024c922634ced1a60cf41ddbef32b610062cb7525ce3e2a0343f396574261afe

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-May-07 14:25:14
Detected languages English - United States

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Microsoft's Cryptography API
Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
The PE only has 7 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Uses Microsoft's cryptographic API:
  • CryptAcquireContextW
 Leverages the raw socket API to access the Internet:
  • WSACleanup
Malicious VirusTotal score: 26/70 (Scanned on 2026-07-20 18:56:49) ALYac: Gen:Variant.Lazy.710289
AVG: Win64:Evo-gen [Trj]
Arcabit: Trojan.Lazy.DAD691
Avast: Win64:Evo-gen [Trj]
Avira: TR/W64.Evo
BitDefender: Gen:Variant.Lazy.710289
Bkav: W32.Malware.3228B3C0
CTX: exe.unknown.lazy
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/Packed.Themida.AE suspicious application
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Lazy.710289 (B)
F-Secure: Trojan.TR/W64.Evo
GData: Gen:Variant.Lazy.710289
K7AntiVirus: Trojan ( 006d9bf01 )
K7GW: Trojan ( 006d9bf01 )
Malwarebytes: Malware.AI.1430581861
McAfeeD: ti!024C922634CE
MicroWorld-eScan: Gen:Variant.Lazy.710289
Microsoft: Trojan:Win32/Wacatac.B!ml
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
VIPRE: Gen:Variant.Lazy.710289

Hashes

MD5 fd05dc22412fa2c49c5025030d84cba9
SHA1 82863c4192cf64f98f65339286ffd30d8f7bf92f
SHA256 024c922634ced1a60cf41ddbef32b610062cb7525ce3e2a0343f396574261afe
SHA3 d9b9b9448588baac8773d5221ebfc076ac340ad3a06aca4a5978e690056ee1ba
SSDeep 98304:B8Ad4KeFPDU8RwiVicsl6N2yXiwccjRtf0EUwp8eAer7PAXhcch5419FSz:Brd4vFPDU829xlLyywcclAdPHz
Imports Hash df70027ad4f231d854301ead9d87b83d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 16
TimeDateStamp 2026-May-07 14:25:14
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x374000
SizeOfInitializedData 0x4e6e00
SizeOfUninitializedData 0x4e00
AddressOfEntryPoint 0x0000000000953005 (Section: .themida)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0xb7a000
SizeOfHeaders 0x600
Checksum 0x5cbd9d
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 134c113d23f797dcc8d790163b59e0b2
SHA1 3c8c4b64ae3d6bcbb12915990fdc7b5e1ada4c03
SHA256 28a7452a62c9e8e6f318ed5f1a78d82c6e720ae257f584dac66b344c5fc0623f
SHA3 5e8c37afb36efe95c80da709d88ce550f444ebf37168cc99c1aa66eb63b8ae0f
VirtualSize 0x373ec0
VirtualAddress 0x1000
SizeOfRawData 0x102800
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.99979

(#2)

MD5 d053d9a512ab38c28b7a845c79f3265a
SHA1 336e88913e37937c512c5efc048cd79046d544d4
SHA256 f19b2a605edbc02b36256bfbbcf3c8a0e1a12ce7a8dad8182dd1d47507ae52cc
SHA3 12b7bb77b277ea7b1cf1caf485867763cb07d123e0d0138ef7739977ae3b0eb8
VirtualSize 0x36e750
VirtualAddress 0x375000
SizeOfRawData 0x134400
PointerToRawData 0x102e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99987

(#3)

MD5 55253792b383557d0d4b71c2c8b46c09
SHA1 58323a5c638263bb1109de62a8d99b5ee980922a
SHA256 419a33bc3dd6d3d06ea32ce73225f62f104c3ac1748ac22d892e48d795422b69
SHA3 3aacf4e0332cf63a74c77f4eb7dd12750f4e742b5ee58e44a698c2e574792ae8
VirtualSize 0x2e180
VirtualAddress 0x6e4000
SizeOfRawData 0x28400
PointerToRawData 0x237200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99795

(#4)

MD5 6600246f8e7ec87a803f9c0a5ff9a36e
SHA1 e15f71336748aaf7895f3c08ebe183212afc59f8
SHA256 4454c7754657d0f630d10b71d21a2c02a3bf5c7e006a78618c8c414b8020141a
SHA3 807f933888b3cf697725838d78d67610a7f467d2f3d25f23f11efbdc0115c0bd
VirtualSize 0xdc830
VirtualAddress 0x713000
SizeOfRawData 0x31400
PointerToRawData 0x25f600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.9981

(#5)

MD5 b3c0237ccab126d17790d8e1720ce551
SHA1 0dd3829dd567468fb0974ceeebff82782e1064bd
SHA256 de3ed81d3fd97fd495489eac3bdde8350ce0f687866150beb55d02b04e7a58f0
SHA3 94fb76e5339fc98676628decd8206c7aa4101222d426b1158dfdb973f810b5ff
VirtualSize 0x20730
VirtualAddress 0x7f0000
SizeOfRawData 0xa000
PointerToRawData 0x290a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.98089

(#6)

MD5 c0fa8e2c43927c01dfe00f79d7fbebe7
SHA1 bef10ba3a08fcaec3c9b7d01850371e90ebadb97
SHA256 f956528a5ed5c5ca520a137b2292985622389a98811de47d6fd59b46272aae6c
SHA3 7ab23ceed60f39e3e47030581940bfd1f4a14f6b7f0ae16081d305d5eb36c2a1
VirtualSize 0x1b5ac
VirtualAddress 0x811000
SizeOfRawData 0x2a00
PointerToRawData 0x29aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.96012

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x4d88
VirtualAddress 0x82d000
SizeOfRawData 0
PointerToRawData 0x29d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

(#7)

MD5 6c516a1f358d1cfdc3f55c989141ab6a
SHA1 ada04bbb830358bdd640929a31adfed37f79613a
SHA256 f2c72f1c4711589ce51b9cbe889722667ed710a95d5bffab88fa384ce39d28c3
SHA3 be772b7e52b3fa09f2220f6c9176f08f54c838315d311624ee0e8f2ad9fe1bfc
VirtualSize 0x1ec8
VirtualAddress 0x832000
SizeOfRawData 0x200
PointerToRawData 0x29d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.20739

(#8)

MD5 4423431ffb77063ee8dfef65a357e757
SHA1 5e19f3e583c3499f0e92aa2e419936181fee0e24
SHA256 4ab8bb2a3317b8f1c0753d3d85f56e1d0fe291af37f2963cdcecb6ba59f58923
SHA3 0edfaeaa1bb9ed60024bd1461d2d69b89bc1d811528928eae7e81325fac16ed1
VirtualSize 0x10
VirtualAddress 0x834000
SizeOfRawData 0x200
PointerToRawData 0x29d600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.403873

(#9)

MD5 b1b1377e0003cce9de6b809cea19f6b4
SHA1 d8621dfdafd4440f9eb01f36c041b732a52c4c9f
SHA256 3db2bcd3b8e7fbb576000a96da1715da2a90ba3eec0dcaaa13eb27dd7e8fe906
SHA3 e9b1a0698b8a31fd4ed4c3742e4d75296deb336442a071838cacc0a4cfa72c62
VirtualSize 0x23b60
VirtualAddress 0x835000
SizeOfRawData 0x10c00
PointerToRawData 0x29d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99286

(#10)

MD5 349c246ea9aa7565143aa76354e4e9df
SHA1 c125fae37f5e251da70e7ba880be3efd93ad266a
SHA256 fa8d4c48beef5cd81939652f94145bf11da486d40a8990e6775464ec7936b665
SHA3 dd4b525e7ca18091d70e1ad994462ebdd381904f5701b286cb66a3e7b70ba0d4
VirtualSize 0xbe00
VirtualAddress 0x859000
SizeOfRawData 0x2400
PointerToRawData 0x2ae400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.94009

.idata

MD5 0915461213bc61634bcb5ef91f8db7d2
SHA1 ea26b570d46c5b562b2a1a2788287f14a990b967
SHA256 4ff1dfb587978bb4d87df80c599f617b65997c9536b4fbb94ff56a6cf07f9b1c
SHA3 60ad5fe677f886eb5866b6e69db00ecda367888ab260c9c99963c05780836db0
VirtualSize 0x1000
VirtualAddress 0x865000
SizeOfRawData 0x200
PointerToRawData 0x2b0800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.60768

.tls

MD5 c5b60bbb316d4af5294a5d9331cce68a
SHA1 ef8093cce0b7f4067d8e21d5f6fe108f58854169
SHA256 62ec6b0b6bf2613ff847acc28ed40ff97f5cfc9dfb16cff63248c439e753a648
SHA3 7586fadf2507b3011a1c61998c15bdea988b44bfd161e6016a22706ac75ef2eb
VirtualSize 0x1000
VirtualAddress 0x866000
SizeOfRawData 0x200
PointerToRawData 0x2b0a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.32011

.rsrc

MD5 89f3639a832ff58804811b466faf9dcf
SHA1 db552299bde0c9d4673e72d462fa4db74bf8f078
SHA256 0cabc005abae27472f11b95fb901e8044ba9b03824cf400f6b0ad0f9124801b2
SHA3 6374d6451c01bc936d7e552f509780822d60889b415bd7dc38071c06c66b7bec
VirtualSize 0x23c00
VirtualAddress 0x867000
SizeOfRawData 0x23c00
PointerToRawData 0x2b0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.31507

.themida

MD5 afc32f4ccb91385baa6db59885e13ec2
SHA1 59ceb5829e2cd0904086ee1e3fec681a0533d579
SHA256 3e819f048dc596ba27d096d3597e6243cfd74bd4c20ba69944882ee6a61a9d70
SHA3 94cd1c509cd268d80a8cd07e0a8ed4861a542061a836771ff43bec3a8c350fb1
VirtualSize 0x2ee000
VirtualAddress 0x88b000
SizeOfRawData 0x2ee000
PointerToRawData 0x2d4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.11996

.reloc

MD5 e16b4c639a369d159736efbd08c168bc
SHA1 3e147a75e5d43ec1e114620b01097259ed1f6132
SHA256 3ab9b0c96cd86327e18a2638681a4b5081991c0f402613eaf83b730917309897
SHA3 cd5c3f0de0bd63c63ba7040ceb22133dbbe2cb5088dab94c0bca8812ab9de514
VirtualSize 0x1000
VirtualAddress 0xb79000
SizeOfRawData 0x10
PointerToRawData 0x5c2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 2.7744

Imports

kernel32.dll GetModuleHandleA
ADVAPI32.dll CryptAcquireContextW
CRYPT32.dll CertCloseStore
msvcrt.dll __C_specific_handler
SHELL32.dll SHFileOperationA
USER32.dll GetProcessWindowStation
WS2_32.dll WSACleanup

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xb450
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98891
Detected Filetype PNG graphic file
MD5 94775d97d628114848ce62c9cb2edc1f
SHA1 fff7d8b09e79b2e9a226153d23d849a11e57060d
SHA256 368d2540cb230617ba53fffa95b1d5e6122b28ba97c39360452ef43da30dd458
SHA3 bbe7757376c24b2669b060bee117f536de2f9d801f6c7ec2df9f22dd86a8c317

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.81079
MD5 ad42d76779e16e80c2526b510d31d9a3
SHA1 0781dafdebaf52e615614e65975184c9e8701c53
SHA256 56dd5915059e8029a1ad1f77cbb5dce84fa2a2742c3f81b0762a446898455b6a
SHA3 07509f818bfe86dc17642f65e57c9ab044fbef4026eb5934a0d2ac7fd65ab158

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.08059
MD5 20704931d0bf5a4341273f4d9ec70b38
SHA1 fa171bb78ae0257ee2e3826491766b59d1b30035
SHA256 b497b4a39387f82f29fa260dd67a52b3964a51b46177e073d5d112de46087a84
SHA3 6ef1ce4e010688426ba56ec0728b818fb5fd4bef2d187dcb08ea1db1e1d90109

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31489
MD5 410cbd621e5d2182c68bf6bfc4eac49f
SHA1 e09e1016c781df0fbfb740c18303fc80a56f1041
SHA256 e74d2f63d6704b10bbec845cb9cad8d8b4e90af3723903bc5aa508b0eef02ff4
SHA3 77f28899037329c285f366ef40c191c7acb5b219e80ef10f4081a9210c1e7411

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.60074
MD5 585136081d3094f3d85042c5674f8063
SHA1 4696bf9e3a59e108d63d07857f378c3a91fd2b16
SHA256 ed41f613fe169cfd6f09d76598867184eccf9207e7ca558b072d27eb79ca9b51
SHA3 dd79143697174c20149f67e4d5a3caa676e6e7076bafe0ea54fbbb52523863ee

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.8318
MD5 06c2b1e9639e86ea6c2e1f7a5bbacc94
SHA1 27f0b82503f800cead6cffd911815c9b1c53b870
SHA256 6ce8c398da3e5f6bc5a60d5a8223de73b005d1a1f9af0eb5f677ff483ac43d9e
SHA3 3947f0bb5836ee764ac55f101327819f45a2476c8053a38ee28dc8428fcfbc2f

ID_ICON1

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 51927093d03916fd54704c4d00ed00e1
SHA1 b319cba02aeac5b42717187f6e7053a79f73bb40
SHA256 1a767dde8472732882e55c2f986fc20e36bf2d91eeecc25481aa299929a52283
SHA3 fd397977845b2db1852520b857c022239f051dd36103ac379235da5f54da8813

Version Info

TLS Callbacks

StartAddressOfRawData 0x140866000
EndAddressOfRawData 0x140866008
AddressOfIndex 0x140866008
AddressOfCallbacks 0x140866010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.