| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Sep-02 14:03:40 |
| Detected languages |
English - United States
|
| Debug artifacts |
Embedded COFF debugging symbols
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: /4
Unusual section name found: /14 Unusual section name found: /29 Unusual section name found: /41 Unusual section name found: /55 Unusual section name found: /67 Unusual section name found: /78 Unusual section name found: /94 Unusual section name found: /110 |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. | 36981 bytes of data starting at offset 0x49400. |
| Malicious | VirusTotal score: 7/70 (Scanned on 2026-09-02 14:37:23) |
APEX:
Malicious
CrowdStrike: win/malicious_confidence_60% (D) Elastic: malicious (high confidence) MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!54F08DD4FC40 Microsoft: Trojan:Win32/Wacatac.C!ml VBA32: BScope.TrojanPSW.Lumma |
| MD5 | 54f08dd4fc40bfb083d7a02b5531452d 🔍 |
|---|---|
| SHA1 | cac4c649247cd879d6ca87e5d50204a7bb46f752 🔍 |
| SHA256 | e2be287335e3d4735fd79de6ab05b769302a4ae5ee1116aec2196019a254eb01 🔍 |
| SHA3 | bdb86fe9d143124ca080bd4d0b28264bfd56a0eb6f7f5730b3ca376674b313b8 🔍 |
| SSDeep | 1536:LMiaEj9Y6MrXwM9Gu+GJQ9dLaf9JizpTJa7/KlAwqhhYp2iCq6/isDKODhMimMYl:YiaEj662XKlEQ9c63EDKODhMiAl 🔍 |
| Imports Hash | fb5248567472cc21c0971a86ae4fc8cb 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 16 |
| TimeDateStamp | 2026-Sep-02 14:03:40 |
| PointerToSymbolTable | 0x49400 |
| NumberOfSymbols | 1726 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x1e00 |
| SizeOfInitializedData | 0x36000 |
| SizeOfUninitializedData | 0x200 |
| AddressOfEntryPoint | 0x000014E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x3000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x52000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x61a6e |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | c48ccf6f27bc6c12c70413fe23bd5644 🔍 |
|---|---|
| SHA1 | c0b36bb7e31c7039b0e52feffa26ff25e4cec624 🔍 |
| SHA256 | b847522bd44d8f038adb3258cd96d754fd12191a888563af3fa57f47b23ac781 🔍 |
| SHA3 | 9b5f39e6af8db0a245cbc164896c2ac4b8a3c22e0129d3d0c5666206190324d0 🔍 |
| VirtualSize | 0x1dd0 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1e00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.86909 |
| MD5 | 9ac829d6924c30517deede302b83a36f 🔍 |
|---|---|
| SHA1 | e4d1e1be95e74b2f0474f0a627fdd703fe085b2a 🔍 |
| SHA256 | c4ec8c5581de672147da8ee200578e21459b56bbe166cfe7825c0d23d54053a7 🔍 |
| SHA3 | 0c0bd188d3650c72e1ca746cad81f14702168a4108cb010e229bd3a05aa03b52 🔍 |
| VirtualSize | 0x44 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x2200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.688391 |
| MD5 | 3bd42694c58d839f4907b507b85d7492 🔍 |
|---|---|
| SHA1 | dddf9da21defbbca8a6900acf0a47805d4111961 🔍 |
| SHA256 | ce0055d351c7174eb8de5ab4642804cf02342aa671427011390ffd50f35f6633 🔍 |
| SHA3 | 2d6b8cddbbfd9f31011b4b2aba8909f9fabe52515e326018a7e674f6ac21132e 🔍 |
| VirtualSize | 0x848 |
| VirtualAddress | 0x4000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x2400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.84089 |
| MD5 | d61f03a031f5550df26e19aa7f8a6763 🔍 |
|---|---|
| SHA1 | 65bfbd70541bff7fd2dc1a88a5ba0e3e7c276731 🔍 |
| SHA256 | 0450ae7b5bd0b78da5423c278240bf2a2baeb15ad88b2d914c2171a673af9931 🔍 |
| SHA3 | 9bbcdb4ddfa0d3f625ecfd9cdf10e2fdc4252242610d3960c1b39af711dc63f9 🔍 |
| VirtualSize | 0x6ac |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x2e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.93569 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xbc |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | 87ab5974846ea559948757a495d4116e 🔍 |
|---|---|
| SHA1 | 786dd9f9b851ce7b06261e80c0739e79d35aab30 🔍 |
| SHA256 | 888a4c5dda6488083b1fe30e82a3293700d9e466ed512eb190d36647a2672332 🔍 |
| SHA3 | 8c5b45edbfa168eeb0bdb5fe7a831da3cc8327c5cba64133de910e11e0be09f5 🔍 |
| VirtualSize | 0x924 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.52811 |
| MD5 | 9890cbb03df81c766719f0de23db565d 🔍 |
|---|---|
| SHA1 | 212bb0c2b4a611cf7791f2c2d444caefac89621e 🔍 |
| SHA256 | 53651fdd8eb283d5febd22085ae7a9571133ed8f410c8b0141406ac5d10ff384 🔍 |
| SHA3 | 42c0486c2153fc147ac2b8a7932dd18dd7fbcd1f47f21060d0c7e22c6a7885fd 🔍 |
| VirtualSize | 0x33cd0 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x33cd0 |
| PointerToRawData | 0x4000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 1.84475 |
| MD5 | e9a5283ae98f6117a59a59bf2512845f 🔍 |
|---|---|
| SHA1 | 04e3fd352a16189d1461846828ce2452482601db 🔍 |
| SHA256 | e5b82c4eb71f07ebac5ffde0842f947bad0f9a1b7f849f31c112dfd0ba5f1d64 🔍 |
| SHA3 | 5fdd37cb92db93081ba39519726b860d9d59ff51834966bc31f9d6d575e3cbd5 🔍 |
| VirtualSize | 0x2c0 |
| VirtualAddress | 0x3c000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x37e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.22349 |
| MD5 | 50a66101d287a9b931b6dd8bab81ad8f 🔍 |
|---|---|
| SHA1 | 9497d5b71ab33e5e2e01f116acc45609d04194dd 🔍 |
| SHA256 | 9645dcbadf22b1363b1398e8bb35035f100644c6d41f4c307cc2fc210f1a229a 🔍 |
| SHA3 | 57561f0775f964e4f03d12cbc9dc6ffc29f72b08145ac9b46224ce96c2af0243 🔍 |
| VirtualSize | 0x2f0 |
| VirtualAddress | 0x3d000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x38200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.67605 |
| MD5 | 4512d75998a3a7b77fc46334f2ad6d2b 🔍 |
|---|---|
| SHA1 | 5664012094dec19a4c339db29b56d0d9612ed46d 🔍 |
| SHA256 | 5b31d44cf6817ce7ccf08aa7ced1af8b825b365eeaa82c0f026aeb034c5cc508 🔍 |
| SHA3 | 59e1f0641eb31e3f0315dcf2105a6d29166c15c743a71b3bdf34d2b4a0734390 🔍 |
| VirtualSize | 0xa8f7 |
| VirtualAddress | 0x3e000 |
| SizeOfRawData | 0xaa00 |
| PointerToRawData | 0x38600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.96407 |
| MD5 | e5ddd8c12b33abb2c991c7755a0e3fe9 🔍 |
|---|---|
| SHA1 | 5a85de548fa069d2de298dfe9beb7102c2fc311c 🔍 |
| SHA256 | dc694bb89e9185d2fb190ff288d2d252039ca61299047560b09ff0a3b44f11d1 🔍 |
| SHA3 | 4524717f916bdd20e9f5c604d283610ad197e34d445cb08cc9cea3d2e0a484c9 🔍 |
| VirtualSize | 0x1c08 |
| VirtualAddress | 0x49000 |
| SizeOfRawData | 0x1e00 |
| PointerToRawData | 0x43000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.65676 |
| MD5 | 5da1708da1d752f555923e2b9424288c 🔍 |
|---|---|
| SHA1 | d1004983a85b2e3e220778efef728dbdb06438dc 🔍 |
| SHA256 | dcb8e0298e08be8f5384952b33310fe433bf957cf725c1d2fe203eb2796e9d3e 🔍 |
| SHA3 | 65463fa0de0f841c57bc3b1d9e1b26a1e6c9f61d2ac78841be53aa8448dc2e9a 🔍 |
| VirtualSize | 0x1b26 |
| VirtualAddress | 0x4b000 |
| SizeOfRawData | 0x1c00 |
| PointerToRawData | 0x44e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.93471 |
| MD5 | 6bd9ff263de5726b74171b15ca30d340 🔍 |
|---|---|
| SHA1 | fd389403bd991fda261dff5d4da83d52625f6581 🔍 |
| SHA256 | 3f5a62ec42720030f19217b0d42d73980acdebebe1523027cbb396b6aae7b9fd 🔍 |
| SHA3 | 7cd85211cf645b8953222c334831914ceb08c99ee4daaf43c49d7c8e448f7ea5 🔍 |
| VirtualSize | 0x2b9 |
| VirtualAddress | 0x4d000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x46a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 3.95725 |
| MD5 | 74315d7da334ffbfe1928bec95b5fc6d 🔍 |
|---|---|
| SHA1 | 025a32f913c2166812c5e4a6f431240f4f2d1e47 🔍 |
| SHA256 | 96d4dcc3e197cb181f7a091760a1f7f0367753a228e7c113419e10236a053d77 🔍 |
| SHA3 | 5b0f1a81e7a538545e772e678813f9f52ee38ad4202574777f6c94e7f5bb72ed 🔍 |
| VirtualSize | 0x1835 |
| VirtualAddress | 0x4e000 |
| SizeOfRawData | 0x1a00 |
| PointerToRawData | 0x46e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.93001 |
| MD5 | f5f7bd070cf8609e0a43d644c77d94c6 🔍 |
|---|---|
| SHA1 | c87182c4efec4dc37f6cd46bdbc52738958c698f 🔍 |
| SHA256 | 87e33357387a6646eb774a755f58852ae2ef1083a0fc91f2dec7509898bd770f 🔍 |
| SHA3 | 44e966231d8bb622120a8f75cc2ac0695987033b70160d62517e4208bf1d1643 🔍 |
| VirtualSize | 0x8df |
| VirtualAddress | 0x50000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x48800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.5908 |
| MD5 | 79dc282e2e7e87f105096f22226d9211 🔍 |
|---|---|
| SHA1 | 0874fa25af56960ef681a1aa144ff68d18460761 🔍 |
| SHA256 | 347d3681e0db2dd19f3eda974ed7a30233444aa588037c9167e8d7e8a2393521 🔍 |
| SHA3 | 38f31fdeced915e7014944cf76d4e24499a05f07d176484ebe27d0e6caf8f87b 🔍 |
| VirtualSize | 0x16d |
| VirtualAddress | 0x51000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x49200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 3.79343 |
| GDI32.dll |
BitBlt
CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetDIBits GetObjectA SelectObject SetDIBits StretchBlt |
|---|---|
| KERNEL32.dll |
FreeLibrary
GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GetTickCount IsDBCSLeadByte LoadLibraryA SetUnhandledExceptionFilter Sleep VirtualProtect VirtualQuery |
| msvcrt.dll |
_XcptFilter
__fpecode __getmainargs __p__iob __p___initenv __p__acmdln __p__commode __p__fmode __pxcptinfoptrs __set_app_type __setusermatherr _amsg_exit _cexit _exit _initterm abort atexit exit fflush free fprintf malloc memcpy rand setvbuf signal srand strlen vfprintf |
| USER32.dll |
BeginPaint
CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint FillRect GetClientRect GetDC GetMessageA GetSystemMetrics InvalidateRect KillTimer LoadBitmapA LoadCursorA LoadIconA MessageBoxA PostQuitMessage RegisterClassExA ReleaseDC SetTimer SetWindowPos ShowCursor ShowWindow TranslateMessage UpdateWindow |
| WINMM.DLL |
timeBeginPeriod
timeEndPeriod |
| Type |
RT_BITMAP
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x31498 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.26727 |
| MD5 | 9dbff79a3f3b895a454754a91fa355e1 🔍 |
| SHA1 | dfae3d28a07866db3f27fd596a317388b3d56e76 🔍 |
| SHA256 | 1320006e6776b32cd475c36f0a663960fdf5a342ba8735023993f6b74840e4e8 🔍 |
| SHA3 | 26db7678de0e4efd79b5410110980fcac476531aa45ef77e84f27dd0cd70de17 🔍 |
| Preview |
|
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x23fc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.93474 |
| Detected Filetype | PNG graphic file |
| MD5 | 0c03a2d2c39eb05a02484b46821a923a 🔍 |
| SHA1 | a326da518c3c2a60048da82d939a4903f2c9c79a 🔍 |
| SHA256 | 00d9d6329c0cd86fd962aa9f2f02e790b0ddd858cdf22a25bc479b2e8495185f 🔍 |
| SHA3 | a7e399a3b02f2b647e432a6aa57797a205e128886522c07c065ce8114e148eaf 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.51664 |
| Detected Filetype | Icon file |
| MD5 | 48e926ec07a95a10a2f9e62871b41df8 🔍 |
| SHA1 | 85f9c293433d996f9204d4a523d2da2cad50c74b 🔍 |
| SHA256 | abe976fb93cf141f53151f6c9f63aafa0b34460f4ba6578e180366418547042d 🔍 |
| SHA3 | 5d7080954d9a918d1305cc9c3305b6c0c7292a03bd26abb964b3f2223330271c 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2c6 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.31884 |
| MD5 | 9ad96638d72bbbbc6440da9c856e4c39 🔍 |
| SHA1 | 29afb0ef053afc70b447be919383f8c8fd562df9 🔍 |
| SHA256 | e989bc9ba32a3f5b1f5a565d5971e07462a2d6a504e7af682bd36cc8cc263f29 🔍 |
| SHA3 | bc609fa29e449d5658a65d53fff8f9bf73c07e46d140fc507870fc7b6a6f9857 🔍 |
No comments yet.