d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: HQR data file
Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Suspicious The PE is possibly packed. Unusual section name found: .xdata
Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Info The PE is digitally signed. Signer: computrabajo.com
Issuer: computrabajo.com
Malicious VirusTotal score: 23/65 (Scanned on 2026-07-07 22:33:23) AVG: FileRepMalware [Pws]
AhnLab-V3: Trojan/Win.Generic.R782055
Alibaba: Backdoor:Win64/Kryptik.f0c8119d
Avast: FileRepMalware [Pws]
Avira: TR/W64.Evo
Bkav: W32.Malware.8EB01290
CTX: exe.trojan.kryptik
CrowdStrike: win/malicious_confidence_90% (D)
ESET-NOD32: WinGo/Kryptik.UP trojan
Elastic: malicious (high confidence)
Fortinet: W64/Kryptik.UP!tr
Google: Detected
Kaspersky: UDS:DangerousObject.Multi.Generic
Malwarebytes: Malware.AI.3295484191
McAfeeD: Trojan:Win/Remus.GOAX
Paloalto: generic.ml
Rising: Trojan.ShellCodeRunner/x64!1.14216 (CLASSIC)
Sangfor: Backdoor.Win64.Kryptik.Vcqs
Sophos: Mal/Generic-S
Tencent: Backdoor.Win64.Gsb.16004173
TrellixENS: Artemis!4DB8E85743A1
Varist: W64/ABApplication.DOMS-1927
huorong: Trojan/Loader.uh

Hashes

MD5 4db8e85743a1ae8b1d26a3bccbffb6d1
SHA1 57659b0847aef1d3f7539a4d31697de8c94f782e
SHA256 d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b
SHA3 1c31b6abaff73676930e5b9ec0a23e3f1c6578584876cabaabf261a97593317b
SSDeep 49152:DDGvk+nJmHrQm++AOtV4djxbD9bsow5zmwC4vHsrX2:DDkmHAEadjx3q7hlBsG
Imports Hash d42595b695fc008ef2c56aabd8efd68e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x2a6e00
NumberOfSymbols 2525
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0xbb600
SizeOfInitializedData 0xd600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000073280 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x30f000
SizeOfHeaders 0x600
Checksum 0x2d23f1
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e2c433fb15a903b5762fd7276cb29cbe
SHA1 ccd68d5839495c71417c716ea4bfbf262f24ec3f
SHA256 41b2b7d5a3e06c446d32022ed60b074b10787f4e2a4b58e9a9543efaa7581d91
SHA3 47ffd485033bf5d13d1fb3a670900a0faef689987a77bcbb1de0c93ee6b1a35f
VirtualSize 0xbb571
VirtualAddress 0x1000
SizeOfRawData 0xbb600
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.28496

.rdata

MD5 f6b1f0f16fe44bb4341e1b3b506d34ba
SHA1 c4a2f87d6f652e102c873574e65a767a7b615200
SHA256 f6e68f3368b49d30e54b5a01700df4bc58cfedabad7ca02364fca5b5f3d7cb86
SHA3 3accafcb5985bb702b4affa07f8541cbc2de18c1cdc22d62b5eca5d80a0ad058
VirtualSize 0x1d4778
VirtualAddress 0xbd000
SizeOfRawData 0x1d4800
PointerToRawData 0xbbc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.18225

.data

MD5 501667070b806c10bf1ff858d30fa727
SHA1 33641cd61d70ec8eb7609045fb4351430930ffe4
SHA256 493c7d3f54fd35352765f36ab4aa8791e1670d8231be5ecf400d8df2879063e1
SHA3 2019ed86aadc8854eec7aa516e7282a9719506a0ab63f17f9f2e68161ddbb5c3
VirtualSize 0x56988
VirtualAddress 0x292000
SizeOfRawData 0xd600
PointerToRawData 0x290400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.12147

.pdata

MD5 e1c9b44858746ca578ebb7cb632e8068
SHA1 64452648c8998e129115ffbb79642b486da76adc
SHA256 077065af7558376532fd3f26f2a7cd4d57d8385b583f8782e9fc1e3584824897
SHA3 1fb0deb7c5d99c580db804df1ad2d5f4ff2b2b776934efcceb68c28a921b5ff1
VirtualSize 0x4c38
VirtualAddress 0x2e9000
SizeOfRawData 0x4e00
PointerToRawData 0x29da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.14288

.xdata

MD5 c6cf81c7ce68fd5253b0caa94ac65962
SHA1 2289d3df23e106010b7c081a61ce9ce9cbd824fc
SHA256 a654e76509be97cd85a6d5ef6b7e40406e3ff89c662b358c975189e9a691d0e3
SHA3 f191db5558a597fe60c13f34fe800ffc0cc74d2db049385afd76bb7e16a57910
VirtualSize 0xb4
VirtualAddress 0x2ee000
SizeOfRawData 0x200
PointerToRawData 0x2a2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78321

.idata

MD5 96576e25fb44fb6854d75208fc1be401
SHA1 64e361815c0611b0b04730d602c21fd549d4f8a8
SHA256 1ee9d8e0f52bb32efe628701e7b3adf6ec91e18ecd734dd0a21cb9304a2c590f
SHA3 8ee6a6fe4d5c087374cd093fd94ba5e7df543d79c76a2c31ebae4c72fd5df536
VirtualSize 0x53e
VirtualAddress 0x2ef000
SizeOfRawData 0x600
PointerToRawData 0x2a2a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.0126

.reloc

MD5 d94536a9ccbdf2d6f04df28b1e7a5a4d
SHA1 3f8444817453ad5110adf36c70ea1e257316d073
SHA256 627cdb75b309d7e1ed6e37afbcf926e9be7d124430d338637414b6c9b8475fae
SHA3 87ab9a707f7178a121c9fb53c2c8fdbb95cd8625e9a0f0e9baecb2cfdc863dd1
VirtualSize 0x3c10
VirtualAddress 0x2f0000
SizeOfRawData 0x3e00
PointerToRawData 0x2a3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.39848

.symtab

MD5 491a0574f81fc5e9ccd56ddc3749b6ae
SHA1 88d0cd0ae47ed93721aa0a5da846a0988e386c16
SHA256 f525c689928294455bcab81ad9879af6a3cfa957cc8427eefe00d7d41a69ca22
SHA3 dd775ff3419b5ae5565b799d06cda36bad8781ea7730da91178dda9b3a564eb8
VirtualSize 0x1aea1
VirtualAddress 0x2f4000
SizeOfRawData 0x1b000
PointerToRawData 0x2a6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.05097

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.