| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Apr-30 07:55:06 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 8/70 (Scanned on 2026-05-07 09:36:50) |
APEX:
Malicious
Bkav: W32.Malware.A7CCDEF9 CrowdStrike: win/grayware_confidence_60% (D) Cylance: Unsafe Cynet: Malicious (score: 100) McAfeeD: Real Protect-LS!235E2768DC15 Sophos: Generic ML PUA (PUA) Trapmine: suspicious.low.ml.score |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Apr-30 07:55:06 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x44600 |
| SizeOfInitializedData | 0x38a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00009C1A (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x46000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x82000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetDriveTypeA
MultiByteToWideChar Sleep CloseHandle WideCharToMultiByte GetDiskFreeSpaceExA GetLastError GetLogicalDriveStringsA CreateMutexW HeapSize FlushFileBuffers SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx FormatMessageW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo FreeLibrary LoadLibraryExW RaiseException RtlUnwind DuplicateHandle CreateProcessW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP SetEnvironmentVariableA SetEnvironmentVariableW HeapAlloc HeapReAlloc HeapFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType ReadFile GetConsoleMode ReadConsoleW WaitForSingleObject GetExitCodeProcess CreatePipe GetConsoleCP GetTimeZoneInformation FindFirstFileExA WriteConsoleW |
|---|---|
| IPHLPAPI.DLL |
GetNetworkParams
GetAdaptersInfo |
| WS2_32.dll |
ntohs
htons closesocket select getaddrinfo send socket connect recv freeaddrinfo WSACleanup WSAStartup |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-30 07:55:06 |
| Version | 0.0 |
| SizeofData | 940 |
| AddressOfRawData | 0x549d0 |
| PointerToRawData | 0x533d0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-30 07:55:06 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x47b000 |
|---|---|
| EndAddressOfRawData | 0x47b008 |
| AddressOfIndex | 0x459ab0 |
| AddressOfCallbacks | 0x446210 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x5c |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x45800c |
| SEHandlerTable | 0x4547f0 |
| SEHandlerCount | 120 |
| XOR Key | 0x452cedd1 |
|---|---|
| Unmarked objects | 0 |
| 241 (40116) | 13 |
| 243 (40116) | 166 |
| 242 (40116) | 29 |
| ASM objects (VS2015 UPD3 build 24123) | 23 |
| C++ objects (VS2015 UPD3 build 24123) | 55 |
| C objects (VS2015 UPD3 build 24123) | 34 |
| Imports (65501) | 7 |
| Total imports | 137 |
| C++ objects (LTCG) (VS2015 UPD3.1 build 24215) | 5 |
| Resource objects (VS2015 UPD3 build 24210) | 1 |
| Linker (VS2015 UPD3.1 build 24215) | 1 |
No comments yet.