Manalyze report for a87eafe7db969f02de48169b8ebe94bfcd15cee7326954d4db2f35d727ac0729

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2065-Jan-12 08:49:01
TLS Callbacks	2 callback(s) detected.
Debug artifacts	GPM2 Options.pdb

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: .buildid` `Unusual section name found: /4`
Info	The PE contains common functions which appear in legitimate applications.	`Possibly launches other programs: CreateProcessA`
Suspicious	The file contains overlay data.	`512 bytes of data starting at offset 0x3d400.`
Malicious	VirusTotal score: 13/71 (Scanned on 2026-11-05 01:38:56)	`ALYac: Gen:Variant.Draftor.36075` `APEX: Malicious` `Arcabit: Trojan.Draftor.D8CEB` `BitDefender: Gen:Variant.Draftor.36075` `Bkav: W32.Malware.3911C02` `CTX: exe.unknown.draftor` `Emsisoft: Gen:Variant.Draftor.36075 (B)` `GData: Gen:Variant.Draftor.36075` `Kaspersky: VHO:Trojan.Win32.Convagent.gen` `McAfeeD: ti!A87EAFE7DB96` `MicroWorld-eScan: Gen:Variant.Draftor.36075` `Symantec: ML.Attribute.HighConfidence` `VIPRE: Gen:Variant.Draftor.36075`

Hashes

MD5	`4b03d4895319fe18d36388180f32a2e1` 🔍
SHA1	`553bcb8eeb99b7cfce67bd973fe42390c1fa9195` 🔍
SHA256	`a87eafe7db969f02de48169b8ebe94bfcd15cee7326954d4db2f35d727ac0729` 🔍
SHA3	`2446db6d498d226a0d77cda6bd080f7eee2786d05ad16d6cbed34d25de6d46fb` 🔍
SSDeep	`6144:G+ZkKx93G6hiOzU7aHfglSaQBy7IjUPgd3hu04zALy/UIWjsmf:G+ZP93G6hiQU7oglSaQByiUGxudALrI` 🔍
Imports Hash	`d001f763ad32ad6b8f5714de4bd88c9c` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x78`
e_cp	`0x1`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x78`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`7`
TimeDateStamp	2065-Jan-12 08:49:01
PointerToSymbolTable	`0x3d400`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x31e00`
SizeOfInitializedData	`0xb200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00002630 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x43000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x1000000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`c8c433d8f37a664bcc94fbcf610f0988 🔍`
SHA1	`7e61884bcd8ce4f8a76f92497aa8ed7b607902bf 🔍`
SHA256	`79640580203ea6bc8dc8b479bba33165221cb8917b623077ae41d962c1cba478 🔍`
SHA3	`bbee242f4b771b10f8aa0d4309a89e1d287b0493c1d6622d39ec237c5ac6814c 🔍`
VirtualSize	`0x31cf4`
VirtualAddress	`0x1000`
SizeOfRawData	`0x31e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.45509`

.rdata

MD5	`6cad4a7f9ccc330542bb782b83aa374c 🔍`
SHA1	`a478bb2934d4fee32d0f44368559aad9629e0432 🔍`
SHA256	`8e41285f471f5378404110d64f386aff2b03591a573ef22adb10fd43bef5c58b 🔍`
SHA3	`d1d90fff4cf7f156022e115b0f26f8cd8553ea43931fbdf63331a26b85b49b09 🔍`
VirtualSize	`0x5dd1`
VirtualAddress	`0x33000`
SizeOfRawData	`0x5e00`
PointerToRawData	`0x32200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.39382`

.buildid

MD5	`bc0f7ce6f577483c32fddc1411bf1fc4 🔍`
SHA1	`99c3116095b3686e92f8b87080fced67118bca09 🔍`
SHA256	`4f5c9255af46a2acbdd357d310dcb679540779c83a4fbf0d08088a83ce06d0a7 🔍`
SHA3	`8e5adc44bca44e8fa7e6ce53726c3b176af0a28423ade13642c11a2fb6fc6139 🔍`
VirtualSize	`0x61`
VirtualAddress	`0x39000`
SizeOfRawData	`0x200`
PointerToRawData	`0x38000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.03151`

.data

MD5	`5532184d13887fbae25320b2952c024a 🔍`
SHA1	`2485721be535ad1f9f4654bddaa4b4d4af33cb0b 🔍`
SHA256	`5355a5b46e93628468eaf3ffcc912976b61be4547ea12a7303fab84c1838301d 🔍`
SHA3	`b730dbfdda6bd1ffcabeba96e84000f5f44a49325f744378c2eae61844d13864 🔍`
VirtualSize	`0x1328`
VirtualAddress	`0x3a000`
SizeOfRawData	`0x200`
PointerToRawData	`0x38200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.532396`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x8`
VirtualAddress	`0x3c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x38400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`691be8df205af64c89a7a42f80cd3b6f 🔍`
SHA1	`046f72f1b6c743127db4d08d710f584393e0785c 🔍`
SHA256	`7ef2e67291b06c3e1db333d819210dd6912ecd11a5f01eec0ba63cd15530bed8 🔍`
SHA3	`1bbe456d0a01ae311b0e3dedef7ed2ea7e055d867e315acada2a650b062423ab 🔍`
VirtualSize	`0x1078`
VirtualAddress	`0x3d000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x38600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.375`

/4

MD5	`d743e889934eed70d7716060d919ca70 🔍`
SHA1	`f7d4f439a542d8469e1ebe35c349e9c24ef37d79 🔍`
SHA256	`c8e2848a19ad2f4fa71e12539afa2ae6d3fa1618804ee815938bc28b81ae4e05 🔍`
SHA3	`e8307076cc66152058f90159befdeaf4fdf4dfe39bdd6f69f0a7583288ef5c2e 🔍`
VirtualSize	`0x3a90`
VirtualAddress	`0x3f000`
SizeOfRawData	`0x3c00`
PointerToRawData	`0x39800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`4.38365`

Imports

USER32.dll	`AdjustWindowRect` `CreateWindowExA` `DefWindowProcA` `DestroyWindow` `DispatchMessageA` `EnableWindow` `GetDC` `GetMessageA` `IsDialogMessageA` `LoadCursorA` `LoadIconA` `MessageBoxA` `PostMessageA` `PostQuitMessage` `RegisterClassA` `ReleaseDC` `SendMessageA` `SetProcessDPIAware` `SetWindowTextA` `SystemParametersInfoA` `TranslateMessage`
GDI32.dll	`CreateFontIndirectA` `GetDeviceCaps`
SHELL32.dll	`SHBrowseForFolderA` `SHGetPathFromIDListA`
ole32.dll	`CoInitialize` `CoTaskMemFree`
api-ms-win-crt-convert-l1-1-0.dll	`atof`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-private-l1-1-0.dll	`strrchr`
api-ms-win-crt-runtime-l1-1-0.dll	`__p___argc` `__p___argv` `__p__acmdln` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_initialize_narrow_environment` `_initterm` `_initterm_e` `_set_app_type` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `__stdio_common_vsprintf` `fclose` `fgets` `fopen` `fputs` `fwrite`
api-ms-win-crt-string-l1-1-0.dll	`strncmp` `strpbrk`
KERNEL32.dll	`CloseHandle` `CreateProcessA` `DeleteCriticalSection` `EnterCriticalSection` `GetEnvironmentVariableA` `GetFileAttributesA` `GetFullPathNameA` `GetLastError` `GetModuleFileNameA` `GetModuleHandleA` `GetPrivateProfileIntA` `GetPrivateProfileStringA` `GetStartupInfoA` `InitializeCriticalSection` `LeaveCriticalSection` `MulDiv` `SetEnvironmentVariableA` `SetUnhandledExceptionFilter` `Sleep` `TlsGetValue` `VirtualProtect` `VirtualQuery` `WritePrivateProfileStringA` `lstrcpyA`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-multibyte-l1-1-0.dll	`_ismbblead`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2065-Jan-12 08:49:01
Version	`0.0`
SizeofData	`41`
AddressOfRawData	`0x39038`
PointerToRawData	`0x38038`
Referenced File	GPM2 Options.pdb

UNKNOWN

Characteristics	`0`
TimeDateStamp	2065-Jan-12 08:49:01
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x43c000`
EndAddressOfRawData	`0x43c004`
AddressOfIndex	`0x43a2bc`
AddressOfCallbacks	`0x438238`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`0x00402890` `0x00402910`

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!

Leave a comment

No comments yet.