9f98445f24869f328d2d5ddc974b19e8292450b2c465490bd1cbfd218be6cfd0
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-Jan-22 08:50:14 |
| Detected languages |
Bulgarian - Bulgaria
English - United States |
Plugin Output
| Suspicious | The PE is packed with UPX |
Unusual section name found: .UPX0
Unusual section name found: .UPX1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 40/71 (Scanned on 2026-09-22 03:32:37) |
APEX:
Malicious
AVG: Win32:Trojan-gen AhnLab-V3: Trojan/Win.Generic.C5383689 Alibaba: Packed:Win32/VMProtect.7bd0d3bb Avast: Win32:Trojan-gen Avira: TR/W32.Trojan Bkav: W32.Malware.21A708A0 CTX: exe.trojan.vmprotect CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS ESET-NOD32: Win32/Packed.VMProtect.HK trojan Elastic: malicious (high confidence) F-Secure: Trojan.TR/W32.Trojan Fortinet: W32/PossibleThreat GData: Win32.Trojan.Agent.2E45G1 K7AntiVirus: Riskware ( 0040eff71 ) K7GW: Riskware ( 0040eff71 ) Lionic: Trojan.Win32.VMProtect.4!c Malwarebytes: Trojan.VMProtect MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!9F98445F2486 Microsoft: Trojan:Win32/Tiggre!rfn Paloalto: generic.ml Panda: Trj/CI.A Rising: Trojan.Fuerboos!8.EFC8 (TFE:5:iBd476IPY8S) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Trojan.wc Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence TrellixENS: Artemis!BAFF4C3EE9DC TrendMicro: TROJ_GEN.R002C0DJL21 TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CAB Xcitium: Malware@#gqy63t7j9lty Yandex: Trojan.VMProtect!V5BuIXzhrh4 Zillya: Trojan.Packed.Win32.154359 alibabacloud: VirTool:Win/Tiggre.Gen tehtris: Generic.Malware |
Hashes
| MD5 | baff4c3ee9dc0a8ca9f3532462e646d9 🔍 |
|---|---|
| SHA1 | 58568288f2ef81db929527138ae0ec787274d130 🔍 |
| SHA256 | 9f98445f24869f328d2d5ddc974b19e8292450b2c465490bd1cbfd218be6cfd0 🔍 |
| SHA3 | e9d325d9963ae792853b71b9840de913ec9b808a88ac5c3a539cfd89105edfec 🔍 |
| SSDeep | 98304:YnCGqlUFofjaWLdPrQM9KQw9UlorXxFtPEBucYl/iXaQyn/teEq5XQweQH5pqAt:YZqdraWLdP9QQCEBuZRiVyn/oEqP7D 🔍 |
| Imports Hash | 3ba351ff79559cc880fa64cc6e6ffddb 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2019-Jan-22 08:50:14 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 10.0 |
| SizeOfCode | 0xe800 |
| SizeOfInitializedData | 0x32000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00C131AA (Section: .UPX1) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x10000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xcac000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x76f00e |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xe748 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x369c |
| VirtualAddress | 0x10000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x2e48 |
| VirtualAddress | 0x14000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.UPX0
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x531cbc |
| VirtualAddress | 0x17000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.UPX1
| MD5 | 558dc36bc2e8a93993270c8d426dffff 🔍 |
|---|---|
| SHA1 | f4a713e83dc542227d569acd05772f65ce42e3e1 🔍 |
| SHA256 | 175a2629811801b72049ea918da2ecff18baced52326cb14ec14e40cc6c5d89c 🔍 |
| SHA3 | 6234c6420a052d80ef8bbf926cfd1095cdc4ebba745e86de50d6afd1b914ca5d 🔍 |
| VirtualSize | 0x735160 |
| VirtualAddress | 0x549000 |
| SizeOfRawData | 0x735200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 7.97211 |
.rsrc
| MD5 | 5b41a1cf0276a3b918b7780d31a30dd3 🔍 |
|---|---|
| SHA1 | 44bb8d58562d943c51b05a5cf88fd895cf2878d5 🔍 |
| SHA256 | 003feace6a084d4319ef433512586a0a00394b98da04c0b032a2f4ab1fcb4b52 🔍 |
| SHA3 | cb663c44b78c271ffdb461bf4371e74de3e0506f62eed8dd3ee3550431c6aa47 🔍 |
| VirtualSize | 0x2cfa8 |
| VirtualAddress | 0xc7f000 |
| SizeOfRawData | 0x2d000 |
| PointerToRawData | 0x735600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.23497 |
Imports
| KERNEL32.dll |
CloseHandle
|
|---|---|
| USER32.dll |
CallNextHookEx
|
| COMCTL32.dll |
InitCommonControlsEx
|
| WTSAPI32.dll |
WTSSendMessageW
|
| KERNEL32.dll (#2) |
CloseHandle
|
| USER32.dll (#2) |
CallNextHookEx
|
| KERNEL32.dll (#3) |
CloseHandle
|
| USER32.dll (#3) |
CallNextHookEx
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | Bulgarian - Bulgaria |
| Codepage | Latin 1 / Western European |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.70069 |
| MD5 | 3bf144e23d3ddd5dfa9b84582ec743c4 🔍 |
| SHA1 | 2872d56f08da539eded48fb76a8af145327f85b2 🔍 |
| SHA256 | d74c97f013472bea7db85fc4a52e50c7fb456ec6de048450594372d4d36bd402 🔍 |
| SHA3 | 4b85d5abc1969529f8648111c43295512317432438899c01bedd1ac84e6673d8 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | Bulgarian - Bulgaria |
| Codepage | Latin 1 / Western European |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.18184 |
| MD5 | 3b2412a1ce8e1a763e5140ade2b12e2e 🔍 |
| SHA1 | a107b5b9eb21713c507194f73473c71affdc8b4f 🔍 |
| SHA256 | 87fb477ec53e00eb8ee5df19f5febb2dc1209879d983a40bbf5f486e49174bdd 🔍 |
| SHA3 | a9cc58295a92241118623e3b85c3e019efb75a2d40adb8e678e1bdeb16996a29 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | Bulgarian - Bulgaria |
| Codepage | Latin 1 / Western European |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.80691 |
| MD5 | 2fcf0b2ef9766b94ca2d63a4d0a12e76 🔍 |
| SHA1 | d8760836810fc9bc67408826984d902fb23be632 🔍 |
| SHA256 | e26e73bb30476f674bba7d39e594f8d65c7849578b77c3a839812ffcc19b88bb 🔍 |
| SHA3 | a3d55d37e6771261a5a60ab880f8bff46aea8b9434ae562bb4083a8faeff68c0 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | Bulgarian - Bulgaria |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.10276 |
| MD5 | 5e5e6ebdd7caae2b6ba721a02afa6307 🔍 |
| SHA1 | a988b464be0a8fddc119451f4dd5b5553f33890f 🔍 |
| SHA256 | 1421f2a691e408e8d7e07bf5533784937d8693e0aeb1e72602846c85ddb17fe7 🔍 |
| SHA3 | 1150a0179bc2b8e19aed911e61f3f5782cea5ad0f5dfe5055111c2c735d88761 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | Bulgarian - Bulgaria |
| Codepage | Latin 1 / Western European |
| Size | 0x28708 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.87361 |
| MD5 | fd2b3684c6084210b4377d6692738a1d 🔍 |
| SHA1 | 50fac161c886c3826c055530c1c3bc46fc195f56 🔍 |
| SHA256 | 95fde55091a32b38e3e87b87cb7404670236906d6543e12c2d168eaece52ed7e 🔍 |
| SHA3 | 6abebb1ee94b41d90bc232e12b28ceb939b91466d652b0d9a75d1b0b21f8676c 🔍 |
101
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Bulgarian - Bulgaria |
| Codepage | Latin 1 / Western European |
| Size | 0x4c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.86004 |
| Detected Filetype | Icon file |
| MD5 | 81e49b7f753058a13e0a7a5ca29b5611 🔍 |
| SHA1 | 4dbe8bb83fc6b83fa55da31e4ddcfd8a6e21ed68 🔍 |
| SHA256 | 08a042de925abd31be8844b5c8c27bf0992f7f6b47b3d142808f026e3c23c8af 🔍 |
| SHA3 | 37de85c274d6fa04989043584b01c497eafad5eda5779ca8710e0871608dc560 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x26c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.01246 |
| MD5 | 7d471a416c480c691b70ebd2c1b966f8 🔍 |
| SHA1 | fe3c58a7469c95dc915b8c028fc016d27be8f300 🔍 |
| SHA256 | d9e9362080b827810db09aa7091f2a82a4b0b874018a131707f572454649484e 🔍 |
| SHA3 | 1bce59de66f97843559f9b4e808b330b1396514cfa695ae32b07434f756fc208 🔍 |
Version Info
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x414154 |
| SEHandlerTable | 0x107e070 |
| SEHandlerCount | 60 |
RICH Header
Errors
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .UPX0 has a size of 0!
Leave a comment
No comments yet.