ffef5fb643931961e8cc9e4da5b5a2120abbe3539f70bd13dd417e7e923e35f3

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-17 08:27:16
Detected languages English - United States
TLS Callbacks 5 callback(s) detected.
Debug artifacts fluemaampuews.pdb
CompanyName hyilleothuitts s.p. z o.o
InternalName Fluemaampuews.exe
OriginalFilename Fluemaampuews.exe
ProductName Fluemaampuews
ProductVersion 1.0.23.2672
FileVersion 1.0.23.2672

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • QemU
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Uses Windows's Native API:
  • NtReadFile
  • NtWriteFile
 Enumerates local disk drives:
  • GetLogicalDriveStringsW
Malicious VirusTotal score: 11/71 (Scanned on 2026-08-19 10:04:17) APEX: Malicious
AVG: FileRepMalware [Misc]
Avast: FileRepMalware [Misc]
Bkav: W32.Malware.F15022CB
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
ESET-NOD32: Win64/GenKryptik.HTSF trojan
Elastic: malicious (high confidence)
Microsoft: Trojan:Win32/Sabsik.FL.A!ml
Rising: Trojan.Kryptik@AI.97 (RDML:o/N8mgyhmnhzYBqyow8dpA)
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 f91c8b1096d9eb1bb437d0dc83d5eceb 🔍
SHA1 8b55c57bbd0f0c6136ec22190716f2f858524b84 🔍
SHA256 ffef5fb643931961e8cc9e4da5b5a2120abbe3539f70bd13dd417e7e923e35f3 🔍
SHA3 50e295d3a4d58af8fecf2af480c1701235629b7ce017bfc0882af632db6a9c4d 🔍
SSDeep 12288:v3sLW5k6mUHnFwoiKFQAiLrpR6hjltYwXIo7WzGhE4BX:UPUHnFwaC5MawXICXX 🔍
Imports Hash db66d04f263872c8277107fde830f018 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-17 08:27:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x19600
SizeOfInitializedData 0x6a800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000C1F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x89000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 15f83c55264575fd9176fa5c3b0d0f5a 🔍
SHA1 90591587b889aeae8f26a00eec5c3035cb1c7ae0 🔍
SHA256 7bae8a1a61808bbd565c849af47c09a00041f3b46bb9147dccb690210667db52 🔍
SHA3 0775207979fc4673434be5a6947a16a750617504e6720f98d579374883002cbd 🔍
VirtualSize 0x19440
VirtualAddress 0x1000
SizeOfRawData 0x19600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47302

.rdata

MD5 d7aa7a10e14fbff8d4c40f5301642b3c 🔍
SHA1 159c31b80d69168e6c5546406b9cd3fd6e4f4494 🔍
SHA256 ca35af85bc16dd2f8d8ee2eaf4cec5ab66f38914b483207b212b63850d8f9119 🔍
SHA3 fc1ccd8dd379791d78b6725de302d59f05f931be852938fafc1de4ca4c3362a5 🔍
VirtualSize 0x65230
VirtualAddress 0x1b000
SizeOfRawData 0x65400
PointerToRawData 0x19a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.12755

.data

MD5 5c2bdfa0f938a892b95ed74b4baf8164 🔍
SHA1 76348fc95bd903bafcd1920fc1026a4418dba3b2 🔍
SHA256 def25c6c8c7b72f896ccd81037eedc838b35d241d386e169fb5358dafad79838 🔍
SHA3 c9aa770e7cb4375aa0c92eb0fc6180cb068331cdebd54fe2c7b97bf09541ff1c 🔍
VirtualSize 0x33e8
VirtualAddress 0x81000
SizeOfRawData 0x1a00
PointerToRawData 0x7ee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.04213

.pdata

MD5 61ce143973a09ad1deea7c858bbc6bf4 🔍
SHA1 0c4eb7dc86534e630f60b5c25e24256cd676a1a8 🔍
SHA256 ea7abe5251d8c6f0c9b11e55ba8a6c84dda230c6de41ccae107a099dc06d427c 🔍
SHA3 f09303639ab38f95e6d9eeb6a4c81b79e3d09759113d9b444a9fbe4d28960136 🔍
VirtualSize 0x12e4
VirtualAddress 0x85000
SizeOfRawData 0x1400
PointerToRawData 0x80800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.04519

.rsrc

MD5 abeabdd34b9d17ce40332b9d20046a52 🔍
SHA1 84c8eed02551b53b407083c19c7a2098f8c2487c 🔍
SHA256 650f74b0cb881b9f4bea83b41d35b1b0ff3bc1c89312e7a405ec168770f6bb02 🔍
SHA3 61ebd42ebfb21b091831a3032fd2c234a666579fab72ce2aaf2dac476ce55f4f 🔍
VirtualSize 0x2d0
VirtualAddress 0x87000
SizeOfRawData 0x400
PointerToRawData 0x81c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.43303

.reloc

MD5 d3338bffa650d208fc79e5f2862a9e0d 🔍
SHA1 47f12341eaf028b8b1108987f8a5e24b3edd2097 🔍
SHA256 05911202ebaed67624912b933381a571e7d101b8f18e1037d22aef77a6a0a326 🔍
SHA3 9ec2dedcab9f1cc05291343da059f924882e53ed06af52db642159711ba428f0 🔍
VirtualSize 0x76c
VirtualAddress 0x88000
SizeOfRawData 0x800
PointerToRawData 0x82000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.28429

Imports

kernel32.dll GetLogicalDrives
GetACP
GetSystemInfo
GetOEMCP
GetLogicalDriveStringsW
GetProcessHeap
HeapReAlloc
GetLastError
MultiByteToWideChar
HeapAlloc
GetProcAddress
SetFileInformationByHandle
WriteConsoleW
HeapFree
WaitForSingleObject
GetFileAttributesW
CloseHandle
GetUserDefaultLangID
GetSystemDefaultUILanguage
LoadLibraryA
GetUserDefaultUILanguage
GetCurrentProcess
GetSystemDefaultLangID
GetThreadLocale
GetCurrentThread
GetCurrentThreadId
GetFileInformationByHandle
GetFileInformationByHandleEx
GetNativeSystemInfo
GetVersion
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
ReleaseSRWLockExclusive
SetLastError
CreateFileW
SetFileTime
GetFullPathNameW
GetModuleHandleA
SetFilePointerEx
GetModuleHandleW
GetCommandLineA
GetEnvironmentStringsW
GetUserDefaultLCID
GetCommandLineW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetModuleFileNameW
ExitProcess
TerminateProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetCPInfo
WideCharToMultiByte
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
HeapSize
FlushFileBuffers
GetConsoleOutputCP
ntdll.dll NtReadFile
RtlGetVersion
RtlNtStatusToDosError
NtWriteFile
WINMM.dll timeGetTime
mixerGetNumDevs
midiInGetNumDevs
midiOutGetNumDevs
KERNEL32.dll WriteFile

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x270
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37602
MD5 6ec9ce4af2b3b014b7d10bd435d42175 🔍
SHA1 5e803de8c1e5a4c441d3bb72f52d0f46313647ff 🔍
SHA256 6055a16d65333280b3c6a5648ab52e24decb8f2decc8ed3a7b1fe023216156d5 🔍
SHA3 763a2e8c3baf22b798665d8e46e06fc4ef35676f51fee6b7f0018e72b34278bb 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.23.2672
ProductVersion 1.0.23.2672
FileFlags (EMPTY)
FileOs (EMPTY)
FileType VFT_UNKNOWN
Language English - United States
CompanyName hyilleothuitts s.p. z o.o
InternalName Fluemaampuews.exe
OriginalFilename Fluemaampuews.exe
ProductName Fluemaampuews
ProductVersion (#2) 1.0.23.2672
FileVersion (#2) 1.0.23.2672
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Aug-19 08:43:50
Version 0.0
SizeofData 42
AddressOfRawData 0x7e010
PointerToRawData 0x7ca10
Referenced File fluemaampuews.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Aug-19 08:43:50
Version 0.0
SizeofData 20
AddressOfRawData 0x7e03c
PointerToRawData 0x7ca3c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-19 08:43:50
Version 0.0
SizeofData 1032
AddressOfRawData 0x7e050
PointerToRawData 0x7ca50

TLS Callbacks

StartAddressOfRawData 0x14007e4a0
EndAddressOfRawData 0x14007e538
AddressOfIndex 0x140083340
AddressOfCallbacks 0x14001b410
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x0000000140004F80
0x0000000140005250
0x0000000140001720
0x0000000140003130
0x000000014000B130

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140081dc0

RICH Header

XOR Key 0x5f5aec2
Unmarked objects 0
Unmarked objects (#2) 3
Total imports 170
Resource objects (34714) 1
Imports (34114) 2
Imports (34408) 8
Linker (34714) 2
ASM objects (34114) 1
ASM objects (34408) 39
C++ objects (34408) 121
C++ objects (34714) 42
C++ objects (LTCG) (34714) 2

Errors

Leave a comment

No comments yet.