f05e79442b2ee0fcda6ac319ecd0d1c45a56bbe418a0fcdc40209daee95dea67

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Mar-23 15:37:49
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %temp%
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • cmd.exe
  • exploit
 Contains domain names:
  • 2010-aia.verisign.com
  • 2010-crl.verisign.com
  • aia.verisign.com
  • aia.ws.symantec.com
  • crl.microsoft.com
  • crl.thawte.com
  • crl.verisign.com
  • crl.ws.symantec.com
  • csc3-2010-aia.verisign.com
  • csc3-2010-crl.verisign.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl04
  • http://csc3-2010-aia.verisign.com
  • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
  • http://csc3-2010-crl.verisign.com
  • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif04
  • http://ocsp.thawte.com0
  • http://ocsp.verisign.com0
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • https://www.verisign.com
  • https://www.verisign.com/cps0
  • https://www.verisign.com/rpa
  • https://www.verisign.com/rpa0
  • logo.verisign.com
  • microsoft.com
  • symantec.com
  • thawte.com
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • verisign.com
  • ws.symantec.com
  • www.verisign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Unusual section name found: .rcd7cb
Section .rcd7cb is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • LoadLibraryA
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteW
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Manipulates other processes:
  • Process32NextW
  • Process32FirstW
Info The PE's resources present abnormal characteristics. Resource 1 is possibly compressed or encrypted.
Malicious VirusTotal score: 55/70 (Scanned on 2026-06-28 05:43:21) ALYac: Gen:Variant.Lazy.715626
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Trojan/Win.Lazy.R720011
Alibaba: TrojanDropper:Win64/ToolX.8832e31a
Antiy-AVL: Trojan/Win32.Phonzy
Arcabit: Trojan.Lazy.DAEB6A
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/Patched.Gen
BitDefender: Gen:Variant.Lazy.715626
Bkav: W32.Malware.B5462192
CTX: exe.trojan.generic
ClamAV: Win.Tool.Zusy-10033075-0
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: Trojan.DownLoader49.35384
ESET-NOD32: Win64/TrojanDropper.Agent.DO trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Lazy.715626 (B)
F-Secure: Trojan.TR/Patched.Gen
Fortinet: W64/Agent.BPJ!tr
GData: Win64.Virus.Fidxinf.A
Google: Detected
Gridinsoft: Trojan.Heur!.03012023
Jiangmin: Trojan.Generic.hssry
K7AntiVirus: Trojan-Downloader ( 006dab321 )
K7GW: Trojan-Downloader ( 006d9c241 )
Kaspersky: Trojan.Win64.Patched.t
Kingsoft: Win64.Trojan.Generic.a
Malwarebytes: Generic.Trojan.Dropper.DDS
MaxSecure: Trojan.Malware.121218.susgen
McAfeeD: Real Protect-LS!9242AD20DB1F
MicroWorld-eScan: Gen:Variant.Lazy.715626
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.Midie!8.12D29 (TFE:1:WvQqQDUantJ)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win64.Dropper.wc
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Trojan-DL.Win64.Agent.cbd
Trapmine: malicious.high.ml.score
TrellixENS: Artemis!9242AD20DB1F
TrendMicro: Trojan.Win32.ZYX.USBLFC26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFC26
VBA32: TrojanDownloader.Win64.Agent
VIPRE: Gen:Variant.Lazy.715626
Varist: W64/Agent.LXR.gen!Eldorado
Zoner: Probably Heur.ExeHeaderL
alibabacloud: Trojan[dropper]:Win/Zusy.Gen
huorong: HackTool/Injector.f

Hashes

MD5 9242ad20db1fd0c62011d4614a082adc
SHA1 0bcf53e543bba239baeb0ab6500a21326a3a8933
SHA256 f05e79442b2ee0fcda6ac319ecd0d1c45a56bbe418a0fcdc40209daee95dea67
SHA3 c876edb6005e8a66819ca002f2ab20c13316e1b38152b35ee6468c287f056c52
SSDeep 49152:129BvtchdTOZVZGdzvchdTOZVZGdzSyw:129Xc3UVevc3UVe
Imports Hash b8b5ac615ce365834b0db9f580768c0f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Mar-23 15:37:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x33000
SizeOfInitializedData 0x37b400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000003B2000 (Section: .rcd7cb)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3ce000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 106f8b70bb5b96d0750de7c915a9110c
SHA1 a00801a00bf7adf0feb244d6ba3427e23f379918
SHA256 86d006bd4c6a77cd2ae1755e180cdbe7706af85f395fc947fd2cfec27fef44bd
SHA3 64dadcecfd00e0e9ce781ff70e28172a8c88c65b076b455b419900673c33e0ed
VirtualSize 0x32f3c
VirtualAddress 0x1000
SizeOfRawData 0x33000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.52018

.rdata

MD5 127147bd6ab25b989abb7136ce42da75
SHA1 59229d05570cde43a3ac46801273aed0972165e7
SHA256 de880367d6b75345fd49dff5914f0decddb2cc59215f89c3e05a5e2703bf51dd
SHA3 edc1dfe4ff84d780782b0391dca3ff76182469e975d2d5970ecdac14e9f4bb07
VirtualSize 0x1346a
VirtualAddress 0x34000
SizeOfRawData 0x13600
PointerToRawData 0x34000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.0844

.data

MD5 e1cfb53d67053fdc339b68e6fe8a1137
SHA1 7904626c00780deae12cb4ff2b03f665be7ccb2f
SHA256 e6560b8761f0703cfb889aa842bf32130e89e409cc2436c32f61ef3c48d0bd50
SHA3 6bd0734e56283c760d2cac3a1006a5ab936ec9aff1e889e07dc6bd569fffd068
VirtualSize 0x1c7624
VirtualAddress 0x48000
SizeOfRawData 0x1c6000
PointerToRawData 0x48000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.3424

.pdata

MD5 e37bf8dad9f00158dcc07bcd76414f00
SHA1 db15aa117336e49b7dae24d9ed464c9bc431d493
SHA256 f18a31036de3ebd27f00dc04364009dc9638792ad012aeab046394499c776707
SHA3 7d1c9ba7fb56a1ccdb613712248b3386b4387a0a33143ff54faf2af46062f412
VirtualSize 0x288c
VirtualAddress 0x210000
SizeOfRawData 0x2a00
PointerToRawData 0x210000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.38029

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x213000
SizeOfRawData 0x200
PointerToRawData 0x213000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 57cd0939ed3212e79bf1193ede0fb6b4
SHA1 4480d1156f6623c96eaecf71530610099be1f466
SHA256 1083693281ff8570d6137ae0b7e348b35490cbcce5345f9c412aa069b4016c3f
SHA3 3cf904d4e0ffb99b2d07e921c0a8a9c208aeb2b3bd7e156ef37139cfd9464d36
VirtualSize 0x19ce50
VirtualAddress 0x214000
SizeOfRawData 0x19d000
PointerToRawData 0x214000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.37456

.reloc

MD5 8176ea651d1d574febfb2f8ffeb8caf4
SHA1 e6a05fdc9e152f246695c41d9478ab566ec59bf4
SHA256 d3fb43ab8f3e206235eb7d822873bac3f60c792e046d475d576e0982c45c56d3
SHA3 44d1f89bb4e843da952a2e3b1dfb101a42f610c1e3f7e2203a8f19fab36bfed8
VirtualSize 0x9bc
VirtualAddress 0x3b1000
SizeOfRawData 0xa00
PointerToRawData 0x3b1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.39944

.rcd7cb

MD5 eb66d615f9d399a6aaafc4bd5de5dafa
SHA1 b8641776db6f729ca581bf8036e40ccfafd7f1f1
SHA256 83d20334aed8110e907ef37a8fdf92f24ed258756eab8df9a2f898b576ca9a92
SHA3 e691f33e76b0f8da78bebd1caef8c2050b233bfdfe596ea9067f46b76b0c003c
VirtualSize 0x1c000
VirtualAddress 0x3b2000
SizeOfRawData 0x1c000
PointerToRawData 0x3b2000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.5483

Imports

KERNEL32.dll DeviceIoControl
CreateFileW
CloseHandle
ReadFile
VirtualFree
GetCurrentProcess
WriteFile
VirtualAlloc
LoadLibraryExA
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
LoadLibraryA
DeleteFileW
Process32FirstW
LoadLibraryW
GetWindowsDirectoryW
GetProcAddress
GetFileSize
FreeLibrary
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
RtlUnwind
USER32.dll SetWindowsHookExA
UnhookWindowsHookEx
EnumWindows
PostThreadMessageA
GetWindowThreadProcessId
IsWindowVisible
SHELL32.dll ShellExecuteW
ntdll.dll RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlImageNtHeader

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x19cbac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.37557
MD5 6847d242a49e8c56de7c8486f5d60c7e
SHA1 bcecae8c020a4e62ee4dc4effd462b7a54cca90f
SHA256 4797855ff097b6c92b60e4f8733a18e17eb43eb1d8103f0eb2c5a0aa4efe2927
SHA3 29f770496954dc5b57a81aa9dbdabb3205a06c1268aa86baeacc0e0a5adbf084

IDI_ICON1

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.16096
Detected Filetype Icon file
MD5 e02fa6595665132e0ea417a21cdbaced
SHA1 c1c34ce0327a36401fb8a055af53d203e699f561
SHA256 04d58db56b20065ba9e2ef90ecff5efae6539fe756eb982ba3fae45c1c7295d0
SHA3 77058e2ff782e6ef71cf612a71be4ccd391c733fbc753dfc673fa7e6ca93ca5a

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Mar-23 15:37:49
Version 0.0
SizeofData 1032
AddressOfRawData 0x43164
PointerToRawData 0x42564

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Mar-23 15:37:49
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400435b8
EndAddressOfRawData 0x1400435c0
AddressOfIndex 0x14020ea20
AddressOfCallbacks 0x140034498
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140048040

RICH Header

XOR Key 0xe872142e
Unmarked objects 0
C++ objects (33145) 178
C objects (33145) 17
ASM objects (33145) 8
ASM objects (35207) 10
C objects (35207) 17
C++ objects (35207) 82
Imports (33145) 9
Total imports 133
C++ objects (LTCG) (35225) 2
Resource objects (35225) 1
151 1
Linker (35225) 1

Errors

Leave a comment

No comments yet.