9611b27bc562b47acb9e94bcb069fdaeeb69797df32d55ee5c9883bec4cc7c2a

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2023-Nov-08 19:48:17
Detected languages English - United States

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Manipulates other processes:
  • Process32First
  • OpenProcess
  • Process32Next
  • ReadProcessMemory
Malicious VirusTotal score: 7/71 (Scanned on 2026-01-17 18:23:11) Bkav: W64.AIDetectMalware
CrowdStrike: win/malicious_confidence_60% (W)
Cynet: Malicious (score: 100)
Kaspersky: VHO:Trojan.Win32.Sdum.gen
MaxSecure: Trojan.Malware.325188728.susgen
McAfeeD: ti!9611B27BC562
Rising: Trojan.Sdum!8.1155F (CLOUD)

Hashes

MD5 623e103fe721be400634ed61d153ff16 🔍
SHA1 f5df8971345e02e83128ad224d89268d61e98955 🔍
SHA256 9611b27bc562b47acb9e94bcb069fdaeeb69797df32d55ee5c9883bec4cc7c2a 🔍
SHA3 950e70482359b8ad8a6a91ed1cb1bc4a9623fda16b7a8f5a9dd90f3fb0733743 🔍
SSDeep 384:XJ6Y1L/yYrSJAoY6/0OP/AbC4rNRdTOADF53kFZ9MT:XlL/fWJiIRXAbDMAIr9M 🔍
Imports Hash b76824cbd179bd29f9d00103f9c6d6ca 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2023-Nov-08 19:48:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x4800
SizeOfInitializedData 0x3200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000004DC8 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f2a5e8399d8ce8ddc0f75e6453f744e9 🔍
SHA1 fb53f7ed3627ba1dcf379b5eae3b43bf11bb6843 🔍
SHA256 b733d050c06424b9aa8592ba60a1eea83982e3ebd0b344f0304b1777701f2e58 🔍
SHA3 4983204b419bcb98d1064baf179fc7b865f81bfb46a9e506788a6be00cd526a6 🔍
VirtualSize 0x4794
VirtualAddress 0x1000
SizeOfRawData 0x4800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.07121

.rdata

MD5 c5e7f55f2c02ca087ea2d568dba95a97 🔍
SHA1 cb85f506c5df36a8ddcbfa65a40aa78b9d245c47 🔍
SHA256 4b29c5e9897bf61a7459375ea3a0b9894b425f91328ee75129b43e0c4714fed2 🔍
SHA3 5eda33a82d2379bd94ab76ad4ed06bed22410075835bfb066f054824a972779e 🔍
VirtualSize 0x1f90
VirtualAddress 0x6000
SizeOfRawData 0x2000
PointerToRawData 0x4c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.57758

.data

MD5 bcd23de6c6e3f32d85bad3166e62ceb9 🔍
SHA1 005dc84679bbd7e9d81ec3f4c4d1bbb461ba7905 🔍
SHA256 1fb0da327aa54fa34b79984203f610feabbe7a4a2fa49d410cb9dae57ee724da 🔍
SHA3 62ab9e662f09d6750696d34b6e024c30f5fa53b9a358f16f758f59ac1226f9f0 🔍
VirtualSize 0x7c0
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.05172

.pdata

MD5 6c1bed9a27812b14b72d8a56a843df3b 🔍
SHA1 292744bff7d27dedd8724e7bb7a9419b6dab38bf 🔍
SHA256 5f1465bb8864e2811cdf1dc09610354dc4780b870f1da468bf62cd5fadf716b5 🔍
SHA3 04b6f64ad0c1e8e83b9a8cf87253ea432f45d944ef4fd45bf296cb133566beb0 🔍
VirtualSize 0x468
VirtualAddress 0x9000
SizeOfRawData 0x600
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.30038

.rsrc

MD5 7f77341ca10dad16840e75bf70bc8baf 🔍
SHA1 d443885ae0f47283bb53da0d3f37916734f48283 🔍
SHA256 abd3fd3cbbfe1233e6a75b6c7070774d606ba53080e351dada014d9f128e5878 🔍
SHA3 d881041e8c22a90693b3ae74e56f1076345ef4a30fd2e88465f1b49991cbbefa 🔍
VirtualSize 0xf8
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.51196

.reloc

MD5 27c0984c10b84697740ee52f6f43b0a9 🔍
SHA1 ba29642d904a63649641918f8468e804171f5641 🔍
SHA256 efc0e7349349ff20bbaf24591a4b6fe03266061ea63b834674ecfd9c2ddf7980 🔍
SHA3 5e36a9040e6e0d3d60aa0005aa9c9845a432dfb6cef336dcb0dee5dc4e03565a 🔍
VirtualSize 0x58
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.20313

Imports

KERNEL32.dll Process32First
Module32Next
Module32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
LoadLibraryW
GetProcAddress
ReadProcessMemory
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
USER32.dll GetAsyncKeyState
MSVCP140.dll _Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memcmp
__std_type_info_destroy_list
memset
memcpy
_CxxThrowException
__C_specific_handler
__std_exception_copy
__std_exception_destroy
memmove
api-ms-win-crt-heap-l1-1-0.dll free
malloc
_callnewh
api-ms-win-crt-runtime-l1-1-0.dll _initialize_onexit_table
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
exit
_invalid_parameter_noinfo_noreturn
_beginthreadex
api-ms-win-crt-string-l1-1-0.dll strcmp

Delayed Imports

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8858
MD5 f7ad1eab748bc07570a57ec87787cf90 🔍
SHA1 0b1608da9fef218386e825db575c65616826d9f4 🔍
SHA256 d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04 🔍
SHA3 6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2023-Nov-08 19:48:17
Version 0.0
SizeofData 720
AddressOfRawData 0x6dd0
PointerToRawData 0x59d0

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2023-Nov-08 19:48:17
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180008010

RICH Header

XOR Key 0x2afb196b
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 6
C++ objects (VS 2015-2022 runtime 32533) 18
C objects (VS 2015-2022 runtime 32533) 8
ASM objects (VS 2015-2022 runtime 32533) 3
Imports (VS 2015-2022 runtime 32533) 6
Imports (30795) 5
Total imports 75
C++ objects (LTCG) (VS2022 Update 7 (17.7.4) compiler 32825) 3
Resource objects (VS2022 Update 7 (17.7.4) compiler 32825) 1
Linker (VS2022 Update 7 (17.7.4) compiler 32825) 1

Errors

Leave a comment

No comments yet.