d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Nov-29 09:09:24 |
| Detected languages |
English - United States
|
| CompanyName | Endermanch |
| FileDescription | Windows Customization Tool |
| FileVersion | 6.6.6.6 |
| InternalName | WinCustomize.exe |
| LegalCopyright | Copyright (C) 2020 |
| OriginalFilename | WinCustomize.exe |
| ProductName | Customization Tool |
| ProductVersion | 6.6.6.6 |
Plugin Output
| Suspicious | The PE is packed with mpress |
Unusual section name found: .MPRESS1
Section .MPRESS1 is both writable and executable. Unusual section name found: .MPRESS2 Section .MPRESS2 is both writable and executable. The PE's resources are bigger than it is. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Possibly launches other programs:
|
| Suspicious | The PE is possibly a dropper. |
Resource 102 is possibly compressed or encrypted.
Resources amount for 150.166% of the executable. |
| Suspicious | The file contains overlay data. | 34975 bytes of data starting at offset 0x9e200. |
| Malicious | VirusTotal score: 54/65 (Scanned on 2026-09-15 08:38:54) |
ALYac:
Trojan.Ransom.ScreenLocker
APEX: Malicious AhnLab-V3: Malware/Win32.RL_Generic.R364340 Alibaba: Ransom:Win32/Disabler.4cf3a1d1 Antiy-AVL: Trojan[Ransom]/Win32.Gen Arcabit: Trojan.Disabler.14 Avira: TR/W32.Agent BitDefender: Gen:Variant.Disabler.14 Bkav: W32.NaomiTunakK.Trojan CTX: exe.trojan.disabler CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.KillBoot.1513 Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Disabler.14 (B) F-Secure: Trojan.TR/W32.Agent Fortinet: W32/Disabler.NDL!tr.ransom GData: Gen:Variant.Disabler.14 Google: Detected Gridinsoft: Ransom.Win32.Generic.oa!s1 Ikarus: Trojan-Ransom.Agent Jiangmin: Trojan.Gen.btz K7AntiVirus: Ransomware ( 005d0e051 ) K7GW: Ransomware ( 005d0e051 ) Kingsoft: Win32.Trojan-Ransom.Gen.brjz Malwarebytes: Hack.Trojan.Userhack.DDS MaxSecure: Trojan.Malware.696116220.susgen McAfeeD: Real Protect-LS!989AE3D19520 MicroWorld-eScan: Gen:Variant.Disabler.14 Microsoft: Trojan:Win32/Disabler.GB!MTB NANO-Antivirus: Trojan.Win32.KillBoot.iestim Paloalto: generic.ml Panda: Trj/PhxBzA.A Rising: Ransom.Gen!8.DE83 (KTSE) SUPERAntiSpyware: Ransom.Disabler/Variant Sangfor: Ransom.Win32.Disabler.Vbyh SentinelOne: Static AI - Malicious PE Sophos: Mal/Generic-S Symantec: Trojan Horse Tencent: Trojan-Ransom.Win32.Gen.hb TrellixENS: GenericRXNR-BW!989AE3D19520 TrendMicro: Ransom.Win32.NOESCAPE.A TrendMicro-HouseCall: Ransom.Win32.NOESCAPE.A VBA32: TrojanRansom.Gen VIPRE: Gen:Variant.Disabler.14 Varist: W32/Disabler.B.gen!Eldorado ViRobot: Trojan.Win32.Z.Ransom.682655 VirIT: Trojan.Win32.Genus.XSI Xcitium: Malware@#1sho60ur73gqq Yandex: Trojan.Agent!yCnQtJZKjtk alibabacloud: Ransomware:Win/Disabler.NFA huorong: Trojan/NoEscape.a |
Hashes
| MD5 | 989ae3d195203b323aa2b3adf04e9833 🔍 |
|---|---|
| SHA1 | 31a45521bc672abcf64e50284ca5d4e6b3687dc8 🔍 |
| SHA256 | d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f 🔍 |
| SHA3 | 1466e4f10ecc266738984ca4f5bf3319b864e9fe5c6c6f0129de8a193de96d73 🔍 |
| SSDeep | 12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t 🔍 |
| Imports Hash | f400a8c725e9bcee856360087d72fec3 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x40 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x2 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0xb400 |
| e_oeminfo | 0xcd09 |
| e_lfanew | 0x40 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2020-Nov-29 09:09:24 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x3c00 |
| SizeOfInitializedData | 0x1bf800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001C640E (Section: .MPRESS2) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x5000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1cc000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0xd000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.MPRESS1
| MD5 | 2943243b75d86836232c2d952b16f0bc 🔍 |
|---|---|
| SHA1 | 54f9c43bfe6325b4dd5ea4caba4fd224bc4f8ed9 🔍 |
| SHA256 | 2052670eb45533ed8c13a9040811468af0f5226187f900e6562b68340ae04cd6 🔍 |
| SHA3 | b97bff5376ab2c932e3906b1f3d20723b2ef8b6bb83ca5419bff0d9184f47501 🔍 |
| VirtualSize | 0x1c5000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x98600 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.99972 |
.MPRESS2
| MD5 | 9923a8c15303e326094fe95215526939 🔍 |
|---|---|
| SHA1 | e463f2a1b4677454cfd2251173fe64d5faba7550 🔍 |
| SHA256 | 8db87277fcf06f5f5481ea2d8c1df4140baeec298a72f669efb489e82cdfc249 🔍 |
| SHA3 | 6176b173b657ded7a32e08e0b10b250fe564015b72ee54d33565565358914993 🔍 |
| VirtualSize | 0xf78 |
| VirtualAddress | 0x1c6000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x98800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.94591 |
.rsrc
| MD5 | 38d78877f0f858140a40b8877a25eaf8 🔍 |
|---|---|
| SHA1 | 99407bf4949106a7e928222a6d037582d6ac3eab 🔍 |
| SHA256 | 67a2253106ad47ced721d9dd9011eb3d4360691870c94d2db117b50b9f19d97e 🔍 |
| SHA3 | 610a902f0879dfc89cf289b9cf6ffb74e131f93cffc026b34cf4e7ee6336b3da 🔍 |
| VirtualSize | 0x4998 |
| VirtualAddress | 0x1c7000 |
| SizeOfRawData | 0x4a00 |
| PointerToRawData | 0x99800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.18654 |
Imports
| KERNEL32.DLL |
GetModuleHandleA
GetProcAddress |
|---|---|
| NETAPI32.dll |
NetUserAdd
|
| ntdll.dll |
RtlGetVersion
|
| USER32.dll |
GetDC
|
| GDI32.dll |
BitBlt
|
| ADVAPI32.dll |
FreeSid
|
| SHELL32.dll |
ShellExecuteW
|
| ole32.dll |
CoTaskMemFree
|
| bcrypt.dll |
BCryptGenRandom
|
| VCRUNTIME140.dll |
wcsstr
|
| api-ms-win-crt-string-l1-1-0.dll |
wmemcpy_s
|
| api-ms-win-crt-runtime-l1-1-0.dll |
exit
|
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.08855 |
| MD5 | e1d71e2f419cb14fcd1a9958a9d24813 🔍 |
| SHA1 | bcd231879a440da358c1f5d08ab4fa199d8efa17 🔍 |
| SHA256 | 1b0065c22f3d23119e90db688f76fb8ce3e37719ed910a30b9276f0d38ef22b8 🔍 |
| SHA3 | 2d387ecb66365588d874351246342958aa304662339c14ef1b1afee2f2e5d46d 🔍 |
102
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x61ed9 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99955 |
| MD5 | 5269795341676709f170837b77b9345d 🔍 |
| SHA1 | 61805924cc729a89c6ef1f734513e313c3293668 🔍 |
| SHA256 | 71512f7d4a324880a204d0cf1559dd5c730b300fb0bdbea7796ee720f09b697f 🔍 |
| SHA3 | 095f76d63ff1e48db5015743d2c1d825d12d5ce7a82ee999e223937df02d4ede 🔍 |
103
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x93036 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
104
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5db |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
105
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xed |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
106
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x133 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
107
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x161 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
108
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x53a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
101
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.91924 |
| Detected Filetype | Icon file |
| MD5 | 3e1d980f0dc747eec9d946c155cb1498 🔍 |
| SHA1 | 15414ced0202f709d400c957d441a8856dde8479 🔍 |
| SHA256 | 027e12c81d53ebb492d0e1ce8166c0c004e135274105fb79465b6b97bc6c71cd 🔍 |
| SHA3 | 11e83c27ff3b8cca2c537273338202138c94fb4b10a6b2daf0f7d23d177cc049 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2fc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.39361 |
| MD5 | cbdac8fe13612775ed7b845cbd020046 🔍 |
| SHA1 | 98270f86083eeb7d542217f9339569a3d2c1395b 🔍 |
| SHA256 | 68b2d3a1c20877b3f78fea333c736b10576088bb144a4d44702d1ec683c66c01 🔍 |
| SHA3 | 952e69705fb1b89b45c740129e3e8fe5b5c47d0a2460d7ab56d8e8f44ff96d5a 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 6.6.6.6 |
| ProductVersion | 6.6.6.6 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Endermanch |
| FileDescription | Windows Customization Tool |
| FileVersion (#2) | 6.6.6.6 |
| InternalName | WinCustomize.exe |
| LegalCopyright | Copyright (C) 2020 |
| OriginalFilename | WinCustomize.exe |
| ProductName | Customization Tool |
| ProductVersion (#2) | 6.6.6.6 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: Ignored an invalid IMAGE_RESOURCE_DATA_ENTRY
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource is empty!
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource is empty!
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource is empty!
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource is empty!
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource is empty!
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
[*] Warning: Resource is empty!
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 103 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 104 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 105 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 106 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 107 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
[!] Error: Resource 108 is bigger than the PE. Not trying to load it in memory.
Leave a comment
No comments yet.