01f3bbb15c575a6f62ebcb3ee470a51e942f5c414363d8a860132fe828c41fb1

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2025-Jul-04 22:09:17
Detected languages English - United States

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
Suspicious The PE contains functions most legitimate programs don't use. Possibly launches other programs:
  • ShellExecuteA
 Uses Microsoft's cryptographic API:
  • CryptHashData
 Leverages the raw socket API to access the Internet:
  • __WSAFDIsSet
Malicious VirusTotal score: 46/68 (Scanned on 2026-06-17 15:02:24) ALYac: Trojan.GenericKD.76789049
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Malware/Win.Themida.R711710
Alibaba: Trojan:Win64/Themida.7589a574
Antiy-AVL: Trojan/Win32.Convagent
Arcabit: Trojan.Generic.D493B539
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Trojan.GenericKD.76789049
Bkav: W32.Malware.3960ABBD
CTX: exe.trojan.convagent
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.Themida.L suspicious application
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.76789049 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: Riskware/Application
GData: Trojan.GenericKD.76789049
K7AntiVirus: Riskware ( 005cdd9a1 )
K7GW: Riskware ( 005cdd9a1 )
Kaspersky: VHO:Trojan.Win32.Convagent.gen
Kingsoft: Win32.Trojan.Convagent.gen
Lionic: Trojan.Win32.Convagent.4!c
Malwarebytes: Malware.Heuristic.2025
McAfeeD: Real Protect-LS!9138B3F7D689
MicroWorld-eScan: Trojan.GenericKD.76789049
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Panda: Trj/Chgt.AD
Rising: Trojan.Convagent!8.12323 (CLOUD)
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win64.Dropper.rc
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.10c404c1
Trapmine: malicious.high.ml.score
TrellixENS: Artemis!9138B3F7D689
VIPRE: Trojan.GenericKD.76789049
Varist: W64/Trojan.GJD.gen!Eldorado
alibabacloud: Trojan:Win/Sabsik.FE
tehtris: Generic.Malware

Hashes

MD5 9138b3f7d68901fdcc5b33bac057b208
SHA1 5c11c35d8ccd26232f98a872ab361ab547e97dbb
SHA256 01f3bbb15c575a6f62ebcb3ee470a51e942f5c414363d8a860132fe828c41fb1
SHA3 27ee806ce17806ce97305a7d91c6c1d06fa4002656cea9d0162d57b09ab198f7
SSDeep 98304:lHf+owXfiTPoI/8E8liT2I8bpLZLoO/0omH:9+Tc38E8oSIILLBUH
Imports Hash 86ef62a0fcdc62a2a44965890e8d63c1

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x130

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 13
TimeDateStamp 2025-Jul-04 22:09:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xed400
SizeOfInitializedData 0x58a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000007C1058 (Section: .boot)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xb9b000
SizeOfHeaders 0x600
Checksum 0x488af9
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 3eac958cdc7949392e99b514aced7237
SHA1 4eecfb1fdee1d82ae3063309d5461dc948d93425
SHA256 e4bf9bf422ea40817afc24f033d26cec0080c0635170ced281d987192ae39595
SHA3 b54abad1e89a0eaa814924be4260d43109f06475ed68f004dd3c9d37325aaccd
VirtualSize 0xed3d8
VirtualAddress 0x1000
SizeOfRawData 0x7ba00
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.99022

(#2)

MD5 3aa4eb35b99f704af4181314eb08e76e
SHA1 c75cd634853cd25d09ce74d157be55f3cd123bce
SHA256 09906ef3c263d80af97bd9e6694cbd852f1c42f69378f8ec13820a517abe6b14
SHA3 c464dc90e7d89cb2d267940e762d5e56cb8b60e37c4f8bbd3566b6b02afe409e
VirtualSize 0x48354
VirtualAddress 0xef000
SizeOfRawData 0x24c00
PointerToRawData 0x7c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.98214

(#3)

MD5 5730e4e9d58f8473aaf0547fea34428d
SHA1 2833eaa97c17a133390cd150a585fa0399ac1110
SHA256 cb3ec1e4a6054c04edea8ea63aec62d7801fb9d8876d3035626f83b833d3e401
SHA3 784d25251f17d6699a0bdd5de049d49cbe2c9943c11ceee9c10ac0890a2d6716
VirtualSize 0x4980
VirtualAddress 0x138000
SizeOfRawData 0xc00
PointerToRawData 0xa0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.74932

(#4)

MD5 fc788e8e250eb9d829cc555c60d2fd46
SHA1 a76253e541e4a63d48f91d4328ce2c1fec46a070
SHA256 e2d2d13fe58912d9491f1c35b5f7c03f45ccc7a3bc93addc6619ab1114c69932
SHA3 038799ffc14da55716f8472e58216951dc35703fb4ea233f4f27e635a4306cf5
VirtualSize 0xa2fc
VirtualAddress 0x13d000
SizeOfRawData 0x6200
PointerToRawData 0xa1800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.6435

(#5)

MD5 2deb7b2c8a075b1374907551ccec74da
SHA1 c1e171d887d1deeaa343499932762984b55e880e
SHA256 f316a0c90d2b9b284b2f187878ff64583c1c4d491a833949e5c0494284cc4913
SHA3 4a549604865522826c9d74e83431d490c470d6a747d9724c089c04b7d2ba22a7
VirtualSize 0x100
VirtualAddress 0x148000
SizeOfRawData 0x200
PointerToRawData 0xa7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.10191

(#6)

MD5 49e34744a908397ede1be7e1143046a7
SHA1 3e47b00589236eafe56aee75f36c15434e2742e1
SHA256 22f5503f6471aceab297b911a5d077930706a9b50dac6992c8b9a666ba284825
SHA3 891c8db7706e43d8a45c25afcc9c84167a8656f0c79b4d70d7f51c7c11335d44
VirtualSize 0x1e8
VirtualAddress 0x149000
SizeOfRawData 0x200
PointerToRawData 0xa7c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.755

(#7)

MD5 faf7faa2074e9afcc8048f302fa6fdbc
SHA1 8b4973c6a60a8a6301a2d58e17805ed4d3d0455e
SHA256 c8d925a158f42c17d89ee66258cae54c161fd74021a64bb2b59984e72b627ebb
SHA3 70f9e4509411b675b71b7aa28d3c8b3f2c7e893b7b9018e88c63fcb20a781a0c
VirtualSize 0x13ec
VirtualAddress 0x14a000
SizeOfRawData 0xa00
PointerToRawData 0xa7e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.76089

.idata

MD5 00582af2046c277ee9d79600ec0f9040
SHA1 ef774047aab3eddc3e61bbdfd3bdf44d5cad61cf
SHA256 1e3a5bc70b9cba510bb03b235866eb7d613ca95329aa19b22a382242297579bd
SHA3 535e4f4c42154b8b83571a337b8eea954ee68e6356467ba355169b31466c45c2
VirtualSize 0x1000
VirtualAddress 0x14c000
SizeOfRawData 0x400
PointerToRawData 0xa8800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.96402

.tls

MD5 904a50e468094f2380d7b2d2737f941a
SHA1 5799a217e9e3739a4e07416acc89ddfbb436efa3
SHA256 3448a6e298eb68730e2d61a413465e582767264e5d4fe784b1369b2202fcd6de
SHA3 7025898f9c2a2df9b2804e71631a0a1b73101e7062eb31ef9e0038ab6c51a5c6
VirtualSize 0x1000
VirtualAddress 0x14d000
SizeOfRawData 0x200
PointerToRawData 0xa8c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.284569

.rsrc

MD5 bb61e378a0bbcff381973cfbb2091027
SHA1 00003a458eac0c62c3cce836c5deee3436adb2e1
SHA256 db44828aae600cb9985541b51c391ec76fa95073f596fa110e11abc5bcb4f3c1
SHA3 4924f6ef26cec867934ca9cc5cae07516a231ca46c352f54bde630e72b3b3f73
VirtualSize 0x1000
VirtualAddress 0x14e000
SizeOfRawData 0x200
PointerToRawData 0xa8e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.76554

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x672000
VirtualAddress 0x14f000
SizeOfRawData 0
PointerToRawData 0xa9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 a45b4de184a7c55f63c36731b40f9226
SHA1 04dce91aa7aaa62ab9561d5d08d42839344e2957
SHA256 1cbf75032e8e29f6b8cb5082a105f5e6e0071a2eb5081fc8551c108623642985
SHA3 33bab6e92a0f4b63c6606d9fc6e0bcebe235627cdc27876bdf44f7974a2590d7
VirtualSize 0x3d9000
VirtualAddress 0x7c1000
SizeOfRawData 0x3d9000
PointerToRawData 0xa9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.9599

.reloc

MD5 58c5daacaebc4ead4253fc0bd0cb34ac
SHA1 5f48f5b89804edf76e589d898df4718c9582aaff
SHA256 5804b28dc9c9a0550a8978df83a542b3bda5433e03deebb331934e03e3f6ca04
SHA3 b2ec7526361805b62e31afc6c79f6509f23ab26ce52a5451c4de9e0adef1a27e
VirtualSize 0x1000
VirtualAddress 0xb9a000
SizeOfRawData 0x10
PointerToRawData 0x482000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 2.4746

Imports

kernel32.dll GetModuleHandleA
USER32.dll GetWindowThreadProcessId
ADVAPI32.dll CryptHashData
SHELL32.dll ShellExecuteA
ntdll.dll RtlInitUnicodeString
CRYPT32.dll CertCloseStore
WS2_32.dll __WSAFDIsSet
SHLWAPI.dll PathFindFileNameW
PSAPI.DLL GetModuleInformation
USERENV.dll UnloadUserProfile
bcrypt.dll BCryptGenRandom

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x184
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91862
MD5 3250787fdcd75aa2587529b89c7738b2
SHA1 622b5627941ecee9cfe6179c3017bbf7b43fffaa
SHA256 8b0de2e560d8476fb0013b44f1e10c2789ae71e0353866890dc5f9c57fb1f44a
SHA3 6bf4f0eaf6795c219d4d808caa895dcb53f7fe9c81e92ce03da1db7841bfcd3d

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x8c1aa86d
Unmarked objects 0
C++ objects (33140) 210
C objects (33140) 18
ASM objects (33140) 7
253 (34321) 7
ASM objects (34321) 10
C objects (34321) 19
Imports (2207) 2
C++ objects (34321) 102
Imports (33140) 25
Total imports 295
C objects (33523) 43
C objects (VS2022 Update 6 (17.6.4) compiler 32535) 129
C++ objects (34809) 5
C++ objects (LTCG) (34810) 6
Resource objects (34810) 1
Linker (34810) 1

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.