ba06e9cae6710343b75550e8cf104e8e62f315acbe86903e7fc9d54b5203fd83
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jun-18 09:46:29 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | The PE is packed with mpress |
Unusual section name found: .MPRESS1
Section .MPRESS1 is both writable and executable. Unusual section name found: .MPRESS2 Section .MPRESS2 is both writable and executable. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Can access the registry:
|
| Malicious | VirusTotal score: 46/71 (Scanned on 2026-08-13 03:33:26) |
ALYac:
Gen:Variant.Application.Zusy.313558
APEX: Malicious AVG: Win32:Evo-gen [Trj] Antiy-AVL: Trojan[Backdoor]/Win32.Remcos Arcabit: Trojan.Application.Zusy.D4C8D6 Avast: Win32:Evo-gen [Trj] Avira: BDS/Backdoor.Gen BitDefender: Gen:Variant.Application.Zusy.313558 Bkav: W32.Malware.B4731E90 CTX: exe.unknown.zusy CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: BackDoor.Remcos.699 ESET-NOD32: Win32/Rescoms.N trojan Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Application.Zusy.313558 (B) F-Secure: Backdoor.BDS/Backdoor.Gen Fortinet: W32/Remcos.M!tr GData: Gen:Variant.Application.Zusy.313558 Google: Detected Ikarus: Backdoor.Remcos Jiangmin: Backdoor.Remcos.dun K7AntiVirus: Backdoor ( 005cecdb1 ) K7GW: Backdoor ( 005cecdb1 ) Kaspersky: HEUR:Backdoor.Win32.Remcos.gen Malwarebytes: Malware.AI.4043026237 MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!51848F76857C MicroWorld-eScan: Gen:Variant.Application.Zusy.313558 Microsoft: Trojan:Win32/Remcos!MTB Rising: Backdoor.Remcos!8.B89E (TFE:5:25sQ9hsRNtH) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: Troj/Remcos-AST Symantec: ML.Attribute.HighConfidence Tencent: Trojan.Win32.Remcos.16001234 Trapmine: malicious.high.ml.score VBA32: BScope.Backdoor.RmRAT VIPRE: Gen:Variant.Application.Zusy.313558 Varist: W32/Rescoms.Q.gen!Eldorado VirIT: Trojan.Win32.Genus.ZLW ZoneAlarm: Troj/Remcos-AST huorong: HEUR:Backdoor/Remcos.ae tehtris: Generic.Malware |
Hashes
| MD5 | 51848f76857ccb14eaed0d5562287377 🔍 |
|---|---|
| SHA1 | edbb99a664cfa1d5673e03c1f0bfc0f1d1ed6dcc 🔍 |
| SHA256 | ba06e9cae6710343b75550e8cf104e8e62f315acbe86903e7fc9d54b5203fd83 🔍 |
| SHA3 | 5a42b3f9f25834c13aef9e320ebed2e49429622710fdbada9e9a41314122ff26 🔍 |
| SSDeep | 3072:R2AFG7H0VVq7kAXidB83OJIwj4/5tl8tqLpg9GprVp/uF3elACqcLvIoIII:R5G7HCVlAXiMX/qtqC9GJVphhD 🔍 |
| Imports Hash | 8e9e0e7f658c52b6279f5fd2a5623b2e 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x40 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x2 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0xb400 |
| e_oeminfo | 0xcd09 |
| e_lfanew | 0x40 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2026-Jun-18 09:46:29 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x53400 |
| SizeOfInitializedData | 0x1fc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00082241 (Section: .MPRESS2) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x55000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x88000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x7000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.MPRESS1
| MD5 | ad6e14c05b68c70a5ca8210ecbd000b0 🔍 |
|---|---|
| SHA1 | 414c1f4fc8117e90c735564c934a2c71068f81f9 🔍 |
| SHA256 | b99582c1c41cd39e54caba0b10a9dca0865413b7cbf9d44db4eaa47414fa5bc7 🔍 |
| SHA3 | 570b0c2a721c4ecd1ae09fac17daa6a66ab59469eb0720b5ae2b03e9280b3e7a 🔍 |
| VirtualSize | 0x81000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x2f400 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.9991 |
.MPRESS2
| MD5 | c9c95eea1bfa1a1ad613ce6224e168ff 🔍 |
|---|---|
| SHA1 | 44ef0a9b69d8a41dc94c8c5864484b5a57ba133f 🔍 |
| SHA256 | 7209b469e4e8a903ccc69f3c8547cb30d9feb1c50d1d7ee4d780f12ff5e420b3 🔍 |
| SHA3 | a3e547b36dcdbcfbbb080a28a740cd242b8abb403c1d1e806e4ca5909bc91233 🔍 |
| VirtualSize | 0xdd0 |
| VirtualAddress | 0x82000 |
| SizeOfRawData | 0xe00 |
| PointerToRawData | 0x2f600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.95974 |
.rsrc
| MD5 | 79db22a3c14135c55024b54866411fd7 🔍 |
|---|---|
| SHA1 | 679e4891d9caf9e496858e929ebfd45940277a57 🔍 |
| SHA256 | 2db5459f467c9a6e7eeada4333ed20ab3caa38b7651564e65a7167eb6181b55c 🔍 |
| SHA3 | 819f0124a4ecd09afcbf471cef72889c5520f777b238da2bf9041205feb2b05a 🔍 |
| VirtualSize | 0x460c |
| VirtualAddress | 0x83000 |
| SizeOfRawData | 0x4800 |
| PointerToRawData | 0x30400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.40748 |
Imports
| KERNEL32.DLL |
GetModuleHandleA
GetProcAddress |
|---|---|
| USER32.dll |
DrawIcon
|
| GDI32.dll |
BitBlt
|
| ADVAPI32.dll |
RegCloseKey
|
| SHELL32.dll |
ExtractIconA
|
| WINMM.dll |
PlaySoundW
|
| WS2_32.dll |
WSAStartup
|
| urlmon.dll |
URLDownloadToFileW
|
| gdiplus.dll |
GdipFree
|
| WININET.dll |
InternetOpenW
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.38988 |
| MD5 | 6eec42acd08bf787da39b691471b6254 🔍 |
| SHA1 | 55a76be098ab76c0f3e2134e7ce7fdaea318fc46 🔍 |
| SHA256 | d8e086b038111b0d2ec2a284aa7464147507bbe42bf20905205482bb6b448fb4 🔍 |
| SHA3 | 909f7450f3d9e444c22eeb596ed0cb7e16b3c088fc1939036f4840e78289d642 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.25192 |
| MD5 | 66f67de06f53b387de72d7419b257dd4 🔍 |
| SHA1 | 0b4a680a9ff94d0fff9a538af1bece92dec547d7 🔍 |
| SHA256 | 5655775933efda1e38ae00f0b8f85f60955669ef9bec207ebb979ecc2cecbea4 🔍 |
| SHA3 | fc52bafc726e52f78f7a2b6dd47475100794af73ccdacad1fc7d429d6eceeb0b 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.13574 |
| MD5 | 65081b1d17440ed59e9e8054927a0912 🔍 |
| SHA1 | 2b6c852e7a922d4000b3fddaa4ee82a4218a0b2e 🔍 |
| SHA256 | 5dd7bade4b5e9a2ddaa8dac9a1288d26c5f61c2aaa1abc1fbbbd7b970494855f 🔍 |
| SHA3 | acc94240f9c441da72110f5854e3c00af31adadde16b64905d8f573a4fe2ec0f 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.3891 |
| MD5 | 3bab1ff36e4049db3035358ecf00dc5b 🔍 |
| SHA1 | 1a30c0c0feba1b9ef5e808be8cde57f395e577cb 🔍 |
| SHA256 | 12b3cf109f2818be4874ec08d906cd6c25b76a1ded8b026045e45f5ca690de91 🔍 |
| SHA3 | 296faac85c1deeb958ec4db0be4282c5bc0c4070b88e2c5f20c111683ba65837 🔍 |
SETTINGS
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x4a6 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
123
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x3e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.62308 |
| Detected Filetype | Icon file |
| MD5 | 1867677010a8b98518bbad5053c9f3fb 🔍 |
| SHA1 | c4d90dd338b5979f1a2169d51e745fe40c46c082 🔍 |
| SHA256 | ad4a5aad6219f3a1fce97f7b45e787ca6947e9af37c4ee39698934208aeffa45 🔍 |
| SHA3 | ec26aaf4edf47dc5260ae3a572008e5c42369b759cb3b88213411d67399ee6a9 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[!] Error: Could not reach the TLS callback table.
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource SETTINGS is empty!
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource SETTINGS is bigger than the PE. Not trying to load it in memory.
Leave a comment
No comments yet.