98e333e65e395db9421d1cef5b0687fced2e26945f4e8b091adb0628564e7d7d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-05 08:47:39
Detected languages English - United States
Debug artifacts C:\Users\Holy\source\repos\Wendigo\injector\ZEROInjector.pdb

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Accesses the WMI:
  • ROOT\CIMV2
 Contains domain names:
  • cdn.discordapp.com
  • discordapp.com
  • github.com
  • githubusercontent.com
  • https://github.com
  • raw.githubusercontent.com
  • wendigovrc.us
  • www.wendigovrc.us
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • VirtualAllocEx
  • CreateRemoteThread
  • WriteProcessMemory
  • OpenProcess
 Can access the registry:
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegCloseKey
 Possibly launches other programs:
  • ShellExecuteA
  • ShellExecuteW
 Uses Microsoft's cryptographic API:
  • CryptUnprotectData
  • CryptProtectData
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Memory manipulation functions often used by packers:
  • VirtualAllocEx
  • VirtualProtect
 Has Internet access capabilities:
  • WinHttpQueryDataAvailable
  • WinHttpConnect
  • WinHttpSendRequest
  • WinHttpCloseHandle
  • WinHttpOpenRequest
  • WinHttpReadData
  • WinHttpQueryHeaders
  • WinHttpOpen
  • WinHttpReceiveResponse
 Manipulates other processes:
  • Process32NextW
  • Process32FirstW
  • WriteProcessMemory
  • OpenProcess
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 32/70 (Scanned on 2026-09-19 17:36:52) ALYac: Trojan.GenericKD.81370124
APEX: Malicious
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Trojan.Generic.D4D99C0C
BitDefender: Trojan.GenericKD.81370124
Bkav: W32.Malware.73374268
CTX: exe.trojan.wacatac
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
ESET-NOD32: Win64/GameHack_AGen.BGH potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.81370124 (B)
GData: Trojan.GenericKD.81370124
Google: Detected
Gridinsoft: Trojan.Win64.Wacatac.bot
Ikarus: Trojan.W64.MalwareX
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Generic.Malware/Suspicious
MaxSecure: Trojan.Malware.8328611.susgen
McAfeeD: ti!98E333E65E39
MicroWorld-eScan: Trojan.GenericKD.81370124
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Rising: Trojan.Kryptik@AI.94 (RDML:03yXEnXyfcTwFirRmZJihA)
SentinelOne: Static AI - Suspicious PE
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!D00CBE1AEC49
TrendMicro: Trojan.Win64.WACATAC.TL0101IA26ZZ
TrendMicro-HouseCall: Trojan.Win64.WACATAC.TL0101IA26ZZ
VIPRE: Trojan.GenericKD.81370124
Varist: W64/ABApplication.ZELP-2889

Hashes

MD5 d00cbe1aec49218c95c42db74c18fb74 🔍
SHA1 b45c94b8b4b562d537942f02cd63205d7eadd31c 🔍
SHA256 98e333e65e395db9421d1cef5b0687fced2e26945f4e8b091adb0628564e7d7d 🔍
SHA3 394de073208b794331816a1f8a327be660d6ce31a0daecc21c88a2e41801f9be 🔍
SSDeep 12288:aPawoPIil1D2VYD+98UHQ7qzWhM9WLWmfCAbppDzYi6nt+c1URkO:9ZAil1D2+C9FQmz8MoLWmfCAQi6ntM 🔍
Imports Hash 8b5fb15b80f3c70f4df3eca160d1f091 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-05 08:47:39
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x95400
SizeOfInitializedData 0x36600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000071480 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xd1000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 72ff61b304f303e35373df27d1b35d8d 🔍
SHA1 3fc80ca066d0b6dfe8c29fcc668ad5cb5544e667 🔍
SHA256 cd0e366abdb6bbab4dad4c3d133ff41de33d70feec9fd814adad3bd74dbdecff 🔍
SHA3 76f98ae9c33a777ac2728566d88592ae90d95badad08826e4f3fa7ed469f3a08 🔍
VirtualSize 0x9529c
VirtualAddress 0x1000
SizeOfRawData 0x95400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.53463

.rdata

MD5 d84214578513783b15016f729bf3e311 🔍
SHA1 90cc9247464e27f7983a49134dd0b7682c169ddd 🔍
SHA256 93936d6a8bf46a38d1b5bfddfb649d2e5a3d60885da1cc729d507270fca1bc9c 🔍
SHA3 9234072ad76f222c700331aa8be9f2eb2e379111ca07ed8afb90e4e2ddc367a9 🔍
VirtualSize 0x27232
VirtualAddress 0x97000
SizeOfRawData 0x27400
PointerToRawData 0x95800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.03612

.data

MD5 d2ccd32c62e861c45f1818818d75620f 🔍
SHA1 d37dd0699ec983137e59d854cf69ae4f997bb251 🔍
SHA256 f4ca8ebfe256924e7cbdcf11b4ff615049282d15da938ba72c6883fba20aee3b 🔍
SHA3 af47a2affe708233ad265267e1f3c95168c9a1603523cdfa5bf05d9613dc0606 🔍
VirtualSize 0x2da4
VirtualAddress 0xbf000
SizeOfRawData 0x1400
PointerToRawData 0xbcc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.56215

.pdata

MD5 a7a8304dcf11d385cc4e03d8be433e4a 🔍
SHA1 0f5f1900aed204ae78924153d11bc3264b7dcd43 🔍
SHA256 953f1c2f86467b070d81dba05c923fbed2af6b6f95096b9763b4be765c4124e8 🔍
SHA3 e2a421b83ae7e2266d7f956ec7ee483a3bfea1aee637acf860bf79d92944bd43 🔍
VirtualSize 0x6354
VirtualAddress 0xc2000
SizeOfRawData 0x6400
PointerToRawData 0xbe000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.95609

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0xc9000
SizeOfRawData 0x200
PointerToRawData 0xc4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 a3a502fab845eb6d38f5458cafb8972a 🔍
SHA1 e66e5e7a971473ec139ade90059b47b183faaad2 🔍
SHA256 26ece492ade331ff98b8383b79029cf104220070f9c3a6181f8503301300c8b5 🔍
SHA3 efe5b32bb733acff783f19efcf3c07e8118c096a85120991e89fe9e1fec954a4 🔍
VirtualSize 0x52b8
VirtualAddress 0xca000
SizeOfRawData 0x5400
PointerToRawData 0xc4600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.87534

.reloc

MD5 b8da62868f1ba7dc93addb2903f791e5 🔍
SHA1 c721f84d9c4f24b895e92c6166488cac5f40bb10 🔍
SHA256 c91a4b66d79acf867984e0dfcf973e14ff0ce1515e86ab5444762e33ba15c0b2 🔍
SHA3 e3702cd7affe7662a3fb3b8794dfce2da6640d94bea57e20b7f4948f222cbc6c 🔍
VirtualSize 0x9e0
VirtualAddress 0xd0000
SizeOfRawData 0xa00
PointerToRawData 0xc9a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.39975

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
CRYPT32.dll CryptUnprotectData
CryptProtectData
KERNEL32.dll Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
CreateThread
GetProcAddress
VirtualAllocEx
LocalFree
SystemTimeToFileTime
GetModuleHandleW
CopyFileW
WideCharToMultiByte
CreateRemoteThread
GetSystemTime
VirtualFreeEx
OutputDebugStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
IsDBCSLeadByte
FreeLibrary
QueryPerformanceCounter
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
InitializeSListHead
WriteConsoleW
SetEndOfFile
HeapSize
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
WaitForSingleObject
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetLastError
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
LoadLibraryExW
VirtualProtect
HeapReAlloc
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
GetTickCount64
Sleep
GetExitCodeThread
MultiByteToWideChar
GetTempPathW
WriteFile
WriteProcessMemory
ReadFile
CreateDirectoryW
RaiseException
HeapAlloc
HeapFree
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
TerminateProcess
ExitProcess
GetCurrentProcess
IsProcessorFeaturePresent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
FlsSetValue
CreateToolhelp32Snapshot
OpenProcess
GetFileAttributesW
FindClose
CreateFileW
GetACP
FlsGetValue
FlsAlloc
SetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
WakeAllConditionVariable
SleepConditionVariableSRW
USER32.dll CreateWindowExW
DestroyWindow
PostMessageW
DefWindowProcW
SetClipboardData
GetClipboardData
EmptyClipboard
LoadCursorW
OpenClipboard
PostQuitMessage
LoadIconW
TranslateMessage
PeekMessageW
DispatchMessageW
ShowWindow
RegisterClassExW
GetSystemMetrics
UpdateWindow
CloseClipboard
ClientToScreen
GetCursorPos
GetWindowRect
SetWindowPos
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
UnregisterClassW
COMDLG32.dll GetOpenFileNameW
ADVAPI32.dll RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SHELL32.dll ShellExecuteA
ShellExecuteW
SHGetFolderPathW
ole32.dll CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
OLEAUT32.dll VariantClear
SysAllocString
SysFreeString
VariantInit
WINHTTP.dll WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
IMM32.dll ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
D3DCOMPILER_47.dll D3DCompile

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x253
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.37978
Detected Filetype PNG graphic file
MD5 19a298930e940c51946404d4fbd05837 🔍
SHA1 87c23e23e0ba14597d3dbe6a9a5e98b0b1c978b8 🔍
SHA256 48c5a7c3dcab3b263d6d089680be4b57ba691112c6fa443c34d737cda050e87c 🔍
SHA3 b5770f9e525af95bc68624f7fc13ac04a8175332b40f28dc368e0df93bd01e6c 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3fe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.76567
Detected Filetype PNG graphic file
MD5 1fc920eb424359671995a735da08c605 🔍
SHA1 4e282f0d5479298fe3f989b92b484f2f1ea9a77d 🔍
SHA256 78fbad0ab165e529b9314bfc3f768ca043a9d208aee9aa17cb06ae1a6f698102 🔍
SHA3 cd5d74623bdd68050c4a54cc74550ae9facd004a7fd8556066f0d5af12354237 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x58a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85103
Detected Filetype PNG graphic file
MD5 c0f1a8840e3d4994de84cb1f8524f0c5 🔍
SHA1 eec561d519b1e49ed4d661919652c98c48d39035 🔍
SHA256 bc2e0f34dd3fdc17e6c73b19bd426febabde36d0cda592d6936d5bdec2f75be1 🔍
SHA3 eb69a0eaac9f07da4be34c9a116f132d0e592b5f996e2793c566d61d3a766997 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x9c9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89082
Detected Filetype PNG graphic file
MD5 ae282de4b211f9fbdffadd635de7641e 🔍
SHA1 686115938ee3bc339244eeeed1a835a5c1fdb78a 🔍
SHA256 82673e769ddab7a0435a3029858a5eeed426ee2483402ea76d6bc23edafec1bf 🔍
SHA3 c31a48390cd079ee40dabe3605f51785778f9a31d40e45edc25ccb8f49997956 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xe35
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93352
Detected Filetype PNG graphic file
MD5 bdb5b38c466dcee067acc4c774e8a80e 🔍
SHA1 8f5fc8f8cb33a580ef413ef0d28445d5d893f4e7 🔍
SHA256 cfb41712098eae6eb8259f316166232e9096430defd6e7ad83fb651a890ecbeb 🔍
SHA3 1db227da5f344b83c35c0899c56d7af260592bd3d0f7c40f067254c27dd2eb9f 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2b04
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97608
Detected Filetype PNG graphic file
MD5 ee6f5268851a74cafb879160280800ee 🔍
SHA1 cdd068d11ce19fdfe1f3b344b18727afa50f0320 🔍
SHA256 099dac52a2225de50d31bd7f1e4ce0d1b8161f83bcea4178de413885d8990f27 🔍
SHA3 69b803ae4a804fcf0de8f6fbeb4c5587701026e32ebf21f31f659baae221f773 🔍

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91314
Detected Filetype Icon file
MD5 d9c88af785a7f0d9b0a138205f69a62e 🔍
SHA1 b18c00072e44c801c566fa223fb5ff6d496e8442 🔍
SHA256 36e8a525632f238c2855c7b618428497233bfc00eb90d724e05b74f9055d3620 🔍
SHA3 ccf6205895e98f2a39fb221ee15732acc0ae0bb60c2076234d12246b624f523d 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Sep-05 08:47:39
Version 0.0
SizeofData 85
AddressOfRawData 0xb2b88
PointerToRawData 0xb1388
Referenced File C:\Users\Holy\source\repos\Wendigo\injector\ZEROInjector.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Sep-05 08:47:39
Version 0.0
SizeofData 20
AddressOfRawData 0xb2be0
PointerToRawData 0xb13e0

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-05 08:47:39
Version 0.0
SizeofData 1012
AddressOfRawData 0xb2bf4
PointerToRawData 0xb13f4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Sep-05 08:47:39
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400b3030
EndAddressOfRawData 0x1400b3038
AddressOfIndex 0x1400c02e4
AddressOfCallbacks 0x140097698
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400bf040

RICH Header

XOR Key 0x55db3b82
Unmarked objects 0
C++ objects (33145) 165
ASM objects (33145) 15
ASM objects (35721) 10
C objects (35721) 16
C objects (33145) 26
C++ objects (35721) 59
Imports (33145) 29
Total imports 211
C++ objects (LTCG) (36256) 32
Resource objects (36256) 1
151 1
Linker (36256) 1

Errors

Leave a comment

No comments yet.