fed1a1556b70e2d634b05a951a4c5f89617d80e1b1cde5c620f7cf7b2970fdd5

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-13 23:38:26
Detected languages English - United States
Debug artifacts prisnumio.pdb
FileDescription prisnumio
FileVersion 2.7.6.17630
InternalName prisnumio.exe
LegalCopyright Copyright © 2023 Prisnumio Inc.. All rights reserved.
CompanyName Prisnumio Inc.
ProductName prisnumio
OriginalFilename prisnumio.exe
ProductVersion 2.7.6.17630

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Enumerates local disk drives:
  • GetDriveTypeW
  • GetLogicalDriveStringsW
Malicious VirusTotal score: 44/70 (Scanned on 2026-10-12 04:29:17) ALYac: Trojan.GenericKD.81715092
APEX: Malicious
AVG: Win64:Evo-gen [Trj]
AhnLab-V3: Trojan/Win.Generic.C5956124
Alibaba: Trojan:Win64/Kryptik.86a8a4b7
Antiy-AVL: Trojan/Win64.Kryptik
Arcabit: Trojan.Generic.D4DEDF94
Avast: Win64:Evo-gen [Trj]
Avira: TR/W64.Evo
BitDefender: Trojan.GenericKD.81715092
Bkav: W32.Malware.8DCF97A2
CAT-QuickHeal: Trojan.Qwexlafiba
CTX: exe.trojan.kryptik
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
DrWeb: Trojan.DownLoader50.37995
ESET-NOD32: Win64/Kryptik.HRN trojan
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.81715092 (B)
F-Secure: Trojan.TR/W64.Evo
GData: Trojan.GenericKD.81715092
Google: Detected
Ikarus: Trojan.Win32.Wacatac
Kaspersky: Trojan.Win64.Agent.smhoea
Lionic: Trojan.Win32.Agent.Y!c
Malwarebytes: Trojan.Injector
MaxSecure: Trojan.Malware.723816896.susgen
McAfeeD: ti!FED1A1556B70
MicroWorld-eScan: Trojan.GenericKD.81715092
Microsoft: Trojan:Win32/Qwexlafiba!rfn
Panda: Trj/PhxBzA.A
Rising: Trojan.Kryptik@AI.84 (RDML:rSa361k/w/DVTQZpSzoDsQ)
Sangfor: Trojan.Win64.Kryptik.Vvbx
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.10c4ce40
TrellixENS: Artemis!954D1293832B
TrendMicro: Trojan.Win32.WACATAC.USBLJ726
TrendMicro-HouseCall: Trojan.Win32.WACATAC.USBLJ726
VIPRE: Trojan.GenericKD.81715092
Varist: W64/Agent.NJT.gen!Eldorado
VirIT: Trojan.Win64.Genus.IXB
Webroot: W32.Malware.gen
alibabacloud: Trojan:Win/Kryptik.HVS

Hashes

MD5 954d1293832b5296971ed38e973a9203 🔍
SHA1 0ea03d0aeaf2bd97bf5be2a8f6e6285952881249 🔍
SHA256 fed1a1556b70e2d634b05a951a4c5f89617d80e1b1cde5c620f7cf7b2970fdd5 🔍
SHA3 d31209db84f03dd2f8f4964f920b6d8f96206636a5384f6cc12f8d9f74fd1c3f 🔍
SSDeep 24576:bcu2/AZQJQwUD5eAcj51lirYH1yc6Y4Jm:bc/4ZQeDNe1AcoHxm 🔍
Imports Hash d9c51ea96e8ef1afcbca50ea21b8ac64 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Sep-13 23:38:26
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21000
SizeOfInitializedData 0xdfe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000128F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x106000
SizeOfHeaders 0x400
Checksum 0x110fd8
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b0cf4fb9798c9459f1fb00269d963acf 🔍
SHA1 185ec5f558269a15b76c35e1e909d714dd157354 🔍
SHA256 337fd8004dacd73c8d315c3584495442b10b8175deeb36aa06d91066b83bf5d2 🔍
SHA3 57b43587a6d1add6ba15ce5f3df46c3ba6e13752a4a94c9e88a577a2dfc3e51c 🔍
VirtualSize 0x20e71
VirtualAddress 0x1000
SizeOfRawData 0x21000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47863

.rdata

MD5 cb17a3956f85ad54b02a32ec1d6e3c23 🔍
SHA1 7667b767bae38d339561d94ad54184c54c89fea9 🔍
SHA256 8dd204d881c87e339b2c7bd70d7e9f2d684e21d243f6ce203a2557d9b9fa100a 🔍
SHA3 9adb286f7586dd10e4de58f820d6e7e38daea24b0339cd992f869b469a2c6973 🔍
VirtualSize 0x94484
VirtualAddress 0x22000
SizeOfRawData 0x94600
PointerToRawData 0x21400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.02864

.data

MD5 d7cb09a96900474272789a10f7516ac1 🔍
SHA1 25a7f2f9680447344a12f977527bb5c79ba95a7f 🔍
SHA256 79656a7f9b900d6b48dca4140ace816708c66b31bfee7a48fbc8d5f4d88a3f5d 🔍
SHA3 6196da3204ebe78d2287744cea7c0ec469dc181fa8a060b98a29989a5e3c4588 🔍
VirtualSize 0x2ea0
VirtualAddress 0xb7000
SizeOfRawData 0x2400
PointerToRawData 0xb5a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.36066

.pdata

MD5 12de62e73ceec9296e38c785d7553bd1 🔍
SHA1 52aa6d3c28a2f7486c46f7c36cd3f4f34b86f821 🔍
SHA256 1f7d584fc7a2c90b77f3419d9ddf3d3b7b7511d1587bc593b1976ccc872e5afe 🔍
SHA3 676260a4a7de1d7da91ea0dbd294c0cedd41405a0bdb26aed0582929c9fcd0f2 🔍
VirtualSize 0x12d8
VirtualAddress 0xba000
SizeOfRawData 0x1400
PointerToRawData 0xb7e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.23385

.tls

MD5 ccde5aa10261b46f5a9dd4ccd1b9dd3d 🔍
SHA1 058b0d5c21bc8ce96387bf505e320d48a5059898 🔍
SHA256 4c71089d86fa411bed57c169b656180e4142595d6894962bb1a22f912e4aef51 🔍
SHA3 094079383d2c4b50658a853033e3b2f36a6198c12838f313d2b0a2c255fee07e 🔍
VirtualSize 0x99
VirtualAddress 0xbc000
SizeOfRawData 0x200
PointerToRawData 0xb9200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.21079

_RDATA

MD5 928a9c80ae4b6ea103ee21abeba128c7 🔍
SHA1 6b09e89cdecebc0395e71c6934868994e5b3764f 🔍
SHA256 52226c593e835ff8f4b5b9788ccdc0ec2e90532c201707a774c17dc1e145a21b 🔍
SHA3 a7a1c621334029a6c074604d7b89687163b1428b61ed7f9fcfbfc1af45f5132d 🔍
VirtualSize 0x444
VirtualAddress 0xbd000
SizeOfRawData 0x600
PointerToRawData 0xb9400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.94577

.rsrc

MD5 6be67f54d24aba31f52c6e36586e1f9c 🔍
SHA1 3cdc2751ce9e6d5956cd906b6fae5a9e38b5d939 🔍
SHA256 c86e642cba2093fb51f2406ad7495aa1c3306c29f40f8710be4e6161508bb3a4 🔍
SHA3 d79916e87df0bbff94f488df72e5dfc271a3c0d6f29e96f359826895f7926214 🔍
VirtualSize 0x46e64
VirtualAddress 0xbe000
SizeOfRawData 0x47000
PointerToRawData 0xb9a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.8689

.reloc

MD5 30829c7d36db47ea0350790c76a21c9d 🔍
SHA1 35499f8686f3f07422b9c9b4959125ad1b3b3c29 🔍
SHA256 97c418da6104a372fb4be395ff1bdb8e1868ee5c4ca07186741ae3e7e8d5392e 🔍
SHA3 831cbded7a1b8d23ba9aae77cd12b157f66c6bed40e920c0dd8352b441ecebbb 🔍
VirtualSize 0x6bc
VirtualAddress 0x105000
SizeOfRawData 0x800
PointerToRawData 0x100a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.05196

Imports

kernel32.dll CloseHandle
CompareStringW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStringsW
GetFileAttributesW
GetFileType
GetFullPathNameW
GetLastError
GetLogicalDriveStringsW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessHeaps
GetProcessId
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetThreadId
GetTickCount
GetTickCount64
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsThreadAFiber
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
user32.dll GetActiveWindow
GetDesktopWindow
GetFocus
GetForegroundWindow
GetMessageExtraInfo
GetShellWindow
api-ms-win-core-synch-l1-2-0.dll WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
ntdll.dll NtWriteFile

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x45b
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 5.23582
MD5 4437b3bf8bbe52f3a1e440f9dc20bed9 🔍
SHA1 1e31c1901640e5b5c24037f3d5532e18d0611a92 🔍
SHA256 65a6d3ca8af797e2597b95223031294edbf8251e08b018cb911429d04ec326b1 🔍
SHA3 595db43b636e5f843fef67169577cb1809a7f9377e14272b8c7aa066b2835b84 🔍

1 (#2)

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x40158
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 2.36059
Detected Filetype PNG graphic file
MD5 e88de513aef2b175c87dfcf9072c30f0 🔍
SHA1 2a00c1e832c0b485e146a73994d4508b5bf31549 🔍
SHA256 1e710a16d9231812063527b69b487b5acf0c7489953301ef183b4c8bbb708d8a 🔍
SHA3 690eec3185ec8cf7b018ca2542561708e5b1392f6e38c8e0796f641b64ad974c 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2474
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 2.67695
Detected Filetype PNG graphic file
MD5 9eca000933e3fb8101be3763914e13de 🔍
SHA1 7a471d5f361b605c0bb5c3750e2d452d506ca3c2 🔍
SHA256 2c27900874e583b212881098aaf0e696a1bd4d8d78eb3352d8870514616a1c03 🔍
SHA3 89046144fbbcdc307bbec20c88de544d9b224f5637aca33e4d835294a16096e9 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1064
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 2.82081
Detected Filetype PNG graphic file
MD5 6f4389d8f89e294756c7a06083f3a345 🔍
SHA1 abfe3d9451d04724e9b661d1a99908ef22dc281b 🔍
SHA256 5e03634294fbf2f9fd3756a870f678f85fa7cfee60cc95ff8e94c09ac72479b9 🔍
SHA3 6b9cf0bde7bc69eaf9718572d31a45fe416979c8f13c47eb8ffdd60f73c8c405 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x454
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 3.16335
Detected Filetype PNG graphic file
MD5 29f0d873f352a50d97945c628efb9d68 🔍
SHA1 d1fab3c416d79c15efda2587bdd1a4b38dd87601 🔍
SHA256 eb7bbe507ba4669d0fa8398a84e71c553a0db394ffc4782a909cf4ac35353989 🔍
SHA3 66f72611720d099181508431f1918ac0005bcca468158ab9e5358d2d3aeaba79 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x29d3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96119
Detected Filetype PNG graphic file
MD5 ad929e04573462d9df30c625d673a30a 🔍
SHA1 ecf71efc838437c197516a6b1c374e03c0a98c50 🔍
SHA256 6f3b5f2886254f9070a587fc6d9d28db26af2961fd58931dfe6a95b56ab4d305 🔍
SHA3 b66aafe4fbff33b69491d5b65e9b4ae94693ebbd693e94e2c80bb4952fb57d99 🔍

MAINICON

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.97095
Detected Filetype Icon file
MD5 502f0b9fcc7a1d12382cac58f69d2cc6 🔍
SHA1 b24bf71bfc05bbe7b1f1be9d128747af5915884c 🔍
SHA256 bb49b02824aca11f53f9f8b6d2502ab4b17f0aeb646aae407466e3d81a27e7cc 🔍
SHA3 2ac15289724178fc11450076c0cf76fc7af9e91aabcace70b4bdf54eca46ddac 🔍

1 (#3)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 2.46418
Detected Filetype Icon file
MD5 dfa900010343b02eb96e5b32707d3786 🔍
SHA1 a6f8a7624ca9685bd0cf747b55c93453d3395ce2 🔍
SHA256 fefea84cf6710ac491667865afedacc8a490970b764ef96a9947f9ae360202a4 🔍
SHA3 f520ba117c339cdf02a3cd6576ea74040113290aed37d4d462db0a885c92c2d2 🔍

1 (#4)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x310
TimeDateStamp 2026-Sep-13 23:38:26
Entropy 3.43154
MD5 95ae18f4a39d6f438afaf5905015a8d1 🔍
SHA1 cc591da9d144d7175903c332ac7e0a6a181642f6 🔍
SHA256 14969d26a44db31beef0967a8b1b26e79d2c04d727428803c413d8b1d72ab496 🔍
SHA3 f91eb11018c7c67814486adb02caba4173e42b2a96f75f34bd5545e8ab64a74d 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.7.6.17630
ProductVersion 2.7.6.17630
FileFlags (EMPTY)
FileOs (EMPTY)
FileType VFT_UNKNOWN
Language English - United States
FileDescription prisnumio
FileVersion (#2) 2.7.6.17630
InternalName prisnumio.exe
LegalCopyright Copyright © 2023 Prisnumio Inc.. All rights reserved.
CompanyName Prisnumio Inc.
ProductName prisnumio
OriginalFilename prisnumio.exe
ProductVersion (#2) 2.7.6.17630
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Sep-13 23:38:26
Version 0.0
SizeofData 38
AddressOfRawData 0xb413c
PointerToRawData 0xb353c
Referenced File prisnumio.pdb

TLS Callbacks

StartAddressOfRawData 0x1400bc000
EndAddressOfRawData 0x1400bc098
AddressOfIndex 0x1400b93c4
AddressOfCallbacks 0x1400b4200
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 2026-Sep-13 23:38:26
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400b8880

RICH Header

Errors

Leave a comment

No comments yet.