0b86d572f837af0209c27392fc2ba7e3

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2017-Dec-11 15:04:33

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • #14
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 10585693 bytes of data starting at offset 0x42a00.
The overlay data has an entropy of 7.99772 and is possibly compressed or encrypted.
Overlay data amounts for 97.4868% of the executable.
Malicious VirusTotal score: 40/69 (Scanned on 2019-01-16 12:52:08) MicroWorld-eScan: Trojan.GenericKD.31155412
CAT-QuickHeal: Trojan.IGENERIC
McAfee: Generic Trojan.i
BitDefender: Trojan.GenericKD.31155412
TrendMicro: PUA_LAZAGNE
Symantec: Trojan.Cridex
ESET-NOD32: Python/Riskware.LaZagne.F
TrendMicro-HouseCall: PUA_LAZAGNE
Avast: Win64:PUP-gen [PUP]
ClamAV: Win.Trojan.Lazagne-6779429-0
Kaspersky: not-a-virus:PSWTool.Win32.Lazagne.ke
NANO-Antivirus: Trojan.Win64.Ric.ezcihq
Paloalto: generic.ml
Tencent: Win32.Risk.Riskware.Hfi
Ad-Aware: Trojan.GenericKD.31155412
Sophos: Mal/Generic-S
Comodo: ApplicUnwnt@#1k8kyqs9fac23
F-Secure: Trojan.GenericKD.31155412
DrWeb: Tool.LaZagne.7
McAfee-GW-Edition: BehavesLike.Win64.Dropper.vc
Trapmine: suspicious.low.ml.score
Emsisoft: Trojan.GenericKD.31155412 (B)
Ikarus: PUA.Python.Riskware
Cyren: W64/Application.YHUA-7536
Webroot: W32.Malware.Gen
Microsoft: HackTool:Win32/LaZagne
Arcabit: Trojan.Generic.D1DB64D4
ZoneAlarm: not-a-virus:PSWTool.Win32.Lazagne.ke
GData: Trojan.GenericKD.31155412
AhnLab-V3: Unwanted/Win32.Passwordcrack.C2548476
ALYac: Trojan.GenericKD.31155412
Malwarebytes: HackTool.LaZagne
Yandex: Riskware.PSWTool!
eGambit: Trojan.Generic
Fortinet: Riskware/LaZagne
AVG: Win64:PUP-gen [PUP]
Cybereason: malicious.2f837a
Panda: Trj/CI.A
CrowdStrike: malicious_confidence_100% (W)
Qihoo-360: Win32/Application.ecc

Hashes

MD5 0b86d572f837af0209c27392fc2ba7e3
SHA1 81451f6884a616e96cb0bf57d7052a890092ba0c
SHA256 d5fa28cbf3a73ac20d908acedfce3849477648e37391e8e926ec2e7933f175a0
SHA3 a63fdf481e0aadf91ea5c190262f6ac1aea74760f016977ca833ba0cfd597316
SSDeep 196608:vu9UzBXcC2tVO0RTuoSOHR3f1gNWot85DCwcrq5JvNfJs0Pp+RWS5RxbzR:CUzhH2ioTC23f2W75DTsIp25/P
Imports Hash c95ddf90b04e9507a08f2b2cdba988ae

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2017-Dec-11 15:04:33
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21200
SizeOfInitializedData 0x2fa00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000087D4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x56000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dde0f91f9b37a56653ef4ab7110ae4c2
SHA1 bf15bcb85ae139eca2b6d8fcc9f0eb5896bd6206
SHA256 24fe8622bf92eabaa143daac661686075a6f09fc1c28252fb46969535f9a32ce
SHA3 9152a0c1d1ee0a0e6be943278574b12e5d4c3645384dd26710cfb1aa6df3056a
VirtualSize 0x211b0
VirtualAddress 0x1000
SizeOfRawData 0x21200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46055

.rdata

MD5 58aff9f1e777b1366b22b859d81c38d9
SHA1 d18cb6f2210922823b3c98d2f9a4cd89799444d9
SHA256 dc04a3798b339186078b6d30becda0418356f7f6ce39102af34742071ae8494b
SHA3 53bdc44bc48e39fee2df90f0ce3ebf607d45d0aeccc576be75b0c79876c8b723
VirtualSize 0xf318
VirtualAddress 0x23000
SizeOfRawData 0xf400
PointerToRawData 0x21600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.84168

.data

MD5 c98c36539db289dd95ec525ba1431cd4
SHA1 3abf840192f7d6ef48b95de6d6c77fccf48142f3
SHA256 2123583623fbfd5a613341bf3465bcee355e405ce5eed336962381310001874d
SHA3 8885ae25aacf07eb32a0c1930d587668d6750f78f7da10a9f5cd9615cbedb9de
VirtualSize 0xf108
VirtualAddress 0x33000
SizeOfRawData 0xc00
PointerToRawData 0x30a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.83796

.pdata

MD5 a11aaa58a821cd6db1c7bc53358bf2c5
SHA1 df05f0bf16f63ddba9b93170ed201d9bb735a4f4
SHA256 395c9a0ae7867fb97ed93cb72f3bc1bbeb4b52cf4132a950f490843b967f894b
SHA3 f78e4de4b804a6456beca0c9f75f63deeda4063d31032d0c1a3d8a0c38418cf7
VirtualSize 0x1cec
VirtualAddress 0x43000
SizeOfRawData 0x1e00
PointerToRawData 0x31600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.21508

.gfids

MD5 f17559e82abd8028224a8e5248d6325f
SHA1 150df9949a5c6ef7285f6bd93e4c33f51accc001
SHA256 7d889a9d1ca275ed90a0eadf1f2ac680bc259910b9873bf5a8f3ff7eb0f42641
SHA3 99525d0c75b1a23c50fbe71571006d1c27aba2b78dc34a28c4a8050cc5ac810a
VirtualSize 0xac
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x33400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.75059

.rsrc

MD5 92df00d6b7f64c483d663d82f6564fb3
SHA1 71acdf57a5a3275b86dfaa7949cb3d5c539861eb
SHA256 af41e50cadbe6a207865f6c52676f694f33ed5741365427c72802a38e97fec8b
SHA3 497651384ff818aeb670de08b363cf8f92dd5acb71d84225063fbba9ebc4a39b
VirtualSize 0xea38
VirtualAddress 0x46000
SizeOfRawData 0xec00
PointerToRawData 0x33600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.29714

.reloc

MD5 a56a9278bd46afe64b769592fc3081ad
SHA1 975cff519963a36c516d4b07f06e25c20349b280
SHA256 79ab2f3f40405d75c97b78cf8b92be1d02fdfb01391cff84c39babfbf2495a00
SHA3 8afd6dc5d41d5da5a9c78c126f33829d3ea418a11011af0ebf904c5e0082b1fb
VirtualSize 0x69c
VirtualAddress 0x55000
SizeOfRawData 0x800
PointerToRawData 0x42200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.99098

Imports

KERNEL32.dll GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageA
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
WS2_32.dll #14

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2017-Dec-11 15:04:33
Version 0.0
SizeofData 720
AddressOfRawData 0x2f9e8
PointerToRawData 0x2dfe8

TLS Callbacks

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140033010

RICH Header

XOR Key 0x2165d1bb
Unmarked objects 0
241 (40116) 7
243 (40116) 170
242 (40116) 13
ASM objects (VS2015 UPD3 build 24123) 7
C++ objects (VS2015 UPD3 build 24123) 28
C objects (VS2015 UPD3 build 24123) 19
Imports (65501) 5
Total imports 114
C objects (VS2015 UPD3 build 24210) 17
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors

<-- -->