9d060f0e49470876911ee6284dd255a7541ca4facc1586198842d999bc4462a9
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Oct-11 19:34:50 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | The PE is possibly packed. |
Unusual section name found: .z;I
Unusual section name found: .#n9 Unusual section name found: .<@2 |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 24/71 (Scanned on 2026-10-13 13:27:56) |
ALYac:
Gen:Variant.Lazy.698216
APEX: Malicious Arcabit: Trojan.Lazy.DAA768 BitDefender: Gen:Variant.Lazy.698216 Bkav: W32.Malware.C28D27A2 CTX: exe.unknown.lazy CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: Win32/Packed.VMProtect.ACI trojan Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Lazy.698216 (B) GData: Gen:Variant.Lazy.698216 Gridinsoft: Trojan.Heur!.02212021 Malwarebytes: Malware.Heuristic.2108 McAfeeD: Real Protect-LS!2F515FFDD98E MicroWorld-eScan: Gen:Variant.Lazy.698216 Microsoft: Trojan:Win32/Wacatac.B!ml Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score VIPRE: Gen:Variant.Lazy.698216 tehtris: Generic.Malware |
Hashes
| MD5 | 2f515ffdd98eeaba1b6045a35a8a6927 🔍 |
|---|---|
| SHA1 | 9dabf146c97ea4799ff1ae746c823c6790755402 🔍 |
| SHA256 | 9d060f0e49470876911ee6284dd255a7541ca4facc1586198842d999bc4462a9 🔍 |
| SHA3 | 7ea41db8d608f05daf608f19a0f696307c073dff3a97c0e62d87278371c1a3ca 🔍 |
| SSDeep | 393216:zKai6i7Uge9s9nft8IHTg4L5oAvK2sDwSHhPTZ0DHq0+wRxMy1fR:zKaiN4gHr8GaA35DHH+wk 🔍 |
| Imports Hash | 5dab9824c55d570c5db81294e3f2fc01 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Oct-11 19:34:50 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1c600 |
| SizeOfInitializedData | 0xcb2000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x013C1262 (Section: .<@2) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x1e000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x271a000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1c4ac |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x8608 |
| VirtualAddress | 0x1e000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x600 |
| VirtualAddress | 0x27000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.z;I
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x12a867e |
| VirtualAddress | 0x28000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.#n9
| MD5 | e92571c06b5b5e4052ca9ee005ed57e7 🔍 |
|---|---|
| SHA1 | 1cd058eda6f88897f9da451cf49d09969e413868 🔍 |
| SHA256 | f12c2c3c9a08ca1978be87a1454110d7b41e39646082a8794cefd3eea2ad60b9 🔍 |
| SHA3 | bf68b8cb77521506f6936d4fcff4af393829fb39a457f8d68e470b6fa5b0c567 🔍 |
| VirtualSize | 0x6d0 |
| VirtualAddress | 0x12d1000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.553873 |
.<@2
| MD5 | 65555e15b353e1760797117074e0ce97 🔍 |
|---|---|
| SHA1 | 37cecac0421d495cde2874da1062dd56de205ed1 🔍 |
| SHA256 | 436067812b9459db8d6c592d9161eec811530ec3ba17562413711d1e71e91936 🔍 |
| SHA3 | 167127a46984e74f5fb950f40197f2b541d871011b820272971a006f26533c5e 🔍 |
| VirtualSize | 0x1403fa0 |
| VirtualAddress | 0x12d2000 |
| SizeOfRawData | 0x1404000 |
| PointerToRawData | 0xc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 7.98536 |
.reloc
| MD5 | 97b05e8600047f4aa67e99e6fd045573 🔍 |
|---|---|
| SHA1 | 19dd12d6114b58d8f14ca1a41e78b27d96d49baf 🔍 |
| SHA256 | d974fbe0e0adea2a69874b271fe06b6e3b7614e80b4d33ef147991ae34950a88 🔍 |
| SHA3 | b43948cb8db1a0edeac83009c8a37f944380bcbe0a3be41dbad02209fdd8f053 🔍 |
| VirtualSize | 0x7f0 |
| VirtualAddress | 0x26d6000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x1404c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.51661 |
.rsrc
| MD5 | e9daf2571c71a5b1f2000fcd5f1438e5 🔍 |
|---|---|
| SHA1 | 6078e7051a7c1d650b8179ac29cead2f28f12ab9 🔍 |
| SHA256 | edc9c8181ebeb96f85e16545dd1a14c50156eeb6eb3235f8b15687778c4a8c44 🔍 |
| SHA3 | 6dabc838e7b34197957cfaf0419087ed31e9b427b8ed31df8ca3e6ec44a31d58 🔍 |
| VirtualSize | 0x422ac |
| VirtualAddress | 0x26d7000 |
| SizeOfRawData | 0x42400 |
| PointerToRawData | 0x1405400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.11266 |
Imports
| VERSION.dll |
GetFileVersionInfoW
|
|---|---|
| MSVCP140.dll |
_Thrd_join
|
| bcrypt.dll |
BCryptGenerateSymmetricKey
|
| KERNEL32.dll |
GetSystemTimeAsFileTime
|
| USER32.dll |
MessageBoxW
|
| ADVAPI32.dll |
OpenSCManagerW
|
| ole32.dll |
CoUninitialize
|
| OLEAUT32.dll |
SysFreeString
|
| SHLWAPI.dll |
StrCmpW
|
| VCRUNTIME140.dll |
__std_exception_destroy
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-convert-l1-1-0.dll |
strtoll
|
| api-ms-win-crt-string-l1-1-0.dll |
strcat_s
|
| api-ms-win-crt-heap-l1-1-0.dll |
_callnewh
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vsprintf_s
|
| api-ms-win-crt-filesystem-l1-1-0.dll |
_lock_file
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_initterm
|
| api-ms-win-crt-time-l1-1-0.dll |
_difftime64
|
| api-ms-win-crt-math-l1-1-0.dll |
ceil
|
| KERNEL32.dll (#2) |
GetSystemTimeAsFileTime
|
| KERNEL32.dll (#3) |
GetSystemTimeAsFileTime
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x42028 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.10405 |
| MD5 | 5102f586007be7af9c05fedfc5da614b 🔍 |
| SHA1 | 080e077df645a1a93fd987ca7c5826ac83cb96e4 🔍 |
| SHA256 | 1df247154fc8c1a36b5aa9a8cf99398a3295e0db95d1fc333cd97b322fc4c709 🔍 |
| SHA3 | ff900f2882a22019c8765c3962eb4a66c70a27ffc26df5d3dd5b56c68a7e7b38 🔍 |
101
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.67095 |
| Detected Filetype | Icon file |
| MD5 | 464cb94db3a2622922a9562865009ae8 🔍 |
| SHA1 | dbe17c767d942f219df59f9eae77b213c15eab70 🔍 |
| SHA256 | 8affd1fa69a6c5a5b54e504d72d4e9a0eba9b7d702a445ea1399a5978794719a 🔍 |
| SHA3 | 3e0e32110c6c0f3323eeeb5e4a6cbb7a8db52ab14e0f065384fb4eedac4fbcda 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x188 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.89623 |
| MD5 | b8e76ddb52d0eb41e972599ff3ca431b 🔍 |
| SHA1 | fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍 |
| SHA256 | 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍 |
| SHA3 | 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍 |
Version Info
TLS Callbacks
Load Configuration
| Size | 0xc0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x427040 |
| SEHandlerTable | 0x2ad5d70 |
| SEHandlerCount | 139 |
RICH Header
Errors
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .z;I has a size of 0!
Leave a comment
No comments yet.