a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Aug-02 19:42:17
Detected languages English - United States
Debug artifacts C:\Users\AzraVeLucky\Desktop\Auth\Emu\x64\Release\Emu.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • ac.pvp.net
  • ap.vg.ac.pvp.net
  • eu.vg.ac.pvp.net
  • githubusercontent.com
  • https://raw.githubusercontent.com
  • https://raw.githubusercontent.com/ZeynepGSM3125/4eA3R/refs/heads/main/output.txt
  • kr.vg.ac.pvp.net
  • na.vg.ac.pvp.net
  • raw.githubusercontent.com
  • vg.ac.pvp.net
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE contains functions most legitimate programs don't use. Possibly launches other programs:
  • system
 Uses Microsoft's cryptographic API:
  • CryptStringToBinaryA
  • CryptBinaryToStringA
  • CryptImportPublicKeyInfoEx2
  • CryptDecodeObjectEx
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 31/70 (Scanned on 2026-08-12 10:03:04) ALYac: Gen:Variant.Yogi.44228
AVG: Win64:MalwareX-gen [Misc]
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Trojan.Yogi.DACC4
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Gen:Variant.Yogi.44228
CTX: exe.trojan.wacatac
CrowdStrike: win/malicious_confidence_70% (W)
DeepInstinct: MALICIOUS
Elastic: malicious (moderate confidence)
Emsisoft: Gen:Variant.Yogi.44228 (B)
F-Secure: Trojan.TR/W64.Agent
GData: Gen:Variant.Yogi.44228
Google: Detected
Gridinsoft: Trojan.Win64.Downloader.oa!s1
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.AI.4234897303
MaxSecure: Trojan.Malware.698503005.susgen
McAfeeD: ti!A89D50884B1F
MicroWorld-eScan: Gen:Variant.Yogi.44228
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Skyhigh: BehavesLike.Win64.Worm.dh
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!DB0272F22913
TrendMicro: Trojan.Win32.WACATAC.USBLH926
TrendMicro-HouseCall: Trojan.Win32.WACATAC.USBLH926
VIPRE: Gen:Variant.Yogi.44228
Varist: W64/ABTrojan.PILM-6496

Hashes

MD5 db0272f22913973dd0e10a4ce7682580 🔍
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856 🔍
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8 🔍
SHA3 82d9dd1b01c1f05979bd434a18d1d75bf0e2016238f8c540d70dc34602422aac 🔍
SSDeep 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF 🔍
Imports Hash 4a25eca2c378d943d75e5e8fdda4da7f 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-02 19:42:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21800
SizeOfInitializedData 0x1d600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000001FC80 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x43000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 66cbb85a820b769cde18d9ec99a5679c 🔍
SHA1 d0b6872803831848c34cd2b9b0ebf2d3f09f3b5c 🔍
SHA256 f8454243dd4ae577e39c7874faee3b11e536b18056a176b8669647e2bc5fa534 🔍
SHA3 b41fd4dcebcaaed7b7a602401d4d6885c462de633a45f4001ad526217047854b 🔍
VirtualSize 0x21611
VirtualAddress 0x1000
SizeOfRawData 0x21800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.33548

.rdata

MD5 a6da58a0c77f0cd2cd06317de867eca7 🔍
SHA1 d8f3e01b493025f71b8bd9e1214cb4bfd8ca4ce5 🔍
SHA256 37cdc280ad74b9e309e6b808ae248eb0b1767322fee98dbdd8c88e1d35daf6fc 🔍
SHA3 cc4afa9e8412bc43bce29b3821e74b09b4a058dc299814d58b333eea497fbb64 🔍
VirtualSize 0x19aa0
VirtualAddress 0x23000
SizeOfRawData 0x19c00
PointerToRawData 0x21c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.9023

.data

MD5 5b10e7917dd8d4cfd705e4942128a21a 🔍
SHA1 ff54f4e14f9bcac83d200c612e77a72ef43fb211 🔍
SHA256 d41681b454a4581c626d6767c4f9c5e8d1bf6bb1bfd23ea4152a5dbaea131cad 🔍
SHA3 a43af5c51463e468d087e0dcb3e71e59324a92d244e9d3058bdae2733bbac4af 🔍
VirtualSize 0x1ba0
VirtualAddress 0x3d000
SizeOfRawData 0xa00
PointerToRawData 0x3b800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.43068

.pdata

MD5 9e897605f41230dd9179871db70eec2d 🔍
SHA1 c207a56db54cdf798da0e6d0ac942b50ed0b9611 🔍
SHA256 eabff8a96bbf02e8c84d0e22d4537600cbfccc1d29d87562fa70dd473badaf4f 🔍
SHA3 83630cdfe6f94b8e4d242c8345ba78aaeec4ec4182575946048432bc6fdda99f 🔍
VirtualSize 0x1698
VirtualAddress 0x3f000
SizeOfRawData 0x1800
PointerToRawData 0x3c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.25077

.rsrc

MD5 da8458c448844d0b8a37592d95849a7a 🔍
SHA1 889fc30fa3e9c3d11f667e0ddfae17eac31eb18c 🔍
SHA256 a0a304ec7cbe68d6a0366adf17e73ab92e7d1404843c2b603e07aab378fdfe04 🔍
SHA3 b7f77a8ff5f674d2b778dfd361fba2bba9de8f3f058574b8d9d7928580eb5e0a 🔍
VirtualSize 0x2b0
VirtualAddress 0x41000
SizeOfRawData 0x400
PointerToRawData 0x3da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.0228

.reloc

MD5 8a5ac2d34d55f08adbde64d7587813f5 🔍
SHA1 c7fa13849018f638deb6b15b99b5e70a3402e765 🔍
SHA256 61ae72769205ac4516bdc8a3f7861523fe626b4196936efc2e60fa889932c11d 🔍
SHA3 b10e860fdaced7f8a8866ea3313954ce7ba4611dd3f6b8a1c7d2053ada7bff0a 🔍
VirtualSize 0x1a4
VirtualAddress 0x42000
SizeOfRawData 0x200
PointerToRawData 0x3de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.57322

Imports

KERNEL32.dll PeekNamedPipe
FindClose
CreateFileW
Sleep
GetLastError
CloseHandle
LocalFree
ConnectNamedPipe
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
FindNextFileA
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
ReadFile
CreateNamedPipeW
WriteFile
FindFirstFileA
GetCurrentProcessId
MSVCP140.dll _Strcoll
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Xtime_get_ticks
_Mtx_unlock
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
__crtLCMapStringA
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
_Mtx_lock
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
bcrypt.dll BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptExportKey
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGenerateKeyPair
BCryptDecrypt
BCryptFinalizeKeyPair
BCryptGetProperty
BCryptDestroyKey
BCryptImportKeyPair
CRYPT32.dll CryptStringToBinaryA
CryptBinaryToStringA
CryptImportPublicKeyInfoEx2
CryptDecodeObjectEx
WS2_32.dll WSAGetLastError
setsockopt
ioctlsocket
freeaddrinfo
htons
htonl
recv
connect
accept
bind
closesocket
select
listen
getaddrinfo
WSAStartup
send
socket
Secur32.dll InitializeSecurityContextW
DecryptMessage
FreeCredentialsHandle
AcquireCredentialsHandleW
QueryContextAttributesW
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll _CxxThrowException
__current_exception_context
__current_exception
memset
memmove
memcpy
memcmp
__C_specific_handler
__RTtypeid
strchr
__std_terminate
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll _fseeki64
fread
fsetpos
ungetc
fputc
setvbuf
fgetpos
fwrite
_set_fmode
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
fgetc
__stdio_common_vsprintf_s
__acrt_iob_func
fflush
__p__commode
_get_stream_buffer_pointers
fclose
api-ms-win-crt-heap-l1-1-0.dll malloc
free
_callnewh
realloc
_set_new_mode
api-ms-win-crt-utility-l1-1-0.dll srand
rand
api-ms-win-crt-time-l1-1-0.dll _localtime64_s
_time64
api-ms-win-crt-runtime-l1-1-0.dll __p___argv
_errno
_beginthreadex
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm_e
system
_set_app_type
_seh_filter_exe
_cexit
_exit
terminate
_initterm
__p___argc
abort
exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-string-l1-1-0.dll tolower
strlen
api-ms-win-crt-convert-l1-1-0.dll strtoull
atoi
strtol
strtoul
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
_lock_file
api-ms-win-crt-environment-l1-1-0.dll _dupenv_s
api-ms-win-crt-locale-l1-1-0.dll ___lc_collate_cp_func
___lc_locale_name_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x249
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.06044
MD5 f7e7c81035fc42015d50fadd75b9300f 🔍
SHA1 df759518191bad6608c336186b31c120b3dadb34 🔍
SHA256 72ae19a66b5d012088d762d3e2de6498a9b3b8fc153352ca6c76cf045d1fe96e 🔍
SHA3 1038ef4fa889f000231ecd6b7f2eb0759548ed2a8e5da6ca3e19b38062e60dbd 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Aug-02 19:42:17
Version 0.0
SizeofData 82
AddressOfRawData 0x37170
PointerToRawData 0x35d70
Referenced File C:\Users\AzraVeLucky\Desktop\Auth\Emu\x64\Release\Emu.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Aug-02 19:42:17
Version 0.0
SizeofData 20
AddressOfRawData 0x371c4
PointerToRawData 0x35dc4

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-02 19:42:17
Version 0.0
SizeofData 912
AddressOfRawData 0x371d8
PointerToRawData 0x35dd8

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Aug-02 19:42:17
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140037588
EndAddressOfRawData 0x140037590
AddressOfIndex 0x14003da70
AddressOfCallbacks 0x140023898
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003d040

RICH Header

XOR Key 0x32337245
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 22
C objects (35721) 10
C++ objects (35721) 33
ASM objects (35721) 6
Imports (35721) 6
Imports (33145) 11
Total imports 257
C++ objects (LTCG) (36252) 1
Resource objects (36252) 1
Linker (36252) 1

Errors

Leave a comment

No comments yet.