f775669b0c3abd52a5a9b939fdebc6fc
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1992-Jun-19 22:22:17 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | PEiD Signature: |
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h) UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .dosx
Section .dosx is both writable and executable. Unusual section name found: .fish Section .fish is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE header may have been manually modified. |
Resource BATCLEN is possibly compressed or encrypted.
Resource CLEAN is possibly compressed or encrypted. Resource EXTRATYPE is possibly compressed or encrypted. Resource HEAD is possibly compressed or encrypted. Resource IDMREG is possibly compressed or encrypted. Resource IDMSPD is possibly compressed or encrypted. Resource MASAIO is possibly compressed or encrypted. Resource UPDT is possibly compressed or encrypted. Resource 101 is possibly compressed or encrypted. The resource timestamps differ from the PE header:
|
| Malicious | VirusTotal score: 49/72 (Scanned on 2026-02-18 12:24:42) |
ALYac:
Gen:Variant.Application.Keygen-Crack-Patcher.3
APEX: Malicious AVG: Win32:UnwantedX-gen [PUP] AhnLab-V3: Unwanted/Win.Crack.C5610628 Antiy-AVL: HackTool/Win32.Crack Arcabit: Trojan.Application.Keygen-Crack-Patcher.3 Avast: Win32:UnwantedX-gen [PUP] Avira: TR/Crypt.ULPM.Gen BitDefender: Gen:Variant.Application.Keygen-Crack-Patcher.3 Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.1771401751ebc6fc CTX: exe.trojan.crack CrowdStrike: win/grayware_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.DownLoader49.31106 ESET-NOD32: Win32/HackTool.Crack.FO potentially unsafe application Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Application.Keygen-Crack-Patcher.3 (B) F-Secure: Trojan.TR/Crypt.ULPM.Gen Fortinet: W32/Agent.EXH!tr GData: Gen:Variant.Application.Keygen-Crack-Patcher.3 Google: Detected Gridinsoft: Trojan.Heur!.032125E1 Ikarus: PUA.HackTool.Crack K7AntiVirus: Trojan ( 0051918e1 ) K7GW: Trojan ( 0051918e1 ) Kingsoft: Win32.Troj.Undef.a Lionic: Trojan.Win32.Generic.4!c Malwarebytes: Malware.AI.2396696924 MaxSecure: Trojan.Malware.583819647.susgen McAfeeD: ti!3C64BD0508AB MicroWorld-eScan: Gen:Variant.Application.Keygen-Crack-Patcher.3 Microsoft: Trojan:Win32/Wacatac.A!ml Paloalto: generic.ml Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Dropper.kc Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score TrellixENS: Artemis!F775669B0C3A VBA32: Trojan.Hide.Heur VIPRE: Gen:Variant.Application.Keygen-Crack-Patcher.3 Varist: W32/ABApplication.LBJS-3199 Xcitium: Packed.Win32.MUPX.Gen@24tbus Zillya: Tool.Crack.Win32.6467 alibabacloud: HackTool:Win/Crack.FP |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xf000 |
| SizeOfInitializedData | 0x2000 |
| SizeOfUninitializedData | 0x2f000 |
| AddressOfEntryPoint | 0x0003E820 (Section: .fish) |
| BaseOfCode | 0x30000 |
| BaseOfData | 0x3f000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x41000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.dosx
.fish
.rsrc
Imports
| advapi32.dll |
RegCloseKey
|
|---|---|
| gdi32.dll |
SetBkColor
|
| IMAGEHLP.DLL |
ImageRemoveCertificate
|
| KERNEL32.DLL |
LoadLibraryA
CopyContext GetProcAddress VirtualProtect |
| oleaut32.dll |
SysFreeString
|
| shell32.dll |
ShellExecuteW
|
| user32.dll |
SetFocus
|
| version.dll |
VerQueryValueW
|
| winmm.dll |
waveOutOpen
|
Delayed Imports
BATCLEN
CLEAN
EXTRATYPE
HEAD
IDMREG
IDMSPD
MASAIO
SELFDEL
UPDT
1
101
DVCLAL
PACKAGEINFO
MAINICON
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .dosx has a size of 0!