c1a078eb364405476c8444a94c16b2a72fd6df4d67adc221d210fdd5e3ca7582
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Feb-01 20:22:18 |
Plugin Output
| Info | Matching compiler(s): | MASM/TASM - sig2(h) |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource 61873B2820B66822E72E23022C1C1A00 is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 36/70 (Scanned on 2026-11-09 10:59:19) |
AVG:
PwrSh:Mayhem-A [Trj]
AhnLab-V3: Trojan/Win32.Agent.R259682 Antiy-AVL: Trojan/Win32.Agent Avast: PwrSh:Mayhem-A [Trj] Avira: TR/Mayhem.A CrowdStrike: win/malicious_confidence_70% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DrWeb: Trojan.MulDrop28.60980 ESET-NOD32: PowerShell/KillMBR.B trojan Elastic: malicious (high confidence) F-Secure: Trojan.TR/Mayhem.A Fortinet: W32/Agent.MAZDI!tr Google: Detected Gridinsoft: Trojan.Win32.Agent.vb!s1 Jiangmin: RiskTool.Generic.kkp K7AntiVirus: Trojan ( 005d9b921 ) K7GW: Trojan ( 005d9b921 ) Malwarebytes: Malware.AI.4231750508 McAfeeD: ti!C1A078EB3644 Microsoft: Program:Win32/Wacapew.C!ml NANO-Antivirus: Trojan.Win32.Scrop.eytdxi Rising: Trojan.Kryptik!8.8 (TFE:5:lMYerF3OYHJ) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Infected.ch Sophos: Generic ML PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score VBA32: Trojan.Agent Varist: W32/Trojan.MNUQ-5487 VirIT: Trojan.Win32.Genus.XWT Webroot: W32.Malware.Gen Yandex: Trojan.GenAsa!xeYOOG2tugU Zillya: Trojan.Shelma.Win32.1656 huorong: Trojan/KillMBR.bx |
Hashes
| MD5 | 480cda031f250fef0e1a908c6bf3e710 🔍 |
|---|---|
| SHA1 | 40ddb2f56cc3941a8191b2aef3a7d2b5064979ae 🔍 |
| SHA256 | c1a078eb364405476c8444a94c16b2a72fd6df4d67adc221d210fdd5e3ca7582 🔍 |
| SHA3 | 4e522186772d66fa7f5fda0c7c88aac5967af777928f9b324d60557f882d9005 🔍 |
| SSDeep | 3072:QwqhFkv93CSk5DJkXTSNTBfkT9pCHct6aoZP:QOv9DkXyeNTB8T9pCHcsaoJ 🔍 |
| Imports Hash | 2adb28da7b9fece4b360fc7188d2f05c 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2018-Feb-01 20:22:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xfe00 |
| SizeOfInitializedData | 0xb000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x12000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
| MD5 | b729b25a916638015e2caaa79da47f5d 🔍 |
|---|---|
| SHA1 | 444fda36e2ea77a77ad347403b6289b943699d0a 🔍 |
| SHA256 | 5c623154a52940c24002446e3abc7a4112947dd195de0f4eac32b40af3531ed7 🔍 |
| SHA3 | 9f9743f130b704a9daf48b830211f586634af3f1c1b0c2caf14dd48bfdf90060 🔍 |
| VirtualSize | 0x3018 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x3200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.51797 |
.text
| MD5 | 1fa7311f693f1815cedfcd8d90089d6e 🔍 |
|---|---|
| SHA1 | 4d178fb5b957aeed89734127977582d3d8e26ea9 🔍 |
| SHA256 | 0afcafe9cbb93806cdca177e6ed458822d78f3e4d52a43efce303e6f1231e7d0 🔍 |
| SHA3 | 2def0924d98ce9bfff8ffa43fbd4ab122340e3902fa7d8692a7a8afa5b894b75 🔍 |
| VirtualSize | 0xcaa2 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0xcc00 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.58019 |
.rdata
| MD5 | 6784f513fac4815ca52b2a1098c59370 🔍 |
|---|---|
| SHA1 | 3aef23f6fc51062b5d1ded994c194b02300ac51f 🔍 |
| SHA256 | c921d0b441a0daec25616a445930b1a356217220055d11969409024c45cf3182 🔍 |
| SHA3 | 8f3c70a202ef020a7abb7742bc9cfcbf61399a4aa0371e29c5a1e6b74679adad 🔍 |
| VirtualSize | 0x33a0 |
| VirtualAddress | 0x12000 |
| SizeOfRawData | 0x3400 |
| PointerToRawData | 0x10200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.109 |
.data
| MD5 | e71cc80ea3bb18f582de381480c4831a 🔍 |
|---|---|
| SHA1 | 738354cb061cfac47666ac50c0efb03b8545b5f5 🔍 |
| SHA256 | dccd5aa4452345f21b3e962a3c40b8e1d608ef6d6a6a3f87d014cb026a9cc44b 🔍 |
| SHA3 | b968fc4b96074c222cc579de2d2c458d5ef6dd21e4fa4b7ee7e68e29187e0811 🔍 |
| VirtualSize | 0x16c4 |
| VirtualAddress | 0x16000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x13600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.28685 |
.rsrc
| MD5 | a4d19450d63c1c14700eba212f0d6bc6 🔍 |
|---|---|
| SHA1 | 4857c210b1190d7d42589d84bba7ba47c90dce6c 🔍 |
| SHA256 | fad510731bab4695784162638351c55085c7ef49ea1cf61fe12105e0bcd21175 🔍 |
| SHA3 | ae38d6a7c56d985b28f7d5b61d0f075b059c4f726ca85b1121b112196b674a99 🔍 |
| VirtualSize | 0x6b4c |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x6c00 |
| PointerToRawData | 0x14600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.29565 |
Imports
| MSVCRT.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc free |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetTempFileNameW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW SendMessageW PostMessageW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathQuoteSpacesW
PathAddBackslashW PathRemoveBackslashW PathRemoveArgsW PathRenameExtensionW |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.13487 |
| MD5 | 57c473d0e2a0fed02a495dba6521641c 🔍 |
| SHA1 | 4c7331cf9f0886e966f5df7e9bd993d6c947e81a 🔍 |
| SHA256 | 8a69b1f49015b3e1e303ecc4848dd8d412767cc00b7dcf2f93d483f037f12651 🔍 |
| SHA3 | be9ff962c1a57717a808031dfc7d448e514ab4f5cd51ccf5c321488ce8b7c626 🔍 |
34AFBBCAC533FC81979DE53A1EB47BE4548DD1AE
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x6 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.58496 |
| MD5 | 155eced85724e500f7a19ea520980196 🔍 |
| SHA1 | a303f8c0954ad737dd7b1ef40cb24b0286c567db 🔍 |
| SHA256 | 2825b5b59b2f0f4a2afc5df409c5deb92b8b1ce0048b43fa1a20e349d33349b9 🔍 |
| SHA3 | 400d64a4a44c131ea212e0239e2c9e5ad464cb2a57dee2e2e8c4b3becf1b27d5 🔍 |
61873B2820B66822E72E23022C1C1A00
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x4028 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99023 |
| MD5 | 7aa02a687500b68bfaaf5f53f7f07c0f 🔍 |
| SHA1 | a0412e4397919834540cd5354593214ebbf292b1 🔍 |
| SHA256 | 874eb5b5888eb78a5acc794c455268493cc24638e4ccc0426fa4640dcdd239a8 🔍 |
| SHA3 | 520764349e72e5145bc55ffc6cf355a017e85ba333c510c32dff18fd25a5af36 🔍 |
A464D7F4A57B9849752C71EC5AF2A5AD
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xe |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.23593 |
| MD5 | 7bb55e591962edd967c9a3039407256c 🔍 |
| SHA1 | e84642313805d66ef70fdada202992d040a1c2cc 🔍 |
| SHA256 | 8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91 🔍 |
| SHA3 | 116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91 🔍 |
B7A605BA0E
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | 55a54008ad1ba589aa210d2629c1df41 🔍 |
| SHA1 | bf8b4530d8d246dd74ac53a13471bba17941dff7 🔍 |
| SHA256 | 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a 🔍 |
| SHA3 | 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.91924 |
| Detected Filetype | Icon file |
| MD5 | 6da8e7d5ae1d5d15e0230a67a7c16c6d 🔍 |
| SHA1 | 678db52cbe5d617c33c6269bfd4b6d8d1a17f956 🔍 |
| SHA256 | 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396 🔍 |
| SHA3 | 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x2a0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.08821 |
| MD5 | ffd3b06250ba95d239365ef050b3627b 🔍 |
| SHA1 | 16e3981245d8dbd44f33d93b203c02a44f3c2b95 🔍 |
| SHA256 | 1c3703755b6e9a690e8eafaa0cc318f667cd5d4c06935b6e3cd07296df9e9dcd 🔍 |
| SHA3 | 2c6baa84c172762978837565c2b2ed4f7716c0edaab79bda3a3ef74724426773 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.