| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2080-Aug-24 02:18:59 |
| Debug artifacts |
D:\Codi\CustomLoader\CustomLoader.Injector\obj\x64\Release\CustomLoader.Injector.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | Injector |
| FileVersion | 1.0.0.0 |
| InternalName | CustomLoader.Injector.exe |
| LegalCopyright | Copyright © 2026 |
| LegalTrademarks | |
| OriginalFilename | CustomLoader.Injector.exe |
| ProductName | Injector |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
| Suspicious | The PE is possibly packed. | The PE only has 0 import(s). |
| Suspicious | The file contains overlay data. |
24431308 bytes of data starting at offset 0x22c00.
The overlay data has an entropy of 7.99999 and is possibly compressed or encrypted. Overlay data amounts for 99.4208% of the executable. |
| Malicious | VirusTotal score: 26/71 (Scanned on 2026-10-11 11:08:09) |
ALYac:
Gen:Variant.Yogi.94210
APEX: Malicious AVG: Win64:MalwareX-gen [Misc] Arcabit: Trojan.Yogi.D17002 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Gen:Variant.Yogi.94210 Bkav: W32.Malware.4C53130F CTX: exe.unknown.yogi CrowdStrike: win/malicious_confidence_60% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: MSIL/DllInject.AQB potentially unsafe application Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Yogi.94210 (B) F-Secure: Trojan.TR/W64.Agent GData: Gen:Variant.Yogi.94210 Ikarus: PUA.MSIL.Dllinject Malwarebytes: Trojan.Injector.MSIL McAfeeD: ti!D9B552673733 MicroWorld-eScan: Gen:Variant.Yogi.94210 Microsoft: Trojan:Win32/Wacatac.B!ml Sangfor: Trojan.Win32.Save.a VIPRE: Gen:Variant.Yogi.94210 VirIT: Trojan.Win64.MSIL_Heur.B |
| MD5 | 11be70ccd11e98493dd91cce65255dc7 🔍 |
|---|---|
| SHA1 | c05bdac6aaf12ee26f2ce5f98826b766ab7d84ae 🔍 |
| SHA256 | d9b5526737338b9beda8ddb8bad948124b805c0e7cc58bf60854ed3bc45a6af2 🔍 |
| SHA3 | d1ff3b54a50ac423baf0866840c5b7ef67547cff6a99a2ab2449070a0550ccfd 🔍 |
| SSDeep | 393216:qX9Ek4irxABfkYP6R+WzV+vGCaPM9m6MTMTOYFu7hqxdpn3FnqXNxu:E4iFY8YP6R+WkvGCa6gTMaLwFRcNxu 🔍 |
| Imports Hash | d41d8cd98f00b204e9800998ecf8427e 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 2 |
| TimeDateStamp | 2080-Aug-24 02:18:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x22400 |
| SizeOfInitializedData | 0x600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000000000 (Section: ?) |
| BaseOfCode | 0x2000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x28000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x400000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 46a9efd16ae2c2b996cd4b68f3cc5715 🔍 |
|---|---|
| SHA1 | aa30e017ebb369c75facee7f0896b9dbdb08f1a3 🔍 |
| SHA256 | c444c8be5ead5bdd7966f29fb951ac43646e30642b7c2249fe4398827de3d853 🔍 |
| SHA3 | fcd65b6091fd4fcd72a235d30bf31d6cfea582f736bd93862c8d497745e497a4 🔍 |
| VirtualSize | 0x22218 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x22400 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.63213 |
| MD5 | d3bce821da068704a51b821ec52b941d 🔍 |
|---|---|
| SHA1 | 8a3706455b543c7101392c93aef9941cfa94fbb2 🔍 |
| SHA256 | 19ebe359a6c1965ba87e278690c80be365470ff07b8ef5a8fb6c8f47d6892a96 🔍 |
| SHA3 | 5368d611fdde40ba159826bea2cdad49a355eca9856920b132a2d7c170d5028b 🔍 |
| VirtualSize | 0x5dc |
| VirtualAddress | 0x26000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x22600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.15078 |
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x34c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.27434 |
| MD5 | 19eb3b652b36f13e7ca457cac2f82371 🔍 |
| SHA1 | b4dd2096d185b1919f84e2148c4144c55e45d0fd 🔍 |
| SHA256 | 42dce662cd789a027d29917d6bad6f90444caa256047b20bbeeea4a081c71cf1 🔍 |
| SHA3 | 112af2461caa217c772564fbdd320d6880a55b1b1fa77cfb4d24304b8ce8723d 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00112 |
| MD5 | b7db84991f23a680df8e95af8946f9c9 🔍 |
| SHA1 | cac699787884fb993ced8d7dc47b7c522c7bc734 🔍 |
| SHA256 | 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍 |
| SHA3 | 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | Injector |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | CustomLoader.Injector.exe |
| LegalCopyright | Copyright © 2026 |
| LegalTrademarks | |
| OriginalFilename | CustomLoader.Injector.exe |
| ProductName | Injector |
| ProductVersion (#2) | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2045-Mar-29 00:39:24 |
| Version | 0.0 |
| SizeofData | 109 |
| AddressOfRawData | 0x2418c |
| PointerToRawData | 0x2238c |
| Referenced File | D:\Codi\CustomLoader\CustomLoader.Injector\obj\x64\Release\CustomLoader.Injector.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
No comments yet.