| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1992-Jun-19 22:22:17 |
| Detected languages |
English - United States
|
| Suspicious | The PE is packed with mpress |
Unusual section name found: .MPRESS1
Section .MPRESS1 is both writable and executable. Unusual section name found: .MPRESS2 Section .MPRESS2 is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
Can access the registry:
|
| Suspicious | The PE header may have been manually modified. |
The resource timestamps differ from the PE header:
|
| Malicious | VirusTotal score: 49/71 (Scanned on 2026-09-08 23:42:04) |
ALYac:
Application.Generic.37074087
APEX: Malicious AVG: Win32:Malware-gen Antiy-AVL: HackTool/Win32.Crack Arcabit: Application.Generic.D235B4A7 Avast: Win32:Malware-gen Avira: TR/Crypt.XPACK.Gen BitDefender: Application.Generic.37074087 Bkav: W32.Malware.DF04B353 CAT-QuickHeal: Trojan.IGENERIC CTX: exe.trojan.crack CrowdStrike: win/malicious_confidence_60% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.Siggen33.63506 ESET-NOD32: Win32/HackTool.Crack.FO potentially unsafe application Elastic: malicious (high confidence) Emsisoft: Application.Generic.37074087 (B) F-Secure: Trojan.TR/Crypt.XPACK.Gen Fortinet: Riskware/Crack GData: Application.Generic.37074087 Google: Detected Gridinsoft: Trojan.Win32.Wacatac.sa Ikarus: Trojan-GameThief.Win32.OnLineGames K7AntiVirus: Trojan ( 0052964f1 ) K7GW: Trojan ( 0052964f1 ) Lionic: Trojan.Win32.Crack.4!c Malwarebytes: Malware.Heuristic.2126 MaxSecure: Trojan.Malware.701448236.susgen McAfeeD: ti!8EAA420D3C8E MicroWorld-eScan: Application.Generic.37074087 Microsoft: Trojan:Win32/Conteban.A!ml Paloalto: generic.ml Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Dropper.qc Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrellixENS: Artemis!0FB924698ECD TrendMicro: Trojan.Win32.WACATAC.USBLI126 TrendMicro-HouseCall: Trojan.Win32.WACATAC.USBLI126 VBA32: Trojan.Downloader VIPRE: Application.Generic.37074087 Varist: W32/ABTrojan.SDDP-1417 Yandex: Packed/MPress alibabacloud: HackTool:Win/Crack.FP tehtris: Generic.Malware |
| MD5 | 0fb924698ecdc7b9830f86d9ebb57c2e 🔍 |
|---|---|
| SHA1 | a86fa4adabbd0a9b4f649c1ea94e58efe56f40c9 🔍 |
| SHA256 | 8eaa420d3c8e7aa450d79f8635c2de5c8f8038a3d3ee3775a3cb7e411d2181fc 🔍 |
| SHA3 | e72275cd4748d0878a13404c7d4bdf0bf7f0c8bb32cbe6925d4980559eb70445 🔍 |
| SSDeep | 768:q9v5Demafo3pZVm/dL4LvK2xyTUrMLS2Ajc2uehfOrL2fZYluzKkWieqpqC47D7:uDBaaEL4LL+zyxusZYukie8qP 🔍 |
| Imports Hash | 1b8f8e987fa56b9b492515708928d761 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x40 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x2 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0xb400 |
| e_oeminfo | 0xcd09 |
| e_lfanew | 0x40 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xe000 |
| SizeOfInitializedData | 0x14400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000392F4 (Section: .MPRESS2) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xf000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3b000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | a267ec25cc9fd269406f8dafb025402b 🔍 |
|---|---|
| SHA1 | a35a13a447c16e10cf0e7fdefd3951a813528d2d 🔍 |
| SHA256 | 7c78a49a7e0a18503ffdcb552da05c861a07ecf99f951204093108deb1d8a6eb 🔍 |
| SHA3 | 0ad645073c5b63b48b0f0da3b91bd242b650f243211720be9a91f99578b65197 🔍 |
| VirtualSize | 0x38000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0xbc00 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.9967 |
| MD5 | b68fe4a02da323e08323862176d3445a 🔍 |
|---|---|
| SHA1 | b913f2fa7cbe8e7e23f355f1bbe7f98c1c920d51 🔍 |
| SHA256 | ea62a8bb0fd9f0f205c89be49b4d2d893067e0992e7f982e2d13bffb6b0e2672 🔍 |
| SHA3 | b41a9948c63039023bc843a086291f977ca65b07f9533a9017512ecb464f2a9a 🔍 |
| VirtualSize | 0xe80 |
| VirtualAddress | 0x39000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0xbe00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.47628 |
| MD5 | 78ffbd0f555e18de05cc533501c68594 🔍 |
|---|---|
| SHA1 | c155cdf7af1d3f65e28ef155b7e16e0d573a672b 🔍 |
| SHA256 | ad461f120a487f39cfe01a17f0a156ade77ba0f8d7abba1ec0786e48b4d0503a 🔍 |
| SHA3 | 1219319e4c8c6a1261d17f146b4b0093a09af032041b90efca56a11c56b53bf3 🔍 |
| VirtualSize | 0xe14 |
| VirtualAddress | 0x3a000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0xce00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.37944 |
| KERNEL32.DLL |
GetModuleHandleA
GetProcAddress |
|---|---|
| user32.dll |
CharNextA
|
| advapi32.dll |
RegCloseKey
|
| oleaut32.dll |
SysFreeString
|
| version.dll |
VerQueryValueW
|
| gdi32.dll |
SetBkColor
|
| shell32.dll |
ShellExecuteExA
|
| IMAGEHLP.DLL |
ImageRemoveCertificate
|
| winmm.dll |
waveOutOpen
|
| Type |
BINRES
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4f56 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x1754 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x23ab |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x340 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x282 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x424 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x346 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x39 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xae6 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
BINRES
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x899 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 1.96237 |
| MD5 | 40fdaec38f1a963cc6cc516d07d0fc75 🔍 |
| SHA1 | 3125f7180443836a3dc965bbf21d76217b88f9a0 🔍 |
| SHA256 | c7895ea64e2cae0a1abc529deb762a477a41461a38d20c85362b59c0208eadcf 🔍 |
| SHA3 | 34be37c0b64f1945d2f0380110504e6df36b0f7fdba1619f234b72726f006f76 🔍 |
| Type |
RT_DIALOG
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ce |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x10 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xc8 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 2.16096 |
| Detected Filetype | Icon file |
| MD5 | 42cf62b780813706e75fb9f2b2e8c258 🔍 |
| SHA1 | a022d5c1cfdd8aace0089f3e72f2eedd41bda464 🔍 |
| SHA256 | a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf 🔍 |
| SHA3 | 0aafc8e3d8b6bde595537da4ffe0efc5fe53f01dafe336a2a5828b6a71283d3c 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x691 |
| TimeDateStamp | 2026-Sep-02 00:30:08 |
| Entropy | 5.03338 |
| MD5 | 2ebe1c914cf3138e976c055b0c43c6ed 🔍 |
| SHA1 | 22da9fee8d777d847960dd950ec359914d73350b 🔍 |
| SHA256 | d7010fc52189c7b15cd40a415859e0c54ddb9e1c135e6ca6ec09412f263ed0b1 🔍 |
| SHA3 | d97ee33a79ee49d17e03871645d2215acb219dd52a6ff6e448d6199b8837f271 🔍 |
No comments yet.