9e23dcf384985c95904233147d146c9bcc13e2fd5bc44d87da348b699cc7f0e8
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Dec-19 17:22:10 |
| Detected languages |
English - United States
|
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileDescription | Application Way |
| LegalCopyright | Usual Join Application Way 2011-2025 |
| ProductName | Application Resolution |
| CompanyName | Usual Join Application Way |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA1 Uses constants related to AES Uses known Mersenne Twister constants Microsoft's Cryptography API |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Cyber Holding Partners LLC
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| Malicious | VirusTotal score: 33/71 (Scanned on 2026-05-15 15:02:15) |
AVG:
Win32:DangerousSig [Trj]
AhnLab-V3: Downloader/Win.Fakesfx.R772945 Alibaba: AdWare:Win32/AdLoad.6f5b1ffc Antiy-AVL: Trojan[Downloader]/Win32.AdLoad Avast: Win32:DangerousSig [Trj] Avira: TR/W32.DangerousSig CTX: exe.trojan.adload CrowdStrike: win/grayware_confidence_60% (D) Cylance: Unsafe DeepInstinct: MALICIOUS F-Secure: Trojan.TR/W32.DangerousSig GData: Win32.Trojan.Agent.8JSAXQ Google: Detected Gridinsoft: Trojan.Win32.Wacatac.cl Kaspersky: HEUR:Trojan-Downloader.Win32.Adload.gen Kingsoft: Win32.Trojan-Downloader.Adload.gen Lionic: Trojan.Win32.AdLoad.a!c Malwarebytes: Adware.SpecialSearchOffer MaxSecure: Trojan.Malware.6991189.susgen Microsoft: PUA:Win32/Presenoker Paloalto: generic.ml Rising: Adware.OpenSUpdater@XH.18C3 (CERT:cOsM6f5ETqONWhwLbFCz1g) Skyhigh: Artemis Sophos: Mal/Generic-S Symantec: Trojan.Gen.MBT TrellixENS: Artemis!5960B24AAC0B TrendMicro: Trojan.Win32.ZYX.USBLED26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLED26 VBA32: TrojanDownloader.Adload Varist: W32/ABTrojan.FXKG-7106 Webroot: Win.Trojan.Gen Xcitium: ApplicUnwnt@#luysboe0dy5 alibabacloud: Trojan[downloader]:Win/Presenoker.Gen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2025-Dec-19 17:22:10 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x37ae00 |
| SizeOfInitializedData | 0x40a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00304D10 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x37c000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3bf000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x113049b |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| KERNEL32.dll |
CreateProcessW
HeapFree GetSystemInfo GetProcessHeap GetDriveTypeW DeleteFileW LCMapStringEx TlsFree WriteConsoleW WakeConditionVariable GetCurrentProcess IsValidCodePage CompareStringW ReleaseSRWLockExclusive GetTimeZoneInformation GetFileType GetTimeFormatW ReadConsoleW GetLastError SetEnvironmentVariableA SetLastError GetVersion TlsGetValue FindNextFileA RemoveDirectoryW WaitForMultipleObjects WaitForSingleObject GetProcAddress FlushFileBuffers GetConsoleCP SetFileTime GetTickCount GetCommandLineA ReleaseSemaphore GetEnvironmentVariableA GetEnvironmentStringsW IsProcessorFeaturePresent HeapAlloc GetFileInformationByHandle GetLocaleInfoW InitializeCriticalSectionEx LocalFree LoadLibraryW SystemTimeToTzSpecificLocalTime VirtualAlloc SetUnhandledExceptionFilter GetOEMCP GetStringTypeW SetFilePointerEx TlsAlloc MultiByteToWideChar Sleep GetCPInfo SetFileAttributesW TryAcquireSRWLockExclusive QueryPerformanceFrequency FreeEnvironmentStringsW LoadLibraryExW ExitProcess SetEndOfFile TlsSetValue GetFileSize GetSystemDirectoryW GetModuleHandleExW GetStartupInfoW EnumSystemLocalesW GetConsoleMode GlobalMemoryStatus AcquireSRWLockExclusive GetFileSizeEx GetVersionExW TerminateProcess EnterCriticalSection VirtualFree ResetEvent MoveFileExW WideCharToMultiByte GetDateFormatW CreateDirectoryW GetModuleFileNameW DeleteCriticalSection InitializeSListHead FreeLibrary ExitThread PeekNamedPipe GetCurrentThreadId SetCurrentDirectoryW SleepEx CreateEventW RtlUnwind GetFileAttributesExW IsDebuggerPresent WakeAllConditionVariable FindClose GetCommandLineW SetStdHandle SetFilePointer QueryPerformanceCounter GetTempFileNameW CreateSemaphoreW HeapReAlloc UnhandledExceptionFilter GetModuleFileNameA WriteFile EncodePointer InitializeCriticalSection FreeLibraryAndExitThread InitializeCriticalSectionAndSpinCount GetTempPathW WaitForSingleObjectEx LCMapStringW ReadFile CreateThread GetUserDefaultLCID GetACP RaiseException CloseHandle GetCurrentProcessId GetSystemTimeAsFileTime SetEvent GetProcessAffinityMask GetFileAttributesW GetExitCodeThread GetModuleHandleW FormatMessageW VerifyVersionInfoW GetModuleHandleA FindFirstFileExA HeapSize GetStdHandle GetFullPathNameW FindFirstFileW FindNextFileW IsValidLocale DecodePointer SleepConditionVariableSRW FileTimeToSystemTime VerSetConditionMask GetCurrentDirectoryW CreateFileW LeaveCriticalSection |
|---|---|
| USER32.dll |
DialogBoxParamW
DestroyWindow LoadStringW CharUpperW KillTimer SetTimer GetDlgItem PostMessageW LoadIconW GetWindowLongW MessageBoxW SetWindowLongW SendMessageW SetWindowTextW ShowWindow EndDialog |
| SHELL32.dll |
ShellExecuteExW
|
| OLEAUT32.dll |
SysStringLen
VariantClear SysAllocStringLen |
| bcrypt.dll |
BCryptGenRandom
|
| ADVAPI32.dll |
CryptEncrypt
CryptDestroyHash CryptDestroyKey CryptReleaseContext CryptHashData CryptGetHashParam CryptImportKey CryptAcquireContextW CryptCreateHash |
Delayed Imports
UpdChecksum
| Ordinal | 1 |
|---|---|
| Address | 0x3045bb |
1
2
97
1 (#2)
188
207
1 (#3)
1 (#4)
1 (#5)
String Table contents
| Extraction Failed |
| File is corrupt |
| Cannot create folder '{0}' |
| Extracting |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| FileVersion (#2) | 1.0.0.0 |
| ProductVersion (#2) | 1.0.0.0 |
| FileDescription | Application Way |
| LegalCopyright | Usual Join Application Way 2011-2025 |
| ProductName | Application Resolution |
| CompanyName | Usual Join Application Way |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Dec-19 17:22:10 |
| Version | 0.0 |
| SizeofData | 868 |
| AddressOfRawData | 0x3a30b4 |
| PointerToRawData | 0x3a22b4 |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Dec-19 17:22:10 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
Load Configuration
| Size | 0xc0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x7a9000 |
| SEHandlerTable | 0x7a2cc0 |
| SEHandlerCount | 183 |
RICH Header
| XOR Key | 0xfc5f365d |
|---|---|
| Unmarked objects | 0 |
| 241 (40116) | 10 |
| 243 (40116) | 131 |
| 242 (40116) | 25 |
| ASM objects (VS 2015/2017 runtime 26706) | 9 |
| C++ objects (VS 2015/2017 runtime 26706) | 52 |
| C objects (VS 2015/2017 runtime 26706) | 30 |
| Imports (VS2008 SP1 build 30729) | 3 |
| Total imports | 171 |
| C++ objects (LTCG) (VS2017 v15.9.7-10 compiler 27027) | 5 |
| Resource objects (VS2017 v15.9.7-10 compiler 27027) | 1 |
| Linker (VS2017 v15.9.7-10 compiler 27027) | 1 |
Errors
Leave a comment
No comments yet.