04b2eba103de1ec5773ff2e9826df7bb1ddb3e9d84cc827c80320ccf2f7ec8c4

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages Russian - Russia
CompanyName Tornado Software
FileDescription Tornado NKN Service Software
FileVersion 2.40.0.28750
InternalName Tornado NKN
LegalCopyright Tornado Software
LegalTrademarks
OriginalFilename TornadoNKN.exe
ProductName Tornado NKN
ProductVersion 2.40.0.28750

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .&Ai
Unusual section name found: .*!7
Unusual section name found: .AOt
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can access the registry:
  • RegQueryValueExA
  • RegSetValueExA
 Possibly launches other programs:
  • ShellExecuteA
 Uses Microsoft's cryptographic API:
  • CryptVerifySignatureA
 Has Internet access capabilities:
  • InternetSetOptionA
Info The PE is digitally signed. Signer: Sole proprietorship Shulgin Viacheslav Nikolaevich
Issuer: GlobalSign GCC R45 EV CodeSigning CA 2020
Malicious VirusTotal score: 12/70 (Scanned on 2026-09-09 11:56:57) APEX: Malicious
AVG: Win32:MalwareX-gen [Misc]
Avast: Win32:MalwareX-gen [Misc]
Avira: TR/W32.Agent
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
F-Secure: Trojan.TR/W32.Agent
Google: Detected
MaxSecure: Trojan.Malware.338151687.susgen
Paloalto: generic.ml
Sophos: Mal/Generic-S
TrellixENS: Artemis!E1DFA3B073D4

Hashes

MD5 e1dfa3b073d44dd5f3c01ddb3d7d3422 🔍
SHA1 5fd74745ad18fb8d776116027b9fc2a0257fde7e 🔍
SHA256 04b2eba103de1ec5773ff2e9826df7bb1ddb3e9d84cc827c80320ccf2f7ec8c4 🔍
SHA3 8de9d018f9d6fa03b03aef2e05dbc45419574c9ead103a40c13d3e5b012cce37 🔍
SSDeep 196608:hPI7PCCisqKhcP4jfN1gzewJh5IAaAWYbRRgzVhWLg+AYShCnB1DIQm7KjSQ4f:WPCCi9KhciV1g/5ZWW8ELg+Afh6BuQAf 🔍
Imports Hash d18c08a9150c2e7f964c14b129e1642a 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 10
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0xb7800
SizeOfInitializedData 0x2d200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00829DB2 (Section: .AOt)
BaseOfCode 0x1000
BaseOfData 0xb9000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x125d000
SizeOfHeaders 0x400
Checksum 0xa60892
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xb77e0
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x5884
VirtualAddress 0xb9000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1029
VirtualAddress 0xbf000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2aae
VirtualAddress 0xc1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x10
VirtualAddress 0xc4000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x18
VirtualAddress 0xc5000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED

.&Ai

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x73cc4f
VirtualAddress 0xc6000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.*!7

MD5 bd37bdbc65934d7aaa3212d53981c02e 🔍
SHA1 225ebae2222858eaefa448a6996fdc88a0dacba0 🔍
SHA256 19bd32c89ce92f3b13f65d6a6978a6bedb9d98833b12ae938cfcd14b5ac20511 🔍
SHA3 4788d4f238967393d73d73e69139398bb4f8dfbc83372e535fd93a1e3ee1da10 🔍
VirtualSize 0xb08
VirtualAddress 0x803000
SizeOfRawData 0xc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.428731

.AOt

MD5 782ce6ed31cb44f39b4b999fb2e9ac1c 🔍
SHA1 3e5ea9e7f2e7ab7825a058fdb20a54aa09b424d1 🔍
SHA256 c6464bdcc5b7bc3af60d8556398251cc9511b63a3a085904fac788d5735ea9e1 🔍
SHA3 73077ac6519987a99e8246b4b3d952d856b5a5a0f781f52b20407dee371a08a8 🔍
VirtualSize 0xa4ef50
VirtualAddress 0x804000
SizeOfRawData 0xa4f000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.9859

.rsrc

MD5 9144d0bdfd0cb4d5f3eebe18df8fc612 🔍
SHA1 e88e1b4aa9afc95b6fee1b81a5bb5efdfc70beee 🔍
SHA256 e71dacf8957c00bd09ae8a1fdcc2eaeeca865f7d5062db9c29cb838c8c9b5c17 🔍
SHA3 c6de02db248286da20b171fa32177ee52efc567c0d6d38d7c2897ade0c03e8fa 🔍
VirtualSize 0x92d9
VirtualAddress 0x1253000
SizeOfRawData 0x9400
PointerToRawData 0xa50000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.49825

Imports

kernel32.dll DeleteCriticalSection
user32.dll MessageBoxA
advapi32.dll RegQueryValueExA
oleaut32.dll SysFreeString
kernel32.dll (#2) DeleteCriticalSection
advapi32.dll (#2) RegQueryValueExA
kernel32.dll (#3) DeleteCriticalSection
version.dll VerQueryValueA
gdi32.dll UnrealizeObject
user32.dll (#2) MessageBoxA
kernel32.dll (#4) DeleteCriticalSection
oleaut32.dll (#2) SysFreeString
ole32.dll CreateStreamOnHGlobal
oleaut32.dll (#3) SysFreeString
comctl32.dll ImageList_SetIconSize
winspool.drv OpenPrinterA
shell32.dll ShellExecuteA
wininet.dll InternetSetOptionA
comdlg32.dll GetOpenFileNameA
advapi32.dll (#3) RegQueryValueExA
shlwapi.dll PathCanonicalizeA
kernel32.dll (#5) DeleteCriticalSection
kernel32.dll (#6) DeleteCriticalSection
user32.dll (#3) MessageBoxA
kernel32.dll (#7) DeleteCriticalSection

Delayed Imports

1

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x509b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95638
Detected Filetype PNG graphic file
MD5 deac34a84f6e0f349a78baa7e62d342d 🔍
SHA1 f7444c4a694bdf2d7851e74b36b4dc0446a6e8a6 🔍
SHA256 f43eff1212f8eeee6520059da2764313182778b0c545e63ca16bb956845faf3d 🔍
SHA3 31ad0681b60554bfd95f61ccabf78e92993af9b6f063ddb7d4678daf3b2ddfd5 🔍

2

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.15481
MD5 33750dc2be2a111b1463f12bb58d7259 🔍
SHA1 eadaefcd2d6a5c4de8b462b253f6696977e3dc03 🔍
SHA256 18a5c440db626bb0b25c8d5132c1963ff2a8ce0da631ebc155d6acec91ca1632 🔍
SHA3 b3d20c779f615db1d2a44eb4e35fae8fbc3053cabb0c3c3ec54d90fda5c3a716 🔍

3

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29811
MD5 5b7fa7a4d94a5aa1d6aa4ef208e1d6f6 🔍
SHA1 39781688640fba457cf496a775c47a54bad6a48a 🔍
SHA256 9112af41978c5b65fc0f9ec370bb8d5dca9bacc7038f637c8f567c1b74ad29dc 🔍
SHA3 01aa68984a4d5d08eba9001ad7c088b33ddc2ada4b3b0113b55aedc2ab44667b 🔍

4

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.80328
MD5 d3fbf2687455a23dd05a153d5103f21a 🔍
SHA1 8fe42c187171c3503af97ab4aac574a723a02d3c 🔍
SHA256 471c799d8247f5f5793d34418eecb4e7cb35ba98490634dbdb824ca131dc73ed 🔍
SHA3 faed5cff1a29c5f03378e246bf458064bc12877ea9375411ba1f9fc9820829ca 🔍

MAINICON

Type RT_GROUP_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.44608
Detected Filetype Icon file
MD5 f61c08522def911c77d6ad9d0cc6743b 🔍
SHA1 9cb6a3906ec14e40890b766b7f29323598284c2e 🔍
SHA256 0fd96131868d891029459ea658d4dc166e9854d49502f8d40bcad67acf455ec8 🔍
SHA3 9e43d23ad5a59ca856867bd55852a4ffb75ad76e766b3e4a4fce3598c6840f87 🔍

1 (#2)

Type RT_VERSION
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x32c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36451
MD5 581b5c39b2931ce2165bbffbac035e41 🔍
SHA1 bd86f112340a899c3e0aad57adf2f22723ce8b23 🔍
SHA256 074c8e1a2b4f93bd5e239bb74ebe1ba258cb639cfefa11c71137345e5845fedf 🔍
SHA3 a70650e7570f77923dd5c5e0bfa49691d59c971710cfc566538722fd496493e8 🔍

1 (#3)

Type RT_MANIFEST
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x245
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.95218
MD5 ec5f45455a2dc2584390b6ba8dac86b6 🔍
SHA1 c4430217c0673d86805482d90cf34fa38a3f758c 🔍
SHA256 a3eca8428248ea414fdceaf0b451393866fe413a5eae29264d1e29bb60c0c68c 🔍
SHA3 227245b0c93388712983c330d15338e56d8d46dbeb08c42d717f98c86d65706f 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.40.0.28750
ProductVersion 2.40.0.28750
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language Russian - Russia
CompanyName Tornado Software
FileDescription Tornado NKN Service Software
FileVersion (#2) 2.40.0.28750
InternalName Tornado NKN
LegalCopyright Tornado Software
LegalTrademarks
OriginalFilename TornadoNKN.exe
ProductName Tornado NKN
ProductVersion (#2) 2.40.0.28750
Resource LangID Russian - Russia

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section CODE has a size of 0! [*] Warning: Section DATA has a size of 0! [*] Warning: Section BSS has a size of 0! [*] Warning: Section .idata has a size of 0! [*] Warning: Section .tls has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .&Ai has a size of 0!
Leave a comment

No comments yet.