| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Aug-09 17:03:28 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses known Mersenne Twister constants |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 3/71 (Scanned on 2026-08-09 17:03:59) |
APEX:
Malicious
Microsoft: Trojan:Win32/Wacatac.B!ml Symantec: ML.Attribute.HighConfidence |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Aug-09 17:03:28 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x99800 |
| SizeOfInitializedData | 0x6dc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000069CB0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x10b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
|---|---|
| USER32.dll |
GetAsyncKeyState
LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetCursorPos GetWindowRect SetWindowRgn UpdateWindow GetSystemMetrics ReleaseCapture SetCapture IsIconic SetWindowPos ShowWindow DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage EnumWindows FindWindowA GetWindowTextA |
| GDI32.dll |
CreateRoundRectRgn
|
| ADVAPI32.dll |
RegCloseKey
RegOpenKeyExA RegQueryValueExA RegEnumValueA |
| SETUPAPI.dll |
SetupDiGetDeviceRegistryPropertyA
SetupDiOpenDevRegKey SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo |
| KERNEL32.dll |
HeapReAlloc
GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW SetStdHandle CreateFileW HeapSize WriteConsoleW TerminateProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread QueryPerformanceFrequency QueryPerformanceCounter Sleep GetCurrentThread SetThreadPriority GetModuleFileNameA GetCurrentProcess ExitProcess GetModuleHandleA SetEndOfFile FlushFileBuffers ReadFile GetEnvironmentStringsW CloseHandle GetLastError ClearCommError GetCommState PurgeComm SetCommState SetCommTimeouts GetWindowsDirectoryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA SetUnhandledExceptionFilter ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread RtlUnwind RtlPcToFileHeader RaiseException SleepConditionVariableSRW WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FlsFree FreeEnvironmentStringsW WriteFile GetProcessHeap CreateFileA RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue |
| IMM32.dll |
ImmGetContext
ImmReleaseContext ImmSetCompositionWindow |
| D3DCOMPILER_47.dll |
D3DCompile
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Aug-09 17:03:28 |
| Version | 0.0 |
| SizeofData | 1012 |
| AddressOfRawData | 0xef37c |
| PointerToRawData | 0xedf7c |
| StartAddressOfRawData | 0x1400ef7b8 |
|---|---|
| EndAddressOfRawData | 0x1400ef7c0 |
| AddressOfIndex | 0x1400fff58 |
| AddressOfCallbacks | 0x14009b758 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400fca80 |
| XOR Key | 0xefd7ae6b |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 181 |
| ASM objects (33145) | 28 |
| C objects (33145) | 35 |
| C objects (35721) | 17 |
| ASM objects (35721) | 12 |
| C++ objects (35721) | 99 |
| Imports (33145) | 19 |
| Total imports | 202 |
| C++ objects (36252) | 18 |
| Linker (36252) | 1 |
No comments yet.