d2649ca22b07ec3cb7ac74b3e4ebaddc8b56bd5e99c9f7100fd73bee2842a4fa
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Oct-25 16:56:22 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| CompanyName | Pluto |
| FileDescription | Pluto |
| FileVersion | 1.0.0 |
| ProductName | Pluto |
| ProductVersion | 1.0.0 |
Plugin Output
| Suspicious | The PE is possibly packed. |
Unusual section name found: .<bB
Unusual section name found: .3bb Unusual section name found: .iYD |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Leverages the raw socket API to access the Internet:
|
| Malicious | VirusTotal score: 28/71 (Scanned on 2026-10-30 01:38:26) |
APEX:
Malicious
AVG: Win64:MalwareX-gen [Misc] Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent Bkav: W32.Malware.6617AFAD CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 99) ESET-NOD32: Win64/Packed.VMProtect.AK suspicious application Elastic: malicious (high confidence) F-Secure: Trojan.TR/W64.Agent GData: Win64.Trojan.Agent.IKX0ZZ Google: Detected Gridinsoft: Trojan.Heur!.02212023 Malwarebytes: Malware.Heuristic.2108 MaxSecure: Trojan.Malware.698869727.susgen McAfeeD: ti!D2649CA22B07 Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Rising: Trojan.Kryptik@AI.84 (RDML:dzOKTjEeb4oewy/kgbdlnA) Sangfor: Trojan.Win32.Agent.Vvgg SentinelOne: Static AI - Suspicious PE Sophos: Generic ML PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score TrellixENS: Artemis!82B1A52D07F8 Varist: W64/ABApplication.HLDE-5487 alibabacloud: VirTool:Win/Packed.VMProtect.AH |
Hashes
| MD5 | 82b1a52d07f8ed28a07518fe519dcdba 🔍 |
|---|---|
| SHA1 | f5f3872efa4057b6fe0254a2e070b8195a822932 🔍 |
| SHA256 | d2649ca22b07ec3cb7ac74b3e4ebaddc8b56bd5e99c9f7100fd73bee2842a4fa 🔍 |
| SHA3 | 9b92b98a4494fd40f19373ee823da72719a3b0f1280eabba210f142fe59e5a82 🔍 |
| SSDeep | 196608:0M/0sIhLxFNdb51Md8w5TWJqHhc4O9hkwulHoST9GbhvnOb/G177/rfwkBOUa3d:Y1zNdU8wwUm4OP5kdT4tn0K77VBO1i5 🔍 |
| Imports Hash | a3223d323c5f82cbc223c1cb99f97d49 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2026-Oct-25 16:56:22 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2f5e00 |
| SizeOfInitializedData | 0xfae200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000001F4C562 (Section: .iYD) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1fbe000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x2f5d70 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xf82a98 |
| VirtualAddress | 0x2f7000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x2f98 |
| VirtualAddress | 0x127a000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.pdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x11454 |
| VirtualAddress | 0x127d000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.<bB
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1b993a |
| VirtualAddress | 0x128f000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.3bb
| MD5 | a6fc49afd41a46125cea1566f487cfc1 🔍 |
|---|---|
| SHA1 | 5112249c57ea727f43a08fc7e47c2e85648bd2b6 🔍 |
| SHA256 | 2eb89dee0aa50ec56b147d24d211c0b1ebb4ffcb3f4131f018a8e4617dbf9793 🔍 |
| SHA3 | 902a71bf47b1672dd19adad353ee4a256e7db114b89a9b07401daf99ccdd67a0 🔍 |
| VirtualSize | 0x338 |
| VirtualAddress | 0x1449000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.948188 |
.iYD
| MD5 | 416b09edc9cc287bd9195cdfa527d86d 🔍 |
|---|---|
| SHA1 | cd83d40a46de60cbdb074ac5a6d2d4ec9a01be63 🔍 |
| SHA256 | fa13972ca3f4fde05485884ce0933eaf7c09a9f4e63a8f4c1c6363f93518e70c 🔍 |
| SHA3 | c68e4cc8fcb4f31521225e42807c14d0a6cd54d3cc2fc49a1041bd13451c0607 🔍 |
| VirtualSize | 0xb5fd7c |
| VirtualAddress | 0x144a000 |
| SizeOfRawData | 0xb5fe00 |
| PointerToRawData | 0x800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
|
| Entropy | 7.99923 |
.rsrc
| MD5 | f6bfc699a52d1f617b0a567ec2955e2f 🔍 |
|---|---|
| SHA1 | 237c60b619ffa3192504ef5222b65ac375f23693 🔍 |
| SHA256 | 2e100518c288de3419b0e57b129118e090ba6fd1c18b8b6dcc4ea746e43a5c23 🔍 |
| SHA3 | b7e43053568cf5504b018bb12775ce9418afae950091d7611ec4ba4d9615b069 🔍 |
| VirtualSize | 0x12ff6 |
| VirtualAddress | 0x1faa000 |
| SizeOfRawData | 0x13000 |
| PointerToRawData | 0xb60600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.89805 |
.reloc
| MD5 | 58041357b8c3912d2d33174f35707a9e 🔍 |
|---|---|
| SHA1 | a06ee6e4e2a9af9d5abd6dde2f331da19f7b69f7 🔍 |
| SHA256 | 2d45b7a6f1bc394acb74ff2a519a5cd9de4868b1cbbddbb8c1ac418ff0d9fb2a 🔍 |
| SHA3 | 762991c15673ea1c356613eb197b25a80e34e660cdea06931ad8d1ec3fe56c12 🔍 |
| VirtualSize | 0x5c |
| VirtualAddress | 0x1fbd000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xb73600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.07738 |
Imports
| kernel32.dll |
SetLastError
|
|---|---|
| advapi32.dll |
EventUnregister
|
| oleaut32.dll |
SysStringLen
|
| bcryptprimitives.dll |
ProcessPrng
|
| ntdll.dll |
RtlNtStatusToDosError
|
| shell32.dll |
DragFinish
|
| ole32.dll |
CoUninitialize
|
| api-ms-win-core-synch-l1-2-0.dll |
WakeByAddressSingle
|
| gdi32.dll |
SelectObject
|
| comctl32.dll |
DefSubclassProc
|
| user32.dll |
SetWindowTextW
|
| shlwapi.dll |
SHCreateMemStream
|
| dwmapi.dll |
DwmEnableBlurBehindWindow
|
| ws2_32.dll |
send
|
| crypt32.dll |
CertGetCertificateChain
|
| secur32.dll |
FreeCredentialsHandle
|
| api-ms-win-crt-math-l1-1-0.dll |
pow
|
| api-ms-win-crt-string-l1-1-0.dll |
strcpy_s
|
| api-ms-win-crt-convert-l1-1-0.dll |
_ultow_s
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_get_initial_narrow_environment
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__p__commode
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
calloc
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x12b94 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.91945 |
| Detected Filetype | PNG graphic file |
| MD5 | 580a4237a39737a6619bd219a7fd5d2b 🔍 |
| SHA1 | 43dba2719d6984d8bdbaa6bc3b7df07e6559facd 🔍 |
| SHA256 | 859243222bfb5c86de50edd757ad66c0a5d948c11d95c57cbbba7d7f5fed4925 🔍 |
| SHA3 | 0d0fdc00263d3615ddcd3a8fabe1260d52c5d2b0e1686f94f414279351201a21 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.59047 |
| Detected Filetype | Icon file |
| MD5 | 660144551160f57aea756de07cb8c20f 🔍 |
| SHA1 | b7c16c18c55dc7b00039bc2296afab5ea040d95c 🔍 |
| SHA256 | 0feef3e9931208e25861eebc747fd67cbde4b36cc2bdefd2d1d3499fdbf47501 🔍 |
| SHA3 | f161e3f0d6e9e8fe568ec98eefdd693487daaaaa160e214bc66e7d6cec147380 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x1c4 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.06442 |
| MD5 | 496c334c7490a49a21e43865934d7948 🔍 |
| SHA1 | 3c7978269e24b69ce22fa47b3117c48818da9a1c 🔍 |
| SHA256 | 5150924c22e7ef1f8d919b73cba7e65b510f6cf87f2da66864ecfd81804159af 🔍 |
| SHA3 | 65ad352899cb77b5d95dcd1c47cb6ac619d87c91032fbba7da259443513674bf 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.96056 |
| MD5 | 01e4c8c046a47771f13cd120b53303e7 🔍 |
| SHA1 | 2a4224d31c916a5cff4f2636a3cb47fdd84a5cc9 🔍 |
| SHA256 | b1cb832f790c153aa0e9a66f76e75460263cf1d41971d2dbcc9a4d87ec18b7d8 🔍 |
| SHA3 | 680120ec819e7ba66519d9a8a3e446973c4cb28aa0146c91cceaa8c8fadc90ae 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Pluto |
| FileDescription | Pluto |
| FileVersion (#2) | 1.0.0 |
| ProductName | Pluto |
| ProductVersion (#2) | 1.0.0 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x141449178 |
|---|---|
| EndAddressOfRawData | 0x141449304 |
| AddressOfIndex | 0x14127ce34 |
| AddressOfCallbacks | 0x141f64760 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001415C7A38
0x000000014024A680 |
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14127a900 |
RICH Header
Errors
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .pdata has a size of 0!
[*] Warning: Section .<bB has a size of 0!
Leave a comment
No comments yet.