c08a087944ccd170403a9b6bd6a07478d27e5e2a5eb8cda249b29667fc9662b9
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1999-Oct-06 10:33:39 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | PEiD Signature: | UPX -> www.upx.sourceforge.net |
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to SHA1 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .Shared |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
6255445 bytes of data starting at offset 0x1e00.
The overlay data has an entropy of 7.99861 and is possibly compressed or encrypted. Overlay data amounts for 99.8774% of the executable. |
| Suspicious | VirusTotal score: 2/66 (Scanned on 2026-06-04 01:55:10) |
ClamAV:
Win.Trojan.Ramnit-6735
VBA32: Backdoor.Agent |
Hashes
| MD5 | 209430d7ac3757035ac95d63a005ea7a 🔍 |
|---|---|
| SHA1 | 8b73e306423fcecb194beef1fb2a76a349b04cde 🔍 |
| SHA256 | c08a087944ccd170403a9b6bd6a07478d27e5e2a5eb8cda249b29667fc9662b9 🔍 |
| SHA3 | 5fe244ee0c0ff8d03be7688a6189cc106e8e7d2fc86a7f5bfbd66aab3f05c565 🔍 |
| SSDeep | 98304:MAOAmWEmglO/yIVMEbRWUKWOEVfN81PD7Cqmv/yzEVN/+XD/5XWIyVDLe08GBhqu:XmXmYkL5k5EVq1r7NmyoVN/+z/RjyhLh 🔍 |
| Imports Hash | a3cd138f09c17f81fb64526d63cb2df6 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 1999-Oct-06 10:33:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 3.0 |
| SizeOfCode | 0xa00 |
| SizeOfInitializedData | 0x1200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001020 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x8000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 2ea0c6f50f14cfbaa8db5da67b0f984b 🔍 |
|---|---|
| SHA1 | d060ec3a36d8affebaf0abadbeaa9b5d7c3b9a06 🔍 |
| SHA256 | 525bf6bb03c2af992f58fb3320aaf7b0f1fbe8891cb76f7675f9a27a2920b78c 🔍 |
| SHA3 | 677faf096b96ceb3c16c744bea62300c6e09cddc19b994b3d4b5293b0941b062 🔍 |
| VirtualSize | 0x9f8 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.27597 |
.rdata
| MD5 | 91b133ee1f288e129ea95f099dfb3264 🔍 |
|---|---|
| SHA1 | 2341fa690c881af79023ff57b52bcbed6f0dc5bb 🔍 |
| SHA256 | c98e9f529894e0881b8935cea17cf284d617937cf6cc2c119f91045820030953 🔍 |
| SHA3 | c29069c8a1ea7a156d6bf17611ab5660f168b0729e1eac7e9226cb4fa356fe8b 🔍 |
| VirtualSize | 0x4 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xe00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.0407808 |
.data
| MD5 | 5abea60fe3607168be501eccd9bbc6d5 🔍 |
|---|---|
| SHA1 | 700b953b237f601d3ce21ccf526940b8a714b234 🔍 |
| SHA256 | 586903877bea8310de04b67b05463fdffb7cb522a6601a2d7ced24e92ec165d2 🔍 |
| SHA3 | 13c6ab2386d4991f9c7b37e2e0d84ed45000a0c64dc8fc01722357983c7f5d23 🔍 |
| VirtualSize | 0x25c |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.07382 |
.idata
| MD5 | a4f4378b9fed81ce4f452ae32eb5dea3 🔍 |
|---|---|
| SHA1 | 12cb76c098a353dfd7231be5a98ab506aafb7ae5 🔍 |
| SHA256 | 54d660635d7ddd77fb28b35e268c0fd067c6bb5a9f42c7102e5b57266068c58f 🔍 |
| SHA3 | a5a62514103815516aa40ed25f53669d0154cb404b566e2f47330f2a9f3075ec 🔍 |
| VirtualSize | 0x2fe |
| VirtualAddress | 0x4000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x1200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.83057 |
.Shared
| MD5 | 1d7d80e8b5ce8c86e7c833467964b6ae 🔍 |
|---|---|
| SHA1 | 88aa1601feff36c623fb15fca9cf29af496ec9b2 🔍 |
| SHA256 | eac0bc584b30b30f3172f645fd2103caa322244e85a3ec4fb1c345f0c4314c94 🔍 |
| SHA3 | a8483a22d7281a11677adbc110fa0c305d06a1ff41bfda4e197443b8b6a3b8e5 🔍 |
| VirtualSize | 0x4 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.0659144 |
.rsrc
| MD5 | 80c4f89422b96aaaf7393ba3265f98a0 🔍 |
|---|---|
| SHA1 | dbc820514899561213ddc21679d67a30dd91dd79 🔍 |
| SHA256 | 13ab56f0c51d53dcc0fc09f9090fc34e50db7797dca09fde278e0d1b2d4e3c5f 🔍 |
| SHA3 | fe4babf7aa9e9d09db897fb082d5422483d7ea6dbffb4a61e5a6305e7f03f6ff 🔍 |
| VirtualSize | 0x39c |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x1800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.189 |
.reloc
| MD5 | f328cf02fdc3d50b64ad99fa4befe97f 🔍 |
|---|---|
| SHA1 | f4fd015008265f5c23127d9ae63fd0ff919f3dfa 🔍 |
| SHA256 | 5746640fa5d9925fb4fb7c96673c1fc598f9e5caf72f8f939cd613271e66ddd4 🔍 |
| SHA3 | 1301566b7610c274db7ea3c04f51e54f552931bccdfd5a4cde8006a9293ce038 🔍 |
| VirtualSize | 0x1b2 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.36734 |
Imports
| KERNEL32.dll |
GetTempPathA
ExitProcess DeleteFileA FreeLibrary lstrcpyA GetProcAddress LoadLibraryA VirtualFree CloseHandle WriteFile GetWindowsDirectoryA CreateFileA lstrcatA CompareStringA GetCurrentDirectoryA lstrlenA ReadFile SetFilePointer VirtualAlloc GetModuleFileNameA InterlockedIncrement GetModuleHandleA |
|---|---|
| USER32.dll |
SetCursor
LoadCursorA wsprintfA ShowWindow FindWindowA MessageBoxA |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 1999-Oct-06 10:33:37 |
| Entropy | 3.38813 |
| MD5 | 75b8f280099989aed1268970665c5956 🔍 |
| SHA1 | ad9842bb042fdb550dfa62339cd83946e67ffda4 🔍 |
| SHA256 | 61e56631a8733b2353bdfd80605df2669fc3fd5de620bb8c4a1b49d7fd748cea 🔍 |
| SHA3 | 109c43cc2fcd590e27e97e67b9fcd5f64856a2603f4f81251dcb64b22a3cb0a5 🔍 |
101
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1999-Oct-06 10:33:37 |
| Entropy | 2.16096 |
| Detected Filetype | Icon file |
| MD5 | 42cf62b780813706e75fb9f2b2e8c258 🔍 |
| SHA1 | a022d5c1cfdd8aace0089f3e72f2eedd41bda464 🔍 |
| SHA256 | a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf 🔍 |
| SHA3 | 0aafc8e3d8b6bde595537da4ffe0efc5fe53f01dafe336a2a5828b6a71283d3c 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.