b1a619a6f1ee2e8eb0ca3cca2d6af1408fe3d6d2353f58e2ec8ec0875286ea7c

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Nov-01 19:42:18
Detected languages English - United States

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .%Dc
Unusual section name found: .xXt
Unusual section name found: .Pz;
Suspicious The PE contains functions most legitimate programs don't use. Possibly launches other programs:
  • ShellExecuteW
 Has Internet access capabilities:
  • InternetOpenUrlA
  • WinHttpConnect
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 25/71 (Scanned on 2026-11-06 20:43:54) APEX: Malicious
Bkav: W32.Malware.702D3E11
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.VMProtect.AK suspicious application
Elastic: malicious (high confidence)
Fortinet: Riskware/Application
GData: Win64.Application.Agent.YJSZ5K
Google: Detected
Gridinsoft: Trojan.Heur!.02212023
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.Heuristic.2108
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!AA8E01E987DF
Microsoft: Trojan:Win32/Wacatac.C!ml
Paloalto: generic.ml
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score
TrellixENS: Artemis!AA8E01E987DF
Varist: W64/ABTrojan.ZXRJ-3814
alibabacloud: VirTool:Win/Wacatac.C9nj

Hashes

MD5 aa8e01e987df779e95ad7260a178b49c 🔍
SHA1 10c478049f3eb08e6254e6b12c3113af6199d61a 🔍
SHA256 b1a619a6f1ee2e8eb0ca3cca2d6af1408fe3d6d2353f58e2ec8ec0875286ea7c 🔍
SHA3 eb3690c5cd8efcebfa85a944a105d550a47c8b379fcfa6a3bd6fd238a1e1b902 🔍
SSDeep 196608:86WCfYj2eLxRelbZCPkQr1b9LgCHUOEn3EYgUvm:8Wot9Rwed9LV0OEU3U+ 🔍
Imports Hash 968aad8aafd29864afc04235b88c0deb 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Nov-01 19:42:18
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xc4800
SizeOfInitializedData 0x143000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000910C25 (Section: .Pz;)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xe3b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xc4610
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x13863c
VirtualAddress 0xc6000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x35f0
VirtualAddress 0x1ff000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x6b88
VirtualAddress 0x203000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.%Dc

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x4eaae5
VirtualAddress 0x20a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xXt

MD5 6649450982f5b79dc7b74104396e6de3 🔍
SHA1 19a796ce053a9915584932689bc424cf315d7e71 🔍
SHA256 8d0a9fb250b8771b94e6d3d3af14a21f8da919a0889ac876f4f38d683de8ad9a 🔍
SHA3 6aebd29d4988c92dcce46d36b89c90aa77f6d2abac741ed042be45b47b5f2af8 🔍
VirtualSize 0x2370
VirtualAddress 0x6f5000
SizeOfRawData 0x2400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.124032

.Pz;

MD5 e602315d2bb736fc783700e0aed10d2b 🔍
SHA1 7a90c8198189eefcd82cd8335ff77cdf8af3fda0 🔍
SHA256 88e5356030dce6e695307db9a778d7b310677c982ce77e6cc637b037e470edc4 🔍
SHA3 90fa31640097fea10af2d8256b4aae9757209e71b7b9ae14d61cd4b101b53eac 🔍
VirtualSize 0x741928
VirtualAddress 0x6f8000
SizeOfRawData 0x741a00
PointerToRawData 0x2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.98064

.rsrc

MD5 8098aaae32841bec2a6a35b4a76200a8 🔍
SHA1 77b0e8e8d2b93d41b86df5d8e19925738f85a03a 🔍
SHA256 a5654680115f9fe91d54c11ffc88178b8411b6df12530eb1c7c5a3d335a900eb 🔍
SHA3 3408dab0ed8e61cfd29a4fef6fca02cf3cc9d2f4da1a570617a8d9f61abf2666 🔍
VirtualSize 0x1e0
VirtualAddress 0xe3a000
SizeOfRawData 0x200
PointerToRawData 0x744200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.77204

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
ole32.dll CoCreateInstance
USER32.dll PeekMessageW
GDI32.dll CreateRoundRectRgn
SHELL32.dll ShellExecuteW
WININET.dll InternetOpenUrlA
ntdll.dll RtlLookupFunctionEntry
ADVAPI32.dll LookupPrivilegeValueW
WS2_32.dll ntohl
KERNEL32.dll LoadLibraryA
OLEAUT32.dll SysAllocString
MSVCP140.dll _Thrd_detach
WINHTTP.dll WinHttpConnect
bcrypt.dll BCryptDecrypt
IMM32.dll ImmReleaseContext
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memcpy
api-ms-win-crt-runtime-l1-1-0.dll __p___argv
api-ms-win-crt-string-l1-1-0.dll _stricmp
api-ms-win-crt-heap-l1-1-0.dll malloc
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
api-ms-win-crt-convert-l1-1-0.dll strtoll
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-math-l1-1-0.dll sinf
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1401ff040

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .%Dc has a size of 0!
Leave a comment

No comments yet.