Manalyze report for 01944f430d62b3c8ae1222ed97cdff58e9657ce7fd9a48fcf0ff5c13e4cf0a6c

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Sep-12 23:30:32
Detected languages	English - United States
CompanyName	cold.wtf
FileDescription	cold.wtf loader
FileVersion	`1.0.0.0`
InternalName	coldwtf-injector
OriginalFilename	coldwtf-injector.exe
ProductName	cold.wtf
ProductVersion	`1.0.0.0`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` `Contains domain names: cold.notify.info github.com http://www.w3.org http://www.w3.org/2000/svg https://github.com https://openfontlicense.orgInter-BoldVersion https://openfontlicense.orgInter-MediumVersion https://openfontlicense.orgInter-RegularVersion https://openfontlicense.orgInter-SemiBoldVersion https://scripts.sil.org https://scripts.sil.org/OFLJetBrainsMono-BoldVersion https://scripts.sil.org/OFLJetBrainsMono-MediumVersion notify.info scripts.sil.org www.w3.org`
Info	Cryptographic algorithms detected in the binary:	`Uses known Mersenne Twister constants`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Code injection capabilities: CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory` `Can create temporary files: CreateFileW GetTempPathW` `Memory manipulation functions often used by packers: VirtualAllocEx VirtualProtect` `Manipulates other processes: OpenProcess WriteProcessMemory Process32FirstW Process32NextW`
Malicious	The PE is possibly a dropper.	`Resource 5001 detected as a PE Executable.` `Resources amount for 91.1188% of the executable.`
Malicious	VirusTotal score: 20/62 (Scanned on 2026-10-05 04:58:06)	`APEX: Malicious` `AhnLab-V3: Trojan/Win.Generic.C5954188` `Antiy-AVL: Trojan/Win32.Agent` `Bkav: W32.Malware.6236C50A` `CTX: exe.trojan.generic` `Cylance: Unsafe` `Elastic: malicious (high confidence)` `Fortinet: W32/PossibleThreat` `Ikarus: Trojan.Win32.Wacatac` `Lionic: Trojan.Win32.Generic.4!c` `McAfeeD: ti!01944F430D62` `Microsoft: Trojan:Win32/Kepavll!rfn` `Paloalto: generic.ml` `SentinelOne: Static AI - Suspicious PE` `Sophos: Generic ML PUA (PUA)` `Symantec: ML.Attribute.HighConfidence` `Trapmine: malicious.moderate.ml.score` `TrellixENS: Artemis!2706E00593F7` `Varist: W64/ABApplication.ERZE-2594` `Webroot: Win.Riskware.Gen`

Hashes

MD5	`2706e00593f772adaf7e1a8ae83119f2` 🔍
SHA1	`02ba1e7793104663e32a83769ff9a7cc3c7e0c30` 🔍
SHA256	`01944f430d62b3c8ae1222ed97cdff58e9657ce7fd9a48fcf0ff5c13e4cf0a6c` 🔍
SHA3	`6660f46547de5307e69f3b5e351eee33f4a64683d147f8b0f4748daaabed8118` 🔍
SSDeep	`24576:ECfWXXirddRRrT/342oOaAolH4lCSkxqEHfblN19gvq5sE+BGFzUfz1:ERipdfPmOaA4H4lTkNfbb5sE+BG` 🔍
Imports Hash	`42377730a6a3d3624ec1cbed17df2552` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Sep-12 23:30:32
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x1e000`
SizeOfInitializedData	`0x207a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000007A60 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x22a000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d2d9d857d151f25f35b42749b0125485 🔍`
SHA1	`68a2f1c8b64aa64cc584b61516bdb0114401c7ec 🔍`
SHA256	`b4028f81b096dd4c5b67a49812a405060d1900ea108da8e9e090afdac3d5d92b 🔍`
SHA3	`8a0f6f32eb99e3f5b4919696a2cd862237662b7222dce91e607127ae6b01c119 🔍`
VirtualSize	`0x1df20`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1e000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.47891`

.rdata

MD5	`0d378f0ec1cdeef6839d1a17415c892d 🔍`
SHA1	`30573b93216e0c13c0a45703bf51f32925163cde 🔍`
SHA256	`6ab233796d0e1c719883863930eb8f8a0e7453e49cda0e85bc108c99fec7b91a 🔍`
SHA3	`c659e7605d424071ce2c1fbcd0f817b960f987f1d22e5b56d3c472e0e671fa93 🔍`
VirtualSize	`0xf210`
VirtualAddress	`0x1f000`
SizeOfRawData	`0xf400`
PointerToRawData	`0x1e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.21647`

.data

MD5	`3affcbdbe7f0a47ffda8a8c180927bfb 🔍`
SHA1	`8a1a59db68c6ad70b9cf370174ab10b08afa99e2 🔍`
SHA256	`cc79eb3b472620821a40e7979ebb6f86caaf135fde5110da790325615ce5f23f 🔍`
SHA3	`3dc852455cbd94ea0f8735459323868386754380fa73fdb8cbc8b9df87723316 🔍`
VirtualSize	`0x1810`
VirtualAddress	`0x2f000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x2d800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.27743`

.pdata

MD5	`06ae6917a29abf6d3a8c53290c5d968a 🔍`
SHA1	`d2385a6e68d0453b69b37c761adbc90538a56e3d 🔍`
SHA256	`37091924cb86afb26b9d830d01d51ab705af7a52b73d9ad4aac727f25cd50ae8 🔍`
SHA3	`b98e94f554ede783f2d5c239bfb72c6c46124c7b8a1effc7a6e52a0e1fb24d16 🔍`
VirtualSize	`0x1a88`
VirtualAddress	`0x31000`
SizeOfRawData	`0x1c00`
PointerToRawData	`0x2e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.1144`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x33000`
SizeOfRawData	`0x200`
PointerToRawData	`0x30000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`ae2e924ec0f78979a59f898813ccf3e4 🔍`
SHA1	`8e777925317eb4a3313858d8dcd4bd612f7cca74 🔍`
SHA256	`8b1293d4b0c5f264b262356034c8288847129f0e8b971e87fa380668e8801b48 🔍`
SHA3	`6e5a49348b712aa065f8102a289a4e834045b5f793c4c8cb4898cd3eba17673f 🔍`
VirtualSize	`0x1f4600`
VirtualAddress	`0x34000`
SizeOfRawData	`0x1f4600`
PointerToRawData	`0x30200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.5817`

.reloc

MD5	`fcac72465e1ef62fd9f97bdc617222e3 🔍`
SHA1	`57fb36676a25a8c75198fb7647a612601e2b8c60 🔍`
SHA256	`4e130a065cd035524f61b7213aa3755b1995040d7ea3917625e6721962ecffe3 🔍`
SHA3	`f395f953a69d27373de64d7f7093d2ccd870753119849f772af12229af40df31 🔍`
VirtualSize	`0x6bc`
VirtualAddress	`0x229000`
SizeOfRawData	`0x800`
PointerToRawData	`0x224800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.02546`

Imports

USER32.dll	`GetWindowThreadProcessId` `EnumWindows` `GetWindowTextLengthW` `GetWindowTextW` `IsWindowVisible`
KERNEL32.dll	`FlsGetValue` `HeapReAlloc` `HeapSize` `SetFilePointerEx` `GetConsoleOutputCP` `FlushFileBuffers` `GetStdHandle` `GetFileAttributesW` `GetFullPathNameW` `Sleep` `GetTickCount64` `GetModuleFileNameW` `GetConsoleMode` `SetConsoleMode` `SetConsoleOutputCP` `GetConsoleCursorInfo` `SetConsoleCursorInfo` `CloseHandle` `GetLastError` `WaitForSingleObject` `CreateRemoteThread` `GetExitCodeThread` `OpenProcess` `VirtualAllocEx` `WriteProcessMemory` `VirtualFreeEx` `IsWow64Process` `GetModuleHandleW` `GetProcAddress` `LocalFree` `FormatMessageW` `CreateToolhelp32Snapshot` `Module32FirstW` `Module32NextW` `Process32FirstW` `Process32NextW` `CreateDirectoryW` `CreateFileW` `GetFileSizeEx` `ReadFile` `WriteFile` `GetTempPathW` `LoadResource` `LockResource` `SizeofResource` `FindResourceW` `MultiByteToWideChar` `WriteConsoleW` `QueryPerformanceCounter` `GetCurrentProcessId` `GetCurrentThreadId` `GetSystemTimeAsFileTime` `InitializeSListHead` `SetUnhandledExceptionFilter` `GetStartupInfoW` `RtlPcToFileHeader` `RaiseException` `RtlLookupFunctionEntry` `RtlUnwindEx` `SetLastError` `FlsAlloc` `FlsSetValue` `FlsFree` `EncodePointer` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `GetCurrentProcess` `ExitProcess` `TerminateProcess` `FreeLibrary` `GetModuleHandleExW` `GetCommandLineA` `GetCommandLineW` `IsProcessorFeaturePresent` `GetNumberOfConsoleInputEvents` `ReadConsoleInputW` `PeekConsoleInputA` `HeapFree` `HeapAlloc` `WideCharToMultiByte` `RtlCaptureContext` `RtlVirtualUnwind` `IsDebuggerPresent` `UnhandledExceptionFilter` `VirtualProtect` `LoadLibraryExW` `CompareStringW` `LCMapStringW` `GetFileType` `FindClose` `FindFirstFileExW` `FindNextFileW` `IsValidCodePage` `GetACP` `GetOEMCP` `GetCPInfo` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `SetStdHandle` `GetStringTypeW` `GetProcessHeap`

Delayed Imports

5001

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1eb600`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.56413`
Detected Filetype	PE Executable
MD5	`7898a463082596bf1f7caa6859a25aaf 🔍`
SHA1	`bcc491c441ec4da6df59ea07dd4bb7950649b7c4 🔍`
SHA256	`20d6a0dd279d65f5e534051383acbae0919e0a55374514ed1f54277007f11367 🔍`
SHA3	`329e8af2a83d7d3794354459b1a4ded75cd285037afb9d2eecff7fd6fce74657 🔍`

5100

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xf80`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.53387`
MD5	`01660f605128ed78acc8e2d26b84146c 🔍`
SHA1	`954e06ff22d8c785ae002d5a8300db5f0ad8c19e 🔍`
SHA256	`f76a2eecf2c3ffd8e1ab9b3a394cb0bc3cf9a4e590216cb59ebe7520df6d23fd 🔍`
SHA3	`0a924fb782df69264cecdf7b1367794b2211dd71c051daaaa380c0f1f6b5e53b 🔍`

5101

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x872`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.65148`
MD5	`937664ea1cbe6bf581321e3d835d606f 🔍`
SHA1	`039b928cf56080099eefe3a2229dfc7efdad3178 🔍`
SHA256	`9872e21cbbcf3129ec61a62186777eafa7f0fb54d0aa3ed9a63ca4cf2b3b8fc7 🔍`
SHA3	`8b867747a97bc7e81135c362f25b14789bcfe90219547161d8fda5e8ddd2dc83 🔍`

5102

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x917`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.6093`
MD5	`26428b5601a599b64487c83885f16412 🔍`
SHA1	`c80ed3598bd6f3a1c990c3fec71c24e3433c4f37 🔍`
SHA256	`4e326205178fe4022a34492c7ab7a9f896c5302c05398e60e2caf1d9a3681287 🔍`
SHA3	`beae28981c8b2804d989c0b37324993e14f5a1c8d39142ba0b8b88c3e9df7f6d 🔍`

5103

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xfbd`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.63614`
MD5	`fce60b2c2d0575f7217f3fd74353519c 🔍`
SHA1	`fe5f04bc5cdc883a8ad401365614eaf5327ba3f5 🔍`
SHA256	`30e28c2d4b712a5f89d4aad1650685f676ae1535a90cb08bd1ba0d89f3728f07 🔍`
SHA3	`69676a945f9ffb429230b0493466422f05c7262f7cb91d061c9ca5ea8b8a94cb 🔍`

5104

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xbee`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.37702`
MD5	`4974ea9ea64ded636816ddf6351012d6 🔍`
SHA1	`6e1275e40c9536cb2ab41492c8843b358ffaa726 🔍`
SHA256	`39bc79dea5d01a667641b3655b5e10adb08291f685c687c231cd574e390a915a 🔍`
SHA3	`350d4326c83b121101cde1973648aaf910218b4dc3c1e9e0ed8a8772a6f3e82f 🔍`

5105

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4d27`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.82247`
MD5	`73b63e1ab5d83d567f2602a1ccf72eed 🔍`
SHA1	`8442a468172e58fee7afdc7395e55cab71365ae9 🔍`
SHA256	`16a420d77bfd51de48462482bb292fda99f438f4476d18f89e936bff0452139b 🔍`
SHA3	`2fdd420df580fe55299b5258cf21fa0e7054c91179ac15aa492b81f6a1c22940 🔍`

1

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x288`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.24196`
MD5	`f3a4653a4ee86b432bad39f6644bc2e8 🔍`
SHA1	`0982c9845a5492fb4d2c9f72169143832e34500f 🔍`
SHA256	`b2e666bb9b0ecbbf8aa25b0f365b74f62fd09d374dc41c2ad52edab83e55afd5 🔍`
SHA3	`99b8cd8900ce1543086f2213432279b0b266949b0f22c90eab4781f4660f03fa 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	cold.wtf
FileDescription	cold.wtf loader
FileVersion (#2)	1.0.0.0
InternalName	coldwtf-injector
OriginalFilename	coldwtf-injector.exe
ProductName	cold.wtf
ProductVersion (#2)	1.0.0.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-12 23:30:32
Version	`0.0`
SizeofData	`840`
AddressOfRawData	`0x2b1e8`
PointerToRawData	`0x2a5e8`

TLS Callbacks

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x14002f000`

RICH Header

XOR Key	`0x2dc470c6`
Unmarked objects	`0`
C++ objects (33145)	`148`
C objects (33145)	`12`
ASM objects (33145)	`7`
ASM objects (35721)	`10`
C objects (35721)	`17`
C++ objects (35721)	`44`
Imports (33145)	`5`
Total imports	`124`
C++ objects (36256)	`5`
Resource objects (36256)	`1`
151	`1`
Linker (36256)	`1`

Errors

Leave a comment

No comments yet.