Manalyze report for b38ee072b592fc86bfa199f64048cd34aa3bfa503c40946e3dcae450c372aef5

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	1970-Jan-01 00:00:00
Debug artifacts	Embedded COFF debugging symbols

Plugin Output

Suspicious	PEiD Signature:	`HQR data file`
Info	Interesting strings found in the binary:	`Contains domain names: https://example.invalid`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Uses constants related to SHA256`
Suspicious	The PE is possibly packed.	`Unusual section name found: /4` `Unusual section name found: /19` `Unusual section name found: /32` `Unusual section name found: /46` `Unusual section name found: /65` `Unusual section name found: /78` `Unusual section name found: /90` `Unusual section name found: .symtab`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: LoadLibraryW LoadLibraryExW GetProcAddress` `Functions which can be used for anti-debugging purposes: SwitchToThread`
Info	The PE is digitally signed.	`Signer: Velmora Quanticryft` `Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1`
Malicious	VirusTotal score: 4/70 (Scanned on 2026-08-17 12:46:11)	`Elastic: malicious (moderate confidence)` `MaxSecure: Trojan.Malware.300983.susgen` `Microsoft: Program:Win32/Wacapew.C!ml` `huorong: Trojan/Loader.wi`

Hashes

MD5	`8c741bcd27a36dbbccedc39d485eae0b` 🔍
SHA1	`a10f22c3a8c9c3993cdb69b4285387d5bc23732e` 🔍
SHA256	`b38ee072b592fc86bfa199f64048cd34aa3bfa503c40946e3dcae450c372aef5` 🔍
SHA3	`debc3055a1ddefeed9c41e5a1515abdadd9a732f6cdc8e5baf4fc2566234d3e7` 🔍
SSDeep	`49152:KsObzRIhBiKQqZ2mbtFT52Q/FLWKuP3cXspaVIOwWlvV4wx+uQ3Lce2H:Hweb2Ylya/wWrx+noe2H` 🔍
Imports Hash	`4f2f006e2ecf7172ad368f8289dc96c1` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0x8b`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`15`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0x4d2200`
NumberOfSymbols	`4383`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`3.0`
SizeOfCode	`0x1bda00`
SizeOfInitializedData	`0x12400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000065AE0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.1`
ImageVersion	`1.0`
SubsystemVersion	`6.1`
Win32VersionValue	`0`
SizeOfImage	`0x562000`
SizeOfHeaders	`0x600`
Checksum	`0x505e59`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`8869ca16b60eb301b2a06d8d2d8a9ea6 🔍`
SHA1	`e5d288fc27ef5f69c6a914e3a90731d003890b5f 🔍`
SHA256	`34aef3b502c2d287f6c7f72ff436324a2d3e36e7cfa1744409f1cabf3bde6671 🔍`
SHA3	`199a0d71656a1c3f326a071f9e820cd10db15b147ba29f7a72e6bcbd88030cb9 🔍`
VirtualSize	`0x1bd9f5`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1bda00`
PointerToRawData	`0x600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.30846`

.rdata

MD5	`6415c33320af41666c8bc964c95a70f5 🔍`
SHA1	`42f075a526718c5c1ec24fa69f1d8fd9f9dcbcad 🔍`
SHA256	`9757f588360ab0db2383926bb17c3896e0896eda5166410fbeef570adbe7d6a1 🔍`
SHA3	`781c7272a1080583c1a36d5b40157476b84dfff8a8c0040813d719488cd0607c 🔍`
VirtualSize	`0x19bac8`
VirtualAddress	`0x1bf000`
SizeOfRawData	`0x19bc00`
PointerToRawData	`0x1be000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.06771`

.data

MD5	`74072ee548364a935e6c10d57f23f8ff 🔍`
SHA1	`c790d75adea8ca9f5d1d878ddcf496bbe5376808 🔍`
SHA256	`8adac4d399e4fbb803deb9b338c9b11a38f5552bc670f9d9b9b9e80fef0e9cae 🔍`
SHA3	`de1c586b5790bdbc6bbf9acd44a43d9276d2b0fc83eae1bd89a5aa8263d37952 🔍`
VirtualSize	`0x69b30`
VirtualAddress	`0x35b000`
SizeOfRawData	`0x12400`
PointerToRawData	`0x359c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.29196`

.pdata

MD5	`56094df970008303248e05f9c78e9e86 🔍`
SHA1	`67cb2f937a685ed2605ce70215e544f9a25e91b7 🔍`
SHA256	`de9069e9620436a95a1fd918d0a2361b4f2eaf084604661ad328e03730c807db 🔍`
SHA3	`7cb9c67456cc4381821347fc7f96c3624924572911d9192a9ef47034467820b0 🔍`
VirtualSize	`0x846c`
VirtualAddress	`0x3c5000`
SizeOfRawData	`0x8600`
PointerToRawData	`0x36c000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.32312`

.xdata

MD5	`2b77345b7ea35b020b2da785e8783f33 🔍`
SHA1	`3db6993ea1618c6674fd7936cd29d355aba9568c 🔍`
SHA256	`e944f576db3a53efd28431bb7c9b5211df7c9af2a5336abac0e19b40ceab7fac 🔍`
SHA3	`216beea5fd41962f85fa3433e0c10c20037aea6f6fdd174eebd1c676127fcec6 🔍`
VirtualSize	`0x9c`
VirtualAddress	`0x3ce000`
SizeOfRawData	`0x200`
PointerToRawData	`0x374600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.53692`

/4

MD5	`17f62672c8506464ae13eccc2eb6cb94 🔍`
SHA1	`65d9dc4d3d6c051bd184fe655ee41925f867957c 🔍`
SHA256	`1a10e5433f8443dbc22881c2c0dff8772c75b2382304652b801b3f67b6693306 🔍`
SHA3	`45e64e05e8d2850a83d419611c4945ca99645fecf96647c4b0f0b602bff5c6b3 🔍`
VirtualSize	`0x129`
VirtualAddress	`0x3cf000`
SizeOfRawData	`0x200`
PointerToRawData	`0x374800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.08195`

/19

MD5	`2e30d048704f1d926659428b51bbf6f2 🔍`
SHA1	`25135510c3c7ad91c95a19a37613e3ffbbdcf299 🔍`
SHA256	`6c05c9cd04b4c60e0d19fedd209e34fc404903ccf7efe3f41afcc432db363a2c 🔍`
SHA3	`034c23c060d340efb56f7af7a923ff1818f13e1afbd2ff08cd150d9805a12a58 🔍`
VirtualSize	`0x3fb68`
VirtualAddress	`0x3d0000`
SizeOfRawData	`0x3fc00`
PointerToRawData	`0x374a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99598`

/32

MD5	`7cc6cd55751509bef05a632cc441537e 🔍`
SHA1	`195674039f73868457b115c67f8e541e4a91fc82 🔍`
SHA256	`4d9b4afddeb4cba0b3ffde4be3f5516a54a244b47c467c85decfba831aa5c31a 🔍`
SHA3	`c6462c7b48c87ae864e5d32f8dcb156f117c7cb4793e6e479b1f9cd5b6936061 🔍`
VirtualSize	`0xd4d0`
VirtualAddress	`0x410000`
SizeOfRawData	`0xd600`
PointerToRawData	`0x3b4600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.93076`

/46

MD5	`87b999fb861257d2ce3244b153dfddd2 🔍`
SHA1	`cf906bd9e3fd82896b29318558baddfc587cd5d7 🔍`
SHA256	`80d2d1ca391bcc3fd9cdf1cec5822cf4e9daf422c91060e5381bd230e377c75d 🔍`
SHA3	`1caa8e2b08d2e60327565ec995b93c789b1b72358580fa5c1c3df5bb767abf59 🔍`
VirtualSize	`0x18`
VirtualAddress	`0x41e000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3c1c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.440284`

/65

MD5	`a31707ca3ae5ba3bfe8a280229e52d7e 🔍`
SHA1	`4dc68c5f54ad119795fce30c926c8088c7bdf253 🔍`
SHA256	`4b4e6194a6497cc780004fa2988d50463fda4d57891eae8f31e49dbc1a2db932 🔍`
SHA3	`8b1d8e478a615c6a82ff6b482ccacd7929764402f42497a7f3e75b40ba3a3105 🔍`
VirtualSize	`0x83f43`
VirtualAddress	`0x41f000`
SizeOfRawData	`0x84000`
PointerToRawData	`0x3c1e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99791`

/78

MD5	`464ab5736609e67de82ffa77c7d2aada 🔍`
SHA1	`a8412faaa7bf2c47b28a50f407ac2123b241b22e 🔍`
SHA256	`8bf0e7f1745edd41f1b4f95107ef748d42aa7a79025349aaebfde5eb5668cfa9 🔍`
SHA3	`909f23dacc85c4f947e83ec8d054807c6d3ef3564be836828a7631be694a6abf 🔍`
VirtualSize	`0x638d2`
VirtualAddress	`0x4a3000`
SizeOfRawData	`0x63a00`
PointerToRawData	`0x445e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99485`

/90

MD5	`f4de5ef57fde48ab2bb823ef79f7c860 🔍`
SHA1	`fd402c3e875f72ed745924ea019345ef3dc3f8d1 🔍`
SHA256	`252a9e9e7b0bb643b51ab5d0e18a366d3e466ebca84e4985a3c3415d8f7b0b6f 🔍`
SHA3	`f5411d0a14197913ca4e728af57f666e834e8d289ff142e196460bd18f6f8272 🔍`
VirtualSize	`0x23016`
VirtualAddress	`0x507000`
SizeOfRawData	`0x23200`
PointerToRawData	`0x4a9800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.83116`

.idata

MD5	`885dbc945242441dac9bd75985abd5ae 🔍`
SHA1	`81350fdda0c2c6d3536d4b6611b5afafd15a8629 🔍`
SHA256	`b085071d82fa46f165ff7455eff33d13091067dcb4915a0de77ae108fcb09ba7 🔍`
SHA3	`85648988ec3581d98bfc2c6190355533160f830697f9f2e8d7b7e54d34b77164 🔍`
VirtualSize	`0x516`
VirtualAddress	`0x52b000`
SizeOfRawData	`0x600`
PointerToRawData	`0x4cca00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.90538`

.reloc

MD5	`ff61d22ede3635000ab8dbf5e9cb17ef 🔍`
SHA1	`438432955233e76e0694b848910fe3824809ca2d 🔍`
SHA256	`d028f72e53acd88440a5bd1041de68563440ddc13a189cfc161260c96abb462c 🔍`
SHA3	`6a8adc425d21acde19fdd38e182fc028f2eb975d11269f5be61b36ce5fe208b8 🔍`
VirtualSize	`0x51a0`
VirtualAddress	`0x52c000`
SizeOfRawData	`0x5200`
PointerToRawData	`0x4cd000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.43275`

.symtab

MD5	`2d2b0dddbc863cccd8ccdaad37438f77 🔍`
SHA1	`78aa5c6f78067077b181a18a097c9204012cf750 🔍`
SHA256	`d582e4822f5c66e4d0bd894a71a2299e48689bb5ada570dda4d0145aea31d56e 🔍`
SHA3	`8cfe4edb380cc2f761721d823c1a836ba780622358c0e866d41809bdb0ef8da8 🔍`
VirtualSize	`0x2f68b`
VirtualAddress	`0x532000`
SizeOfRawData	`0x2f800`
PointerToRawData	`0x4d2200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.1516`

Imports

kernel32.dll	`WriteFile` `WriteConsoleW` `WerSetFlags` `WerGetFlags` `WaitForMultipleObjects` `WaitForSingleObject` `VirtualQuery` `VirtualFree` `VirtualAlloc` `TlsAlloc` `SwitchToThread` `SuspendThread` `SetWaitableTimer` `SetUnhandledExceptionFilter` `SetProcessPriorityBoost` `SetEvent` `SetErrorMode` `SetConsoleCtrlHandler` `ResumeThread` `RaiseFailFastException` `PostQueuedCompletionStatus` `LoadLibraryW` `LoadLibraryExW` `SetThreadContext` `GetThreadContext` `GetSystemInfo` `GetSystemDirectoryA` `GetStdHandle` `GetQueuedCompletionStatusEx` `GetProcessAffinityMask` `GetProcAddress` `GetErrorMode` `GetEnvironmentStringsW` `GetCurrentThreadId` `GetConsoleMode` `FreeEnvironmentStringsW` `ExitProcess` `DuplicateHandle` `CreateWaitableTimerExW` `CreateThread` `CreateIoCompletionPort` `CreateFileA` `CreateEventA` `CloseHandle` `AddVectoredExceptionHandler`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Tried to read outside the COFF string table to get the name of section /19!
[*] Warning: Tried to read outside the COFF string table to get the name of section /32!
[*] Warning: Tried to read outside the COFF string table to get the name of section /46!
[*] Warning: Tried to read outside the COFF string table to get the name of section /65!
[*] Warning: Tried to read outside the COFF string table to get the name of section /78!
[*] Warning: Tried to read outside the COFF string table to get the name of section /90!

Leave a comment

No comments yet.