f153dfacec09dd69809c3bbf68270a38ee3701f44220c7bf181c14a68c138133

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2011-Apr-30 16:41:06

Plugin Output

Info Matching compiler(s): Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessA
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 46/71 (Scanned on 2026-08-15 13:58:57) ALYac: Application.Agent.AHB
APEX: Malicious
AVG: Win32:MalwareX-gen [Trj]
Alibaba: Trojan:Win32/Generic.9d3f6ef1
Antiy-AVL: RiskWare/Win32.Application
Arcabit: Application.Agent.AHB
Avast: Win32:MalwareX-gen [Trj]
Avira: TR/W32.MalwareX
BitDefender: Application.Agent.AHB
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
ESET-NOD32: Generik.NEANVZC trojan
Elastic: malicious (high confidence)
Emsisoft: Application.Agent.AHB (B)
F-Secure: Trojan.TR/W32.MalwareX
Fortinet: W32/Generic_PUA_OK.NEANVZC!tr
GData: Application.Agent.AHB
Google: Detected
Gridinsoft: Trojan.Win32.Agent.vb!s1
Ikarus: PUA.Agent
Jiangmin: Trojan.Agent.fczg
Kingsoft: malware.kb.a.933
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.AI.2274305401
MaxSecure: Trojan.Malware.666904643.susgen
McAfeeD: ti!F153DFACEC09
MicroWorld-eScan: Application.Agent.AHB
NANO-Antivirus: Trojan.Win32.MlwGen.daocxo
Paloalto: generic.ml
Rising: Trojan.Totbrick!8.E0F0 (TFE:5:LtlJOsWnJOO)
Sangfor: Trojan.Win32.Agent.Vpts
Skyhigh: GenericRXET-IE!251F4D0CAF6E
Sophos: Mal/Generic-S
Symantec: Trojan.Gen.2
TrellixENS: GenericRXET-IE!251F4D0CAF6E
TrendMicro: TROJ_GEN.R002C0PLK20
TrendMicro-HouseCall: TROJ_GEN.R002C0PLK20
VIPRE: Application.Agent.AHB
Varist: W32/ABTrojan.OMKI-0114
VirIT: Trojan.Win32.Paxxess.IKB
Xcitium: Malware@#10aa9bj5go8jf
Yandex: Trojan.Agent!yYy229LWhAM
alibabacloud: Trojan:Win/Generik.NAZBSFM

Hashes

MD5 251f4d0caf6eadae453488f9c9c0ea95 🔍
SHA1 ea8e109eb3fbdb76623cf9522267345b19721e42 🔍
SHA256 f153dfacec09dd69809c3bbf68270a38ee3701f44220c7bf181c14a68c138133 🔍
SHA3 fb98ab196fb1d7030e5748a42bb12f0b71d6fb4d4f328f1c814cf20f5c48c388 🔍
SSDeep 192:X+ysyWoQydF8GnFdYaeJSWLSLSjPrQXofBemKkZpzmZBdZDRiiKwUCry4m534i/:X+ysyWoQyLd2Jp7z5rmlDwoC6nBmo 🔍
Imports Hash bf3d48dd03f2a72ee307ffe7965bfce1 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2011-Apr-30 16:41:06
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x3000
SizeOfInitializedData 0x2000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001577 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x4000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x6000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6bc8373e9f753cd282af864ad71269c2 🔍
SHA1 96d6a9b8cbf82c03bc8430d23b80e472a87aff01 🔍
SHA256 bcd3a749b87adade78236ab4ac07fd8d111af2cd635fd0c05216e617fa97f960 🔍
SHA3 9450e2db0c4003046a74fc8b70b13911f6f54a5bbc8654a5fab837022a628ed2 🔍
VirtualSize 0x2c66
VirtualAddress 0x1000
SizeOfRawData 0x3000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.25123

.rdata

MD5 40e860eea4ba1be6d0d3936b0dbbf076 🔍
SHA1 eed74a6246d087024807ede9b930b49335f5389e 🔍
SHA256 24133f38c21ac16d0d6470580e942fc0bd9f2e5251bef1af5e183466c7c37a83 🔍
SHA3 8a9bec23361bf52ba853bef5b5fb3316f205ead6ad0fddd05a87ffdb8592b1b6 🔍
VirtualSize 0x7d0
VirtualAddress 0x4000
SizeOfRawData 0x1000
PointerToRawData 0x4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.16852

.data

MD5 6103ee24e83b7788dacddba6a1fb83d0 🔍
SHA1 020f412c2c001fbefcbc0e8b4af5f86d2d455aab 🔍
SHA256 8532f3689f37bb3f2796f34ec1e87e257546af74c3bb0bd0494de3a692b05975 🔍
SHA3 332bb8635e59807e2568e7361b4361eec39d9222fc3173a8ad646ca5d3ae14f3 🔍
VirtualSize 0x7dc
VirtualAddress 0x5000
SizeOfRawData 0x1000
PointerToRawData 0x5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.685321

Imports

KERNEL32.dll WaitForSingleObject
CreateProcessA
Sleep
GetModuleFileNameA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
HeapReAlloc
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
GetStringTypeW
WS2_32.dll WSAStartup
WSASocketA
gethostbyname
closesocket
WSACleanup
htons
connect

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x3b45f821
Unmarked objects 0
C++ objects (VS98 build 8168) 1
C objects (VS98 build 8168) 19
14 (7299) 11
19 (8034) 5
Total imports 46
C++ objects (VS98 build 8168) (#2) 2

Errors

Leave a comment

No comments yet.