97b5376ba6b3ad7f1d120c9590162cd722e5d2f8745538d67184e89927fff585

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 1970-Jan-01 00:00:00
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: XWD graphics format
HQR data file
Info Interesting strings found in the binary: Contains domain names:
  • .eq.github.com
  • .eq.golang.org
  • .hash.net
  • GonereadopensyncfilepipelinkStat.com
  • eq.github.com
  • eq.golang.org
  • github.com
  • golang.org
  • https://discord.gg
  • https://go.dev
  • https://gql.twitch.tv
  • https://gql.twitch.tv/gql
  • textproto.nl
  • tiktok.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: /4
Unusual section name found: /19
Unusual section name found: /32
Unusual section name found: /46
Unusual section name found: /65
Unusual section name found: /78
Unusual section name found: /95
Unusual section name found: /112
Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Malicious VirusTotal score: 7/67 (Scanned on 2026-06-22 09:36:42) Bkav: W32.Malware.5963ACE6
DrWeb: Trojan.Siggen32.45360
ESET-NOD32: WinGo/Agent.AZH trojan
Rising: Trojan.Agent!8.B1E (CLOUD)
Sophos: Mal/Generic-S
TrellixENS: Artemis!EE68A7A8667E
alibabacloud: Trojan:Multi/Agent.AOG

Hashes

MD5 ee68a7a8667e2ac87e196a61f0aec8ca 🔍
SHA1 90ce2e16788709e26395e1f91ef4ff39637f6fb5 🔍
SHA256 97b5376ba6b3ad7f1d120c9590162cd722e5d2f8745538d67184e89927fff585 🔍
SHA3 b0ea5b72548551d868f9df1350abc0601c8f5c7153ec1fedd260d12fac765371 🔍
SSDeep 98304:Z6MzySPm3lv+oedKWEBDIHJQgIkoJAI1vE5bpAlYgau67M:Zza+oeWBDIHJClJA8vEt0Ygalw 🔍
Imports Hash ed8b780a3ce7ca4aba78a21f6bc3d4e0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 16
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x901400
NumberOfSymbols 9759
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x2f5000
SizeOfInitializedData 0x67000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000087FA0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x29dd000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6a6b5c5f1aa5ecafbe9e54bfcaee1af2 🔍
SHA1 1da8c1e3dda183a08452e6168ef1398323a95017 🔍
SHA256 488ef1707940c6c378831501b2e520f1794f0105768a2e380f45f325c19edb28 🔍
SHA3 0d6a9796a6cace901773ca230f38cabb7df9dfb1525c925b1ce7d6cc5ef5465b 🔍
VirtualSize 0x2f4e31
VirtualAddress 0x1000
SizeOfRawData 0x2f5000
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.22568

.rdata

MD5 50e2981eeef6ee163e71bbaa8844531e 🔍
SHA1 d4e5f3e651d51e99100a7fa24c0f20a6a0aae386 🔍
SHA256 d6c3153a37709fba3ab6489c3657e9224e994bf173d3bc518fb5d4dee744d140 🔍
SHA3 09cc302a7de369f07c7aff8bcd0bccc5e35753035794ec62f803a15d0afc6a10 🔍
VirtualSize 0x31e9b0
VirtualAddress 0x2f6000
SizeOfRawData 0x31ea00
PointerToRawData 0x2f5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.64503

.data

MD5 1859c9595d6dcc4497edd6334f635088 🔍
SHA1 3957ea7365dc97084ac308e4f515125fa4272512 🔍
SHA256 0fa21cb0e4655f02bee1eb69b048a92b11872d47b91e7aae44280c856741db74 🔍
SHA3 66369cf63e6b615020f1073dca46cf4ec654ce75e8a227cc7e9f16648dbdabef 🔍
VirtualSize 0x20bddc0
VirtualAddress 0x615000
SizeOfRawData 0x67000
PointerToRawData 0x614000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.63851

.pdata

MD5 5686caf133850f96b9d10cac0b6e777b 🔍
SHA1 be08514a52078cbc2b34cb6da3d9ec07e6e66232 🔍
SHA256 925909dba612216e096442ac3ae571d3d28fdf9216c0c95b96cfa14d3844bc0c 🔍
SHA3 90006230a35b3168952190d70d13b8397ba53f4db7159317979b1ca3e5c9d92f 🔍
VirtualSize 0x116c4
VirtualAddress 0x26d3000
SizeOfRawData 0x11800
PointerToRawData 0x67b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.67154

.xdata

MD5 24f8c15eac3f3f5b798fefd5cb1f5100 🔍
SHA1 ffbcfd61f2dfe580df761f962cf16df88dfea34a 🔍
SHA256 f10f53034eab249fc2ddf9cfed8a4d1d27ef67f82593da53f420a47da466a939 🔍
SHA3 fff48cec2684a32d6132cd6710eb43ff6426f23e47a62fbd37957c1d80af1052 🔍
VirtualSize 0xb4
VirtualAddress 0x26e5000
SizeOfRawData 0x200
PointerToRawData 0x68c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78711

/4

MD5 bcddef00414a946919302442928e542e 🔍
SHA1 b0fbeae40093e8241edcbdeae94ba06880dedf04 🔍
SHA256 fb7bf682d27ba8920146a9b134a183cd2109b202916488b9b3a4f7d623f0b484 🔍
SHA3 7d5b252590738bde977b6dfab9c3034c2ad82b952980a3585c1dc88e1f06f005 🔍
VirtualSize 0x154
VirtualAddress 0x26e6000
SizeOfRawData 0x200
PointerToRawData 0x68ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.67257

/19

MD5 e62eba1347701c038adf9cb8280b509b 🔍
SHA1 a02225b7a9aba38edc16ead1c0f9ffef73d8e41c 🔍
SHA256 7bfa81972cadc5015b5fc12fd9d3df263e3f03ed3415dedd7b30cfcb2f0512de 🔍
SHA3 f6c0d3cad07c92aa6067ae5458dc2af5e9f2d168728b9c258d3b11a129db55af 🔍
VirtualSize 0x88204
VirtualAddress 0x26e7000
SizeOfRawData 0x88400
PointerToRawData 0x68cc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99645

/32

MD5 1df1b4b166e44a8ee9e3012ca1c6c4bf 🔍
SHA1 7981f9705a06740c1ab4f572717417ae02884168 🔍
SHA256 a568e02e2663ac40349d54f722ac1ac25b5eabc837fbf66bf4c064b9c0c90748 🔍
SHA3 73e49306d9daa6d3942ed8f878c9bf4b07ffcafce6b3e54706cc7a32895a0779 🔍
VirtualSize 0x1bff6
VirtualAddress 0x2770000
SizeOfRawData 0x1c000
PointerToRawData 0x715000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.93963

/46

MD5 f05dcdb0a22c8769d5f5d6abdea87fc9 🔍
SHA1 04293c2fff8f32ec184d9cc44abe0477188ace0d 🔍
SHA256 8320c9afeb817a8214ac8ad064518618ee9f5857027c76fabf10de53f451421b 🔍
SHA3 959331f838ea9a310decef6b2e5be200666cb691f1cf3ec8de1e6051c859ddb1 🔍
VirtualSize 0x26
VirtualAddress 0x278c000
SizeOfRawData 0x200
PointerToRawData 0x731000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.683863

/65

MD5 b791c457ef5afb5fef582799e9a81780 🔍
SHA1 7dfcbb4cd3ccb8b022fa9caf18a7e7d97bb53a0f 🔍
SHA256 26030a01cfe1b5f48a1d1b0264029ff7e32aa088081ce287d49fdd4ee4179461 🔍
SHA3 ad211e4945c6e2e6c555495817e1d4b9104d6192d92908b8a874542b4056dbe0 🔍
VirtualSize 0x10372e
VirtualAddress 0x278d000
SizeOfRawData 0x103800
PointerToRawData 0x731200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99836

/78

MD5 9fb13be5cbc02fbe247bfa7f2c8911de 🔍
SHA1 2169b0b613f337fbeff31d9873efbfb0cef6dd9c 🔍
SHA256 cb55af37ac506b1f3f8c3bf546bd1f3977206b159530bbd31f40dc49bf46d402 🔍
SHA3 f87a495f0f9eb5d738087e0dcf34f51c288c06d883afe6c343fda6af5935bc1a 🔍
VirtualSize 0x83890
VirtualAddress 0x2891000
SizeOfRawData 0x83a00
PointerToRawData 0x834a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99746

/95

MD5 ae59d6227363d03d9416c59cdaf72aa8 🔍
SHA1 5126df5775a0efc3171dc47e33ca114a76e37c79 🔍
SHA256 82086ac9e06388eb16fc3481df98bddadecaddb4bdedc0cd38e2b58f2cc1212a 🔍
SHA3 4ac616681ed6eb0190c0b044ce4ebe58f0506be606dfa691c5c8e4ea3641ccc0 🔍
VirtualSize 0x35c3d
VirtualAddress 0x2915000
SizeOfRawData 0x35e00
PointerToRawData 0x8b8400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.99636

/112

MD5 ca0478227f06638c1f7ebff8b5778495 🔍
SHA1 0f26dc9bbaa55db06fbb6b61c5220c77a913ab06 🔍
SHA256 83626e1c29725fac3a4fccc6732ef30466bf3030d85325806dbdf338d9d2eb8f 🔍
SHA3 17a9bfeb76c4621ad59ca665ca567c66c9242ef698aaa6070f8df76aec8ec181 🔍
VirtualSize 0x3796
VirtualAddress 0x294b000
SizeOfRawData 0x3800
PointerToRawData 0x8ee200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.7766

.idata

MD5 07fbda048160e527bfd4696347886c1a 🔍
SHA1 133b3cc6800b556a5cc5b571e99b4897a27c44f2 🔍
SHA256 095eb02191c58db5cc546331b82c4019fc82e8aff27f8a21efd1007394bdc170 🔍
SHA3 a877a66267c6a7d82122e979dd9cc66439d6a77d100ff0992ed3bad8ad6bbb9d 🔍
VirtualSize 0x57c
VirtualAddress 0x294f000
SizeOfRawData 0x600
PointerToRawData 0x8f1a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.29895

.reloc

MD5 be69898b598023263db14ee813e2212c 🔍
SHA1 745cc0c87bccfe4fc05cb43fc16bd4c0cda0f130 🔍
SHA256 7586aae7a5d7a9a300dd0e1ed204cd646c016f8ddd847aabf5daa068bf592efb 🔍
SHA3 10e7505dec7d56f014bf2571627a68bd73a9242ed7e265351af42ce1945d3746 🔍
VirtualSize 0xf3ec
VirtualAddress 0x2950000
SizeOfRawData 0xf400
PointerToRawData 0x8f2000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43543

.symtab

MD5 8f6ca2760b23d9364c3806b470aed030 🔍
SHA1 1d6ca4ffa1430446af64182ac8c47fe7a3a4f4a0 🔍
SHA256 c90d906375cd4b55cec5bf412cda758fe08e6480b25450f96f61e6b9cb2a7c44 🔍
SHA3 59b7835bdfb5511f2806606e76e64f782ec1a13ffda83c4b11eba5f6a5ef8fb0 🔍
VirtualSize 0x7c382
VirtualAddress 0x2960000
SizeOfRawData 0x7c400
PointerToRawData 0x901400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.37748

Imports

kernel32.dll GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4! [*] Warning: Tried to read outside the COFF string table to get the name of section /19! [*] Warning: Tried to read outside the COFF string table to get the name of section /32! [*] Warning: Tried to read outside the COFF string table to get the name of section /46! [*] Warning: Tried to read outside the COFF string table to get the name of section /65! [*] Warning: Tried to read outside the COFF string table to get the name of section /78! [*] Warning: Tried to read outside the COFF string table to get the name of section /95! [*] Warning: Tried to read outside the COFF string table to get the name of section /112!
Leave a comment

No comments yet.