e57b46ef3d1d9137b26e0734b75e9ef875f5492d893e3bc9d9008ceaf6d1a025

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Feb-19 23:33:56

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Suspicious The file contains overlay data. 8 bytes of data starting at offset 0x95a00.
Malicious VirusTotal score: 47/70 (Scanned on 2026-09-08 06:57:11) ALYac: Gen:Variant.MassLogger.23
APEX: Malicious
AVG: Win32:MalwareX-gen [Rat]
AhnLab-V3: Packed/Win32.RL_Quasar.C4324593
Antiy-AVL: Trojan[Spy]/MSIL.Quasar
Arcabit: Trojan.MassLogger.23
Avast: Win32:MalwareX-gen [Rat]
Avira: TR/Dropper.Gen
BitDefender: Gen:Variant.MassLogger.23
Bkav: W32.Malware.432E4E96
CTX: exe.unknown.masslogger
ClamAV: Win.Malware.Uztuby-9848412-0
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
DrWeb: Trojan.Siggen33.59796
ESET-NOD32: MSIL/Spy.Agent.BRK trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.MassLogger.23 (B)
F-Secure: Trojan.TR/Dropper.Gen
Fortinet: MSIL/Agent.6D7E!tr
GData: Gen:Variant.MassLogger.23
Google: Detected
K7AntiVirus: Spyware ( 005d0cd91 )
K7GW: Spyware ( 005d0cd91 )
Kaspersky: HEUR:Trojan-Spy.MSIL.Quasar.gen
Kingsoft: malware.kb.c.1000
Malwarebytes: Malware.AI.65711927
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!F084D23B2361
MicroWorld-eScan: Gen:Variant.MassLogger.23
Microsoft: Backdoor:MSIL/Quasar.GG!MTB
Panda: Trj/GdSda.A
Rising: Backdoor.xRAT!1.E17E (CLASSIC)
Sangfor: Suspicious.Win32.Save.pkr
SentinelOne: Static AI - Malicious PE
Skyhigh: GenericRXSK-NQ!F084D23B2361
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.moderate.ml.score
TrellixENS: GenericRXSK-NQ!F084D23B2361
TrendMicro: Cryp_Xin1
TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA5
VIPRE: Gen:Variant.MassLogger.23
Varist: W32/MSIL_Quasar.F.gen!Eldorado
Yandex: TrojanSpy.Agent!ugXwUGG/d6A
huorong: Backdoor/MSIL.Xiclog.a

Hashes

MD5 f084d23b23618702fd47bdb7c0cae258 🔍
SHA1 6ebd3d3f65f720b27ae3fbca769660ce09c826f5 🔍
SHA256 e57b46ef3d1d9137b26e0734b75e9ef875f5492d893e3bc9d9008ceaf6d1a025 🔍
SHA3 a7e2c95273967b1bbdcdcd4ec5dcb3ce59729005f08223cbcd5922b19e2de7e7 🔍
SSDeep 12288:yGWNuALkmHMhd0ObJglvzDxqiOKqUIJbk4:rak9hTbJ23xqiXfI9k4 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0
e_cp 0
e_crlc 0
e_cparhdr 0
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2026-Feb-19 23:33:56
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x94800
SizeOfInitializedData 0xe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000967DE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x98000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x9e000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 15

.text

MD5 f54b580d3620ba0f28012304c4e21686 🔍
SHA1 536f5fedcb75a58f9498a9311bdf6a187fd414fe 🔍
SHA256 3cad19ea78585619511be0859ab8a1bf9fbef9e88fdf66b977811bedf4bd11f3 🔍
SHA3 7f38280e007ac35882a24c0cf298c49a839803b58c50adf2c27e38f35afb583b 🔍
VirtualSize 0x947e4
VirtualAddress 0x2000
SizeOfRawData 0x94800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.20179

.sdata

MD5 cf6811ac613d96bf1b1e820440fc5920 🔍
SHA1 b5c028814ed9f282cbe01ea57b9d9417ea7ce89a 🔍
SHA256 8aecfcaf7c1e63826b3df0f1c4889e974bad2446fd9ef0f95fae8e4b40fe3f6c 🔍
SHA3 306d0d55d9a65099a4d7c0a7382d6fe3890ebb7b3530da4ad11227561449c767 🔍
VirtualSize 0x212
VirtualAddress 0x98000
SizeOfRawData 0x400
PointerToRawData 0x94c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.21404

.rsrc

MD5 c99a74c555371a433d121f551d6c6398 🔍
SHA1 605db3fdbaff4ba13729371ad0c4fbab3889378e 🔍
SHA256 e5a00aa9991ac8a5ee3109844d84a55583bd20572ad3ffcd42792f3c36b183ad 🔍
SHA3 463c61ad03873aa9e82581205205acc3d3c8346c7037c43e4e241ee529f2dc27 🔍
VirtualSize 0x7ec
VirtualAddress 0x9a000
SizeOfRawData 0x800
PointerToRawData 0x95000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.reloc

MD5 f3a8870a4f5314cb82c18b713e3091e2 🔍
SHA1 febd881e73624426cb57be786b6a87e0ca4d5ff4 🔍
SHA256 3641eda4881b3c8b0e7e1c6583529af3c73951c5ea028255e8f56902b255c43f 🔍
SHA3 6a7029be5d9823f92ac4365372437b11dd6922e023fdf253e7eca32dc5d73f87 🔍
VirtualSize 0xc
VirtualAddress 0x9c000
SizeOfRawData 0x200
PointerToRawData 0x95800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.