06c2a137c31aae5d02b4d7df61ffd31f1af9a9e59978f15b3f7265cc751bff1f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Mar-19 17:53:17
Detected languages English - United States

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • nUI.exe
  • rshell.exe
 Accesses the WMI:
  • ROOT\CIMV2
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
  • https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
  • https://www.torproject.org
  • https://www.torproject.org/download/.
  • torproject.org
  • www.torproject.org
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA256
Uses constants related to AES
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • ShellExecuteW
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Enumerates local disk drives:
  • GetDriveTypeW
  • GetLogicalDriveStringsW
 Manipulates other processes:
  • OpenProcess
Malicious VirusTotal score: 58/70 (Scanned on 2026-08-20 14:02:02) ALYac: Gen:Variant.Ransom.Akira.20
APEX: Malicious
AVG: Win64:MalwareX-gen [Ransom]
AhnLab-V3: Trojan/Win.Generic.R697360
Alibaba: Ransom:Win64/Akira.5a146128
Antiy-AVL: Trojan[Ransom]/Win64.Akira
Arcabit: Trojan.Ransom.Akira.20
Avast: Win64:MalwareX-gen [Ransom]
Avira: TR/W64.MalwareX
BitDefender: Gen:Variant.Ransom.Akira.20
Bkav: W32.Malware.7F5E2E4A
CTX: exe.ransomware.akira
ClamAV: Multios.Ransomware.Megazord-10021030-1
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
DrWeb: Trojan.Encoder.41853
ESET-NOD32: Win64/Filecoder.Akira.A trojan
Elastic: Multi.Ransomware.Akira
Emsisoft: Gen:Variant.Ransom.Akira.20 (B)
F-Secure: Trojan:W32/Akira.A
Fortinet: W64/Filecoder_Akira.D!tr.ransom
GData: Win64.Trojan-Ransom.Akira.B
Google: Detected
Gridinsoft: Ransom.Win64.FileCryptor.oa!s1
K7AntiVirus: Ransomware ( 005ce0a11 )
K7GW: Ransomware ( 005ce0a11 )
Kaspersky: HEUR:Trojan-Ransom.Win64.Akira.b
Kingsoft: Win64.Trojan-Ransom.Akira.b
Lionic: Trojan.Win64.Akira.tst9
Malwarebytes: Akira.Ransom.FileCryptor.DDS
MaxSecure: Trojan.Malware.697533945.susgen
McAfeeD: Trojan:Win/GenericY.FNF
MicroWorld-eScan: Gen:Variant.Ransom.Akira.20
Microsoft: Ransom:Win64/Akira.AA!MTB
NANO-Antivirus: Trojan.Win64.Encoder.lfpsso
Paloalto: generic.ml
Panda: Trj/GdSda.A
Rising: Ransom.Akira!1.127EE (CLASSIC)
SUPERAntiSpyware: Trojan.Agent/Gen-Crypt
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win64.Worm.th
Sophos: Troj/Akira-A
Symantec: Ransom.Akira
Tencent: Trojan-Ransom.Win64.Akira.16004370
TrellixENS: Ransomware-HVB!AA88621587A4
TrendMicro: Ransom.Win64.AKIRA.SMYXDJJT
TrendMicro-HouseCall: Ransom.Win64.AKIRA.SMYXDJJT
VBA32: TrojanRansom.Win64.Akira
VIPRE: Gen:Variant.Ransom.Akira.20
Varist: W64/Akira.B.gen!Eldorado
VirIT: Trojan.Win64.Genus.HWW
Webroot: W32.Trojan.Gen
Zillya: Trojan.Filecoder.Win64.122789
ZoneAlarm: Troj/Akira-A
alibabacloud: Ransomware:Win/Akira.A
huorong: Ransom/Akira.f

Hashes

MD5 aa88621587a40bf353cc07a965e00ee2 🔍
SHA1 dfa5e52cd8a709cd2b479c71c9c06a89990a0e9f 🔍
SHA256 06c2a137c31aae5d02b4d7df61ffd31f1af9a9e59978f15b3f7265cc751bff1f 🔍
SHA3 bb962e86dd4717f95d909a489e6b92d7a8efad295cbbb48120aebd53e42eed16 🔍
SSDeep 24576:zQagXrs6xiS7Ay/i4NBqThb23KAwcCcoVuqs:zQa36bg4NBqT1VAwfcoVQ 🔍
Imports Hash f89d971f855e5743dd4d1e73a5da5699 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2025-Mar-19 17:53:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xcc800
SizeOfInitializedData 0x3d600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000008DD38 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x110000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4186de4bf06df62adfa5f28d69d300cf 🔍
SHA1 dd995689a60cc248731c2871e6906702da01d61a 🔍
SHA256 137128de5736f86991c0173725a22905eae83fb057d52addc3fb4febd513d8b6 🔍
SHA3 3c9ae99e082fba74eb34c7ac814cd3e22d4424eaac843e1bc72245a7d433e593 🔍
VirtualSize 0xcc64e
VirtualAddress 0x1000
SizeOfRawData 0xcc800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45431

.rdata

MD5 14becbc108f20bb82b36c13659dbe29c 🔍
SHA1 3c45010fde00dc8170fe5dc329a9649e085ece53 🔍
SHA256 591d25219a5ab3ed478ee88b88518e0df267bf02a602e528190bbecbd27132d2 🔍
SHA3 28521445a256e30320f43aaea1620bf28870af583e71c514909c291edb3a910b 🔍
VirtualSize 0x29742
VirtualAddress 0xce000
SizeOfRawData 0x29800
PointerToRawData 0xccc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.18798

.data

MD5 fc72c4d7b11ae006e5e1a004c010bbc6 🔍
SHA1 5bd36405253c0c81c9bd7b6ad9af8d5467300802 🔍
SHA256 1eb65f268db052add7f358985c4bbfd0160cfb912243e5f7916197f7ff66a682 🔍
SHA3 daa9ae0bbb06ad213c8273541c7661235d598209dcd6b8378aa06b6e509bd424 🔍
VirtualSize 0xa20c
VirtualAddress 0xf8000
SizeOfRawData 0x8400
PointerToRawData 0xf6400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.88099

.pdata

MD5 6a342d6a125954a25baf1e3c15b9eac6 🔍
SHA1 9ca12fc08ec9ddaee5f60e26fec1c76c86fdcafe 🔍
SHA256 897116bb3a3d1e1dbfd8458d73874360440228075855f8b50dd9e5b8f2782a37 🔍
SHA3 7c3521aab20b3347536b1b14a7f3cfb4f31f44e2880111ad5e474d8d40510cfc 🔍
VirtualSize 0x8058
VirtualAddress 0x103000
SizeOfRawData 0x8200
PointerToRawData 0xfe800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.94447

_RDATA

MD5 61d90dd25defc66524a69362820c6618 🔍
SHA1 167543407dbb8bfa2a46964ef1d6d9b36b8546df 🔍
SHA256 2c60d33f1a465a102058d12c507c37c41fa3c864993e99fa2b5e467923ad6a2b 🔍
SHA3 1578efd9a15a88ce98517cac6ee5f77d998b4c4cf4826cd1058265f5b3bda8de 🔍
VirtualSize 0x15c
VirtualAddress 0x10c000
SizeOfRawData 0x200
PointerToRawData 0x106a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.31538

.rsrc

MD5 2a208a5d7eec9231c51995faa8ef698a 🔍
SHA1 c060662f30008938e7cc22d0f0f9aa9cb450829e 🔍
SHA256 129b409cb25a86ea790bfaeefce6d27d4a02ad27c3ccc43099a917bbd4ba72e2 🔍
SHA3 a0d3be222b053995f2b33b5f0baed598cf0a24c7de590aa5b390fb1a26287eaa 🔍
VirtualSize 0x1e0
VirtualAddress 0x10d000
SizeOfRawData 0x200
PointerToRawData 0x106c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71768

.reloc

MD5 b0210b61e12dd98ba5152fbb985e60c1 🔍
SHA1 3d1c60ddcc33b934cf5ec0f5ce8a5c8eae27408d 🔍
SHA256 51a70314cf5808d89b68003c3944476feee3834953ef7f984f70feb0f20d688d 🔍
SHA3 f69ec7d8549e9c85e67cc8f252c94138c416e256a6190df380423b91347a9daf 🔍
VirtualSize 0x138c
VirtualAddress 0x10e000
SizeOfRawData 0x1400
PointerToRawData 0x106e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.40182

Imports

KERNEL32.dll EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
WaitForSingleObject
PostQueuedCompletionStatus
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
TlsFree
FormatMessageA
ReadFile
GetFileSizeEx
SetWaitableTimer
TlsSetValue
SetLastError
WriteFile
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
GetCurrentThreadId
CreateEventW
SetFileInformationByHandle
DeleteFileW
CancelIoEx
SleepEx
TlsGetValue
CreateIoCompletionPort
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetDriveTypeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCommandLineW
GetStdHandle
WriteConsoleA
GetDynamicTimeZoneInformation
Sleep
GetConsoleMode
GetFileAttributesA
GetSystemInfo
GetCurrentProcessId
GetCurrentProcess
GetProcessId
OpenProcess
ResetEvent
GetLogicalDriveStringsW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapSize
HeapReAlloc
GetLocaleInfoEx
RtlPcToFileHeader
RaiseException
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
RtlUnwind
SHELL32.dll CommandLineToArgvW
ShellExecuteW
ole32.dll CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
OLEAUT32.dll VariantClear
SysAllocString
SysFreeString
VariantInit
WS2_32.dll WSAStartup
WSACleanup
SHLWAPI.dll PathIsNetworkPathW
MPR.dll WNetGetConnectionW
WTSAPI32.dll WTSEnumerateProcessesW
WTSFreeMemory
RstrtMgr.DLL RmShutdown
RmStartSession
RmEndSession
RmRegisterResources
RmGetList

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Mar-19 17:53:17
Version 0.0
SizeofData 1008
AddressOfRawData 0xe9014
PointerToRawData 0xe7c14

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2025-Mar-19 17:53:17
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400e9428
EndAddressOfRawData 0x1400e9444
AddressOfIndex 0x1401010b0
AddressOfCallbacks 0x1400ce780
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400f9368

RICH Header

XOR Key 0xf6913746
Unmarked objects 0
ASM objects (27412) 6
C objects (27412) 19
C++ objects (27412) 181
C objects (CVTCIL) (27412) 1
C objects (VS 2015-2022 runtime 32533) 16
ASM objects (VS 2015-2022 runtime 32533) 10
C++ objects (VS2022 Update 7 (17.7.0-3) compiler 32822) 3
C objects (VS2022 Update 7 (17.7.0-3) compiler 32822) 23
C++ objects (VS 2015-2022 runtime 32533) 100
Imports (27412) 19
Total imports 206
C++ objects (LTCG) (VS2022 Update 7 (17.7.0-3) compiler 32822) 9
Resource objects (VS2022 Update 7 (17.7.0-3) compiler 32822) 1
Linker (VS2022 Update 7 (17.7.0-3) compiler 32822) 1

Errors

Leave a comment

No comments yet.