a27f9025282dee787e26d67a70c09496632eb46b9c7ee93878869b98774efbb5
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Feb-01 20:22:18 |
Plugin Output
| Info | Matching compiler(s): | MASM/TASM - sig2(h) |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource 89B11FC63345A078A8FA53F5774712A9 is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 37/71 (Scanned on 2026-11-09 10:59:31) |
AVG:
PwrSh:Mayhem-A [Trj]
AhnLab-V3: Trojan/Win32.Agent.R259682 Antiy-AVL: Trojan/Win32.Agent Avast: PwrSh:Mayhem-A [Trj] Avira: TR/Mayhem.A CrowdStrike: win/malicious_confidence_70% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.MulDrop28.60980 ESET-NOD32: PowerShell/KillMBR.B trojan Elastic: malicious (high confidence) F-Secure: Trojan.TR/Mayhem.A Fortinet: W32/Agent.MAZDI!tr Google: Detected Gridinsoft: Trojan.Win32.Agent.vb!s1 Jiangmin: RiskTool.Generic.kkp K7AntiVirus: Trojan ( 005d9b921 ) K7GW: Trojan ( 005d9b921 ) Malwarebytes: Malware.AI.4231750508 McAfeeD: ti!A27F9025282D Microsoft: Trojan:Win32/Wacatac.B!ml NANO-Antivirus: Trojan.Win32.Scrop.eytdxi Rising: Trojan.Kryptik!8.8 (TFE:5:lMYerF3OYHJ) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Infected.ch Sophos: Generic ML PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score VBA32: Trojan.Agent Varist: W32/Trojan.MNUQ-5487 VirIT: Trojan.Win32.Genus.XWT Webroot: W32.Malware.Gen Yandex: Trojan.GenAsa!xeYOOG2tugU Zillya: Trojan.Shelma.Win32.1656 huorong: Trojan/KillMBR.bx |
Hashes
| MD5 | 72abda744954c3fa9bcfcf17012d76a7 🔍 |
|---|---|
| SHA1 | 726dde20e08c8fe7f2593b8a713d97a545df6220 🔍 |
| SHA256 | a27f9025282dee787e26d67a70c09496632eb46b9c7ee93878869b98774efbb5 🔍 |
| SHA3 | a1aa2dfe9f41635206a8615b697ffe5b3967b42ff49b32b9de57b0151604e756 🔍 |
| SSDeep | 1536:C7fTsqBbFkvQ21/ipICdckP+o1Ll5PlNg1qkXTcIOlnToIfZvp9prLpVfB+H/R:gwqhFkv93CSk5DJkXTSNTBfZB9pQ/R 🔍 |
| Imports Hash | 2adb28da7b9fece4b360fc7188d2f05c 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2018-Feb-01 20:22:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xfe00 |
| SizeOfInitializedData | 0xb000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x12000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
| MD5 | b729b25a916638015e2caaa79da47f5d 🔍 |
|---|---|
| SHA1 | 444fda36e2ea77a77ad347403b6289b943699d0a 🔍 |
| SHA256 | 5c623154a52940c24002446e3abc7a4112947dd195de0f4eac32b40af3531ed7 🔍 |
| SHA3 | 9f9743f130b704a9daf48b830211f586634af3f1c1b0c2caf14dd48bfdf90060 🔍 |
| VirtualSize | 0x3018 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x3200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.51797 |
.text
| MD5 | 1fa7311f693f1815cedfcd8d90089d6e 🔍 |
|---|---|
| SHA1 | 4d178fb5b957aeed89734127977582d3d8e26ea9 🔍 |
| SHA256 | 0afcafe9cbb93806cdca177e6ed458822d78f3e4d52a43efce303e6f1231e7d0 🔍 |
| SHA3 | 2def0924d98ce9bfff8ffa43fbd4ab122340e3902fa7d8692a7a8afa5b894b75 🔍 |
| VirtualSize | 0xcaa2 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0xcc00 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.58019 |
.rdata
| MD5 | 6784f513fac4815ca52b2a1098c59370 🔍 |
|---|---|
| SHA1 | 3aef23f6fc51062b5d1ded994c194b02300ac51f 🔍 |
| SHA256 | c921d0b441a0daec25616a445930b1a356217220055d11969409024c45cf3182 🔍 |
| SHA3 | 8f3c70a202ef020a7abb7742bc9cfcbf61399a4aa0371e29c5a1e6b74679adad 🔍 |
| VirtualSize | 0x33a0 |
| VirtualAddress | 0x12000 |
| SizeOfRawData | 0x3400 |
| PointerToRawData | 0x10200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.109 |
.data
| MD5 | 27f503aade709da35f53cafa28f87c6c 🔍 |
|---|---|
| SHA1 | 93fc72a7664c1b877daee3ca55391b6014d432b7 🔍 |
| SHA256 | 50c1c28a7f446337eb9fb42a4931358d003733542539a0dab7bb79c0fd76caa0 🔍 |
| SHA3 | c44435a29ebc6d5ea3d98b3bf97c0c685ae712ec1b089042a7277188bfdd2eb6 🔍 |
| VirtualSize | 0x16c4 |
| VirtualAddress | 0x16000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x13600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.28766 |
.rsrc
| MD5 | da17d288b0494ca8abc369bb09246e06 🔍 |
|---|---|
| SHA1 | 378d4b00eff57785c80be85b2df23903528c39cc 🔍 |
| SHA256 | c5ac7013aa8c0d4e1496074667b3184c48b2b86efc796bb224195f38eb3c5600 🔍 |
| SHA3 | 8f8a7556b5c936469f7ddfe7d721a00d72754b10d9886315c919d7d7c5f2fff4 🔍 |
| VirtualSize | 0x6b50 |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x6c00 |
| PointerToRawData | 0x14600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.29341 |
Imports
| MSVCRT.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc free |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetTempFileNameW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW SendMessageW PostMessageW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathQuoteSpacesW
PathAddBackslashW PathRemoveBackslashW PathRemoveArgsW PathRenameExtensionW |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.13487 |
| MD5 | 57c473d0e2a0fed02a495dba6521641c 🔍 |
| SHA1 | 4c7331cf9f0886e966f5df7e9bd993d6c947e81a 🔍 |
| SHA256 | 8a69b1f49015b3e1e303ecc4848dd8d412767cc00b7dcf2f93d483f037f12651 🔍 |
| SHA3 | be9ff962c1a57717a808031dfc7d448e514ab4f5cd51ccf5c321488ce8b7c626 🔍 |
278775D9A5
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | 55a54008ad1ba589aa210d2629c1df41 🔍 |
| SHA1 | bf8b4530d8d246dd74ac53a13471bba17941dff7 🔍 |
| SHA256 | 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a 🔍 |
| SHA3 | 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7 🔍 |
5B6AA406242E5A30660B2108697200F316CCA179
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x6 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.58496 |
| MD5 | bcb32139322bdcb78ac8cbcca1acf2d0 🔍 |
| SHA1 | 57fbfc2a990853123da63ccad2efa920403a4e38 🔍 |
| SHA256 | d03227e3c360d5885a2af2a1dbfc0180cc6af25981a0a984f368a8741c5899f7 🔍 |
| SHA3 | 4c7737ded63fe75ccfdaa0453befd2dfca789d2dfab3874dd354f90dcbb09482 🔍 |
89B11FC63345A078A8FA53F5774712A9
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x402c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99016 |
| MD5 | 72cc92efa459d566deb5f591b3440ea0 🔍 |
| SHA1 | 395a5ae75e58d667ec94445d06c8482cbba3dd2d 🔍 |
| SHA256 | 3246f9642aa51d94325397e6d4de1b0c9ba943e117fb2a19f1f59e1941dc7669 🔍 |
| SHA3 | af783f8b658d597d92f5c4d1c6ff4653d2cf26e0690e345b5da7d31d0f78e9ce 🔍 |
A0D7A4E92FEEC771F055BFBDF41A8EE2
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xe |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.23593 |
| MD5 | 7bb55e591962edd967c9a3039407256c 🔍 |
| SHA1 | e84642313805d66ef70fdada202992d040a1c2cc 🔍 |
| SHA256 | 8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91 🔍 |
| SHA3 | 116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.91924 |
| Detected Filetype | Icon file |
| MD5 | 6da8e7d5ae1d5d15e0230a67a7c16c6d 🔍 |
| SHA1 | 678db52cbe5d617c33c6269bfd4b6d8d1a17f956 🔍 |
| SHA256 | 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396 🔍 |
| SHA3 | 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x2a0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.08821 |
| MD5 | ffd3b06250ba95d239365ef050b3627b 🔍 |
| SHA1 | 16e3981245d8dbd44f33d93b203c02a44f3c2b95 🔍 |
| SHA256 | 1c3703755b6e9a690e8eafaa0cc318f667cd5d4c06935b6e3cd07296df9e9dcd 🔍 |
| SHA3 | 2c6baa84c172762978837565c2b2ed4f7716c0edaab79bda3a3ef74724426773 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.