391f4fcf5aedfec3d1 🔍
SHA256 bd177a7dbf5248ac2970875dd685c3c145f47aa5a87a94b4999ff90cbc7babfe 🔍
SHA3 b37c4b58e67fd48e6d46b7cb58da5cc12e02bdd2b05ef70065f838ca60f444a8 🔍
VirtualSize 0x1d38
VirtualAddress 0x2c000
SizeOfRawData 0xc00
PointerToRawData 0x2a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.26564

.pdata

MD5 747f524a48eece17c148c4400fe62044 🔍
SHA1 8d2b10c8066ca5f8c8f7f1d05e45f8ababda5623 🔍
SHA256 2cb87b274bd467fab0ed77d2e3e7943e92633034b21b9e6fc060d8699970f025 🔍
SHA3 950ed0161d9b3645e2c3ae595684db9a45a99ec3fdad1fa01c000a0183f412e6 🔍
VirtualSize 0x18a8
VirtualAddress 0x2e000
SizeOfRawData 0x1a00
PointerToRawData 0x2ae00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.14292

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x30000
SizeOfRawData 0x200
PointerToRawData 0x2c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 0e1730780df121b4a4552ce6b3484944 🔍
SHA1 428c52e138489c5099d2fae9d0c8bf08a2a89fd0 🔍
SHA256 216b098e32a3d5e2ce734c5403ec5f8eb8c78609aeb87e2111501198976dbe88 🔍
SHA3 f12ccf6dfe5bb765c10760938b96332eed31ada4e70d610d721d65233ce9b883 🔍
VirtualSize 0x9cb4
VirtualAddress 0x31000
SizeOfRawData 0x9e00
PointerToRawData 0x2ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.87861

.reloc

MD5 47324876ee21ab9fb27a73395fd88e0d 🔍
SHA1 1feac62530302566ccb170fc1999edb541a0ead8 🔍
SHA256 db8d315347bd328aac789859c133fbf71da30428df0f70e7fde61bb12141c787 🔍
SHA3 12dabcda0842c2a395d956ae6ce3d4cc2772162d79c6523fd71e54dabc0e185e 🔍
VirtualSize 0x698
VirtualAddress 0x3b000
SizeOfRawData 0x800
PointerToRawData 0x36800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.95519

Imports

SHELL32.dll ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
bcrypt.dll BCryptGenerateSymmetricKey
BCryptDestroyKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptGenRandom
BCryptCloseAlgorithmProvider
KERNEL32.dll GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
GetCommandLineW
GetEnvironmentVariableW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetFileAttributesW
GetFileSizeEx
GetFullPathNameW
ReadFile
SetFilePointerEx
WriteFile
GetTempPathW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
Sleep
GetCurrentProcess
CreateProcessW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetModuleFileNameW
LocalFree
CopyFileW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VirtualProtect
WriteConsoleW
SetFileAttributesW
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
ADVAPI32.dll OpenProcessToken
GetTokenInformation

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x29e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.55005
Detected Filetype PNG graphic file
MD5 63df4f62f45abf2fd67e40b44f07f448 🔍
SHA1 a03525731329dccaced6e34a65456930ef69a6f3 🔍
SHA256 d1b784088e5c8bd0143cc8305e23bb43462c1671b06d5bfac7dd5b41859d9f27 🔍
SHA3 35c5a441da4a14586471c63b664b1de360985885e9ba01be6d82811f99e340f1 🔍

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x36b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.66742
Detected Filetype PNG graphic file
MD5 3f37449f5a4f39023c53fa00d3050845 🔍
SHA1 89e6b7c1066ded693b9e2237d0aecd2861ebed36 🔍
SHA256 21da340e9fe2750c5d9be93231fa88d69d8a4eba7cfe08dfe7457b06f6039697 🔍
SHA3 70ae21133612d66061ab23e865490f72d28c9177a9a8f880636811bfb1ee309f 🔍

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x422
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.75977
Detected Filetype PNG graphic file
MD5 c856713f6f6507fc8e119986f7fef750 🔍
SHA1 06426048bd796e2ef249e769736557a6cd93f2a5 🔍
SHA256 1534d50e8a36c0a3192e19476f8d007bae73f4af2e9c9b9cacc5bf060fd1cbc4 🔍
SHA3 cdc9cb27eefb3ae09a1f56fca18e16ba29f29e458cc6d1a97aef44d1bb3562fa 🔍

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x5a7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83378
Detected Filetype PNG graphic file
MD5 6fa22d9998b7740d822b82ecae0ada14 🔍
SHA1 1005ecdc16bfdd6b78e4c582eee4baa314b386b3 🔍
SHA256 d34a09f15d793ce235e35e1235f02066007583b8c76f3fc202e6049ce3a78f7c 🔍
SHA3 ca3ecd33ad7341678099cdce7312138ab668098e089b4223d7f583d56f0ed60e 🔍

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x706
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86788
Detected Filetype PNG graphic file
MD5 9ea2b061519aa5ee9336bcaad5b3993a 🔍
SHA1 8c10147b8edd3fda5f67ece2be5c11364eda2616 🔍
SHA256 92b98aadf0202f8cd88d0adf7d55beb7ec4f4d6eb825e430ff2b941221f139f1 🔍
SHA3 9cc3180a00c6ddf47ec6d68061284270caa03ae490a03550e93e0e5d055c2152 🔍

6

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x890
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86592
Detected Filetype PNG graphic file
MD5 c4fbf89ce9a2bfe83f5e8f51c49d63f5 🔍
SHA1 ccd39a41581a859f65dc8368c9ad26a8984fdb70 🔍
SHA256 e6c4bcd168aa9042425171e194cdf3d153784a4b1c1b55d85c9fdf2c7f543d9f 🔍
SHA3 c3cf72ebbb7ca74c1f5afba984f700f7806758bfc267d0cfbca7ce408bd9c5ce 🔍

7

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xb95
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.90611
Detected Filetype PNG graphic file
MD5 535c3d262f7d6107fe72d8e168314137 🔍
SHA1 7e1ca698d40b483e329b223024514230a5e2cc60 🔍
SHA256 0a2af8eadeb3113c470bb9c19ff592b9b7451416ca95c12ab67092a9d71d6e9b 🔍
SHA3 936c3a5c6d2fb9ce6905fc559ca7ae91776fee571fb91de10954161ac0531ba3 🔍

8

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x127a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9293
Detected Filetype PNG graphic file
MD5 1b1a7debafbdb781a0a846e01b0dc41b 🔍
SHA1 f4dde5b6a169e77f1ab11e27116b044817b10922 🔍
SHA256 1624147ef89a218d7220c7e00e1cc5e60c264d67e190d2cfe6f8a9b2318e3ede 🔍
SHA3 df257be7df437e30b722a8444caa82b5df56b1b5c1db615560fd34cd0b1ce7ba 🔍

9

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x1a6b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94487
Detected Filetype PNG graphic file
MD5 2c1dc53d84c20cd037ff24443baf163f 🔍
SHA1 7f221ac70fa0406adc3acfb2fcac393993a4b47f 🔍
SHA256 8fb31bbca4aca47da2d087638d90a12fd3ab713493c3f3ffa98b2f5e8b5509f2 🔍
SHA3 7ffc6bb9da18bc4d096dead65c68aa9a399d3534adbef09053caddf99b517b76 🔍

10

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x3a24
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93886
Detected Filetype PNG graphic file
MD5 483d30dbf6476c0141991f187d797e62 🔍
SHA1 beed1100ed8119437abb89e4bb6fa41a895cbf6b 🔍
SHA256 0ba290bf7393058c7c37f821ecb31478f13245253d4ec248e6867207071e048c 🔍
SHA3 360a1cfc04ccbfe71546e57eed47ef6f216b5267c0493365438d0b9636cfa785 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x92
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11529
Detected Filetype Icon file
MD5 1174e20624bfaa824e538834497beba7 🔍
SHA1 ac08603664975dfcbcd0943a3d7b51f45fc72f7d 🔍
SHA256 26dd12b8b1d73ccf32b37b99c120c517c43e8f16272afc16e07583571267425f 🔍
SHA3 d8e60e9ed0e5a0f8a2f313de2551ebc803b0d7eabde76ff7cee3111adb15c5ef 🔍

32512

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x92
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11529
Detected Filetype Icon file
MD5 1174e20624bfaa824e538834497beba7 🔍
SHA1 ac08603664975dfcbcd0943a3d7b51f45fc72f7d 🔍
SHA256 26dd12b8b1d73ccf32b37b99c120c517c43e8f16272afc16e07583571267425f 🔍
SHA3 d8e60e9ed0e5a0f8a2f313de2551ebc803b0d7eabde76ff7cee3111adb15c5ef 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x2a4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44846
MD5 fe3777f6ae6a61d7921bf53bfd257bd8 🔍
SHA1 c8fb36776a09f24a3d6b5e5e2712e8487074a98c 🔍
SHA256 d1e6680b607cfeef39423ea3bbe0177e4b62fd3a210dee73ebb46499112a6d27 🔍
SHA3 809023af4a76e82d3b4225dc9063f5411107adc44439c5ddf3de58c6c6760518 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x3c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28578
MD5 33bf9e77457f2aeb8cc62929be9c85cd 🔍
SHA1 13f2fcd1dd03ec023072f23f7429fd9211816e75 🔍
SHA256 fbb85c25645fc58ea3217090a903484afa2466d807aac6eb6286162cb31b24e5 🔍
SHA3 9366c5ed91ed2708664c79e49c829e49690c18a3e2385ee0f1e6d8a7cb253f8f 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.20.7764.10417
ProductVersion 2.20.7764.10417
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName 32
FileDescription 32
FileVersion (#2) 2.20.7764.10417
InternalName 32
LegalCopyright Copyright (C) 2026
OriginalFilename 32_setup_6_011.exe
ProductName 32
ProductVersion (#2) 2.20.7764.10417
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 2026-Sep-07 21:12:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14002c000

RICH Header

Errors

Leave a comment

No comments yet.