8fa30c5b42249656ef1e4efdda84196f1fcc33f4cf3ff299a7b562a8b3a96d36

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2105-Jan-26 09:24:45
Debug artifacts T6TC NEW.pdb
Comments
CompanyName
FileDescription T6TC NEW
FileVersion 1.0.0.0
InternalName T6TC NEW.exe
LegalCopyright Copyright © 2022
LegalTrademarks
OriginalFilename T6TC NEW.exe
ProductName T6TC NEW
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Suspicious Unusual section name found: F\x1d3xG\x029M
Section F\x1d3xG\x029M is both writable and executable.
Unusual section name found:
Malicious VirusTotal score: 9/71 (Scanned on 2026-10-04 00:26:45) CrowdStrike: win/malicious_confidence_70% (D)
DeepInstinct: MALICIOUS
Elastic: malicious (high confidence)
Fortinet: PossibleThreat
Gridinsoft: Trojan.Heur!.03013281
McAfeeD: ti!8FA30C5B4224
Paloalto: generic.ml
SentinelOne: Static AI - Suspicious PE
VBA32: CIL.HeapOverride.Heur

Hashes

MD5 596a17c3bd973f31455be78ab7fda4a8 🔍
SHA1 e10c7f922471957b42ecf72209c6b5f552ef701a 🔍
SHA256 8fa30c5b42249656ef1e4efdda84196f1fcc33f4cf3ff299a7b562a8b3a96d36 🔍
SHA3 00a7f878d4546486fa2733150973d263afbeab0c181e85ecdc7157bee883c6f0 🔍
SSDeep 393216:ssb+1KB4AlHUY0FAIfWGslJn1Xqalgn3lecvV6lSIrQnqGCvQzf:piKB4AlHUYRIfW/ZZSXMJrQn5CvS 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2105-Jan-26 09:24:45
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x14c00
SizeOfInitializedData 0x1475e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0149000A (Section: )
BaseOfCode 0x1460000
BaseOfData 0x2000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1494000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

F\x1d3xG\x029M

MD5 150dc9e5275860fa0ad3d80a441d3dbd 🔍
SHA1 f3b403163b84336894e3649ec672ed68f3ad0057 🔍
SHA256 e07edf17ca9ed36c148e051aeb5058ffbade9c5b7b25ce9c9b48385dc18b6774 🔍
SHA3 ed292fb2cd675d7ecd289ebabe64cfdcd8658c9cdaf9b16564f828d87665eec8 🔍
VirtualSize 0x145c248
VirtualAddress 0x2000
SizeOfRawData 0x145c400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99999

.text

MD5 6a118e30f6faf4e619019ff11694d6cb 🔍
SHA1 a0ef22c972afd1705270f775a275ea02573f46cf 🔍
SHA256 c28792221d6368976c61009ce4a36e6c6db66664b365f4b13534bd215fe65d9f 🔍
SHA3 537ef8c1bb403ea50a130b9d0453ecfcaf0b2a14bae7707faaee2d7bcf747f6a 🔍
VirtualSize 0x14838
VirtualAddress 0x1460000
SizeOfRawData 0x14a00
PointerToRawData 0x145c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.50822

.rsrc

MD5 97248b129914572a55515b328e77fdd6 🔍
SHA1 250c346c30d89f723564c990e5834be80add6b22 🔍
SHA256 66a968b9fe28c5f0ecc31f359794fadeaf5ea824d162657bf8fb372532796928 🔍
SHA3 36814d818c83be522e6e58457c83b6d8ad49d874edb581c588b2f84792c11745 🔍
VirtualSize 0x1979e
VirtualAddress 0x1476000
SizeOfRawData 0x19800
PointerToRawData 0x1471200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.25842

Section_4

MD5 6936ecfe9d20ac4cfea25c958379e9cf 🔍
SHA1 f02d10a67eb820dab8bd0e8fa3421b2185e9b58a 🔍
SHA256 1a3fe1ea1f4805547e764fafb2cef5e4d0dd3403ec6fc5cff2fd24c627503dfe 🔍
SHA3 43c1b4a27b371b3e00c2dc16f1361a2575d4bafdad2903a6bb61da420f1ba67a 🔍
VirtualSize 0x10
VirtualAddress 0x1490000
SizeOfRawData 0x200
PointerToRawData 0x148aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 0.13873

.reloc

MD5 0958d1cd3d5719e57db4590c91d09bbc 🔍
SHA1 b343f97b2b5645e6c215f436172d02489c8c2e0c 🔍
SHA256 c182d74a1914f1538635163d6f59b9fb5cd0205a887b1a3e3f59d3803cdb3124 🔍
SHA3 13cb49bb38c17d46ba55ed72e8173489759e8b705973dc473fa357f7730e491c 🔍
VirtualSize 0xc
VirtualAddress 0x1492000
SizeOfRawData 0x200
PointerToRawData 0x148ac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0980042

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xb14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.6318
Detected Filetype PNG graphic file
MD5 c20b155c9413a143dc01ede10e05cbff 🔍
SHA1 0fd160ee4951576908ecdd52cd1a5941de96ab7c 🔍
SHA256 6fbf911aef1c8ee0ed6683cdc62530afa25bf7c4e5a9b74af02dbd5f47d2842b 🔍
SHA3 fd469c8f5dcf673dee6264b19af823abb4f39df0fc77530dc54c2ad282b09f3d 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.7693
MD5 8284385620f90c26a77719d47fd52242 🔍
SHA1 294117b39e2550fa778dfb792a1739e31bbe22ea 🔍
SHA256 d701a08093396dafa8482d662ea39b02729969712e7370ff380f8efc0743f788 🔍
SHA3 ebd4130868150f46f0a5e7b1d57afa45b3e2f9da2b2b84d32965d526312a34c9 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.98258
MD5 cd154ce472ae07cb16a05273784a4a25 🔍
SHA1 229fff4d055edb00e2ca3274bf78a98587d58589 🔍
SHA256 a5b6040b17046507dc77ac51834a44158c64cce439570fcf22f63e70bcf2e6bf 🔍
SHA3 9ce0094fd33d1f7963aa16ef5491cd99f7f303f3c3416b8508d077640d333a0c 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.99275
MD5 a2e25d1973f56036d63189c5a3cff657 🔍
SHA1 e1b671997a974562dd83e029a93c120f9ca309cb 🔍
SHA256 6727962de5814de34dfb20cd6bdbb6f637592af029d4d0cd95470f350f4d5681 🔍
SHA3 1892a0f162d51d344e5384078faba07faac0bbee1073f27de0df9e941d1b14f2 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.18376
MD5 d13afa1b99d36e4e888c1ae0e52d745c 🔍
SHA1 ef318aa63b1c0225d232923d9ebfdc5390e93991 🔍
SHA256 4f194c3a8a63f6b08897f07c45f53fc1492da25152c3081c5dd13fb918575e4f 🔍
SHA3 26630a19cee8740ca23b872b064ac25b94aca3ae601274ca1cb9932b1a954945 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.35531
MD5 7772549679f8b5e1432bc91aa92eaa7f 🔍
SHA1 d91c31e0dad14a1b1d99599d548544486fdf1517 🔍
SHA256 b953cd6b8e0e96987426a0215b4c4f414e2dc74e64a81427a07537a0a78b946c 🔍
SHA3 30cbcf15bd1d5acece143135893ca2c3b350020f577848f697bb79845335f490 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 352d7f8455d869c56423b19badf70986 🔍
SHA1 1b3e12be12c1b4f5b13586fb435b388840f0f110 🔍
SHA256 c9332e0a42a4e62826b42a11d3045aefc479136afd7eb68c5473961a6890615a 🔍
SHA3 08884bff08c51ce5fe43dc29f272c99184df4086c5b7082999ebdd54f6d06136 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x31c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29841
MD5 803f6dc7a7a650dc7499f274c336cd98 🔍
SHA1 8fb3a1e22df6ddbfe6e7fa353bb144dcd95719df 🔍
SHA256 bf784818ebfd78587035d6aaad848fe39d20137206dc374355f38ac7a3536dd9 🔍
SHA3 a13d6b589d6d1b241f1c599a7c78b5be65255c48f6ac951a0cac3da92894bb37 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription T6TC NEW
FileVersion (#2) 1.0.0.0
InternalName T6TC NEW.exe
LegalCopyright Copyright © 2022
LegalTrademarks
OriginalFilename T6TC NEW.exe
ProductName T6TC NEW
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2040-Jan-30 06:12:32
Version 0.0
SizeofData 37
AddressOfRawData 0x14622a8
PointerToRawData 0x145eaa8
Referenced File T6TC NEW.pdb

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.