0ca64c410cc37c33a6bfbcfa077c004203981092d405728a236bac1609079a73

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-15 18:16:38
Detected languages English - United States
TLS Callbacks 1 callback(s) detected.
Debug artifacts kegoaskak.pdb
CompanyName Slaherk Works, Inc.
FileDescription Kegoaskak Service
FileVersion 26.3.10.83
InternalName Kegoaskak
OriginalFilename Kegoaskak.exe
ProductName Kegoaskak
ProductVersion 26.3.10.83

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qemu
Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Uses Windows's Native API:
  • NtReadFile
  • NtWriteFile
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Malicious VirusTotal score: 10/71 (Scanned on 2026-10-28 18:54:53) APEX: Malicious
Bkav: W32.Malware.465B2E1B
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
ESET-NOD32: Win64/Injector.AOW trojan
Elastic: malicious (high confidence)
Google: Detected
Ikarus: Trojan.Win32.Wacatac
Malwarebytes: Trojan.Injector
Rising: Trojan.Kryptik@AI.88 (RDML:ySqqjYV0n9TWGPBrKbKRIA)

Hashes

MD5 64485e98275688522a5b07104cf09713 🔍
SHA1 559078a7f2c7443f6c1706c89a9178751127ff30 🔍
SHA256 0ca64c410cc37c33a6bfbcfa077c004203981092d405728a236bac1609079a73 🔍
SHA3 7bc07a0539a06342f8fee148691aea0cc862947d3fe3c8fe754fcd9885e1f3d7 🔍
SSDeep 24576:WtmHgBkAo2okjIiCuuHafhHXW1gtAbw4Xty:/Hup8iO/3Ns 🔍
Imports Hash 45889676b32856769b948376831debf2 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Oct-15 18:16:38
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21600
SizeOfInitializedData 0xfb200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000013130 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x122000
SizeOfHeaders 0x400
Checksum 0x123205
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d2fc6c0fcaae6c5ed4411ffeac7f7537 🔍
SHA1 1ab7c05787d1a69cd9a105905564bc723b1b3064 🔍
SHA256 10d73f2caffd03a0e028cdb79579ef1a071e9431ff870f8d41429f35f0ef381f 🔍
SHA3 fb00c58ffad002733b5f53f5b585da15a85cdcf6a6235dae471479290e624730 🔍
VirtualSize 0x21591
VirtualAddress 0x1000
SizeOfRawData 0x21600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.56471

.rdata

MD5 ccdf8493133a84c312a0c62d6ff7a529 🔍
SHA1 5bf2220924d59cd8f2545c2cee91b9f7c601aa8b 🔍
SHA256 87d05e4ae6a476e6b7c9b64ca2fad082a734d88cad9e9f9535c3e87af0bdd89a 🔍
SHA3 74ccb307825370351e8a3a8e065340174997593f07fa8ed50cabd6802f8c0cfd 🔍
VirtualSize 0x668c4
VirtualAddress 0x23000
SizeOfRawData 0x66a00
PointerToRawData 0x21a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.48184

.data

MD5 ac19a6815c793d4d51c9f32a75316451 🔍
SHA1 e590e65a72e6ac386bdb798b2cc6bf625e480177 🔍
SHA256 7e7f4d1e3e307031675c81849b4042b6ecba11ea65be4d1a03b811b17baedc0b 🔍
SHA3 19b58c3a7c2a359b56ad34b6b0a6b840ff09a2d15c500712ed312b15671d5c7c 🔍
VirtualSize 0x4ec70
VirtualAddress 0x8a000
SizeOfRawData 0x4e200
PointerToRawData 0x88400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.16808

.pdata

MD5 d03b11eaa820881217cb8e388b241392 🔍
SHA1 0964aa66e004612099ab9b962a1637486b79238f 🔍
SHA256 f3f86b4495847ca883bc07c49cba38a6983487bca773bbbe29ae357d88c5f06b 🔍
SHA3 360df2d23d394047e810c72e09ee8b51f8d4c7da9db5915f7510330f19d7f96c 🔍
VirtualSize 0x12c0
VirtualAddress 0xd9000
SizeOfRawData 0x1400
PointerToRawData 0xd6600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.19092

.tls

MD5 628673cd097b81c2496ee99cd8981db1 🔍
SHA1 e79b7bdc0dea00ca8b175480a73a14cd0656309d 🔍
SHA256 4de8cf8df3a29a6684104349d55ba5be4600c0b47486fb95cbfbb2eee6761659 🔍
SHA3 ec106e1a0e135b9af8ed4ee0eb49625ffce31b63c6e535dae05e8cfd7137d731 🔍
VirtualSize 0x149
VirtualAddress 0xdb000
SizeOfRawData 0x200
PointerToRawData 0xd7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.41969

.rsrc

MD5 54278dc631abdb17ec0667cf7f22c43b 🔍
SHA1 f08ddab4c5285f1a8d7b8e6e636afbb5e5738357 🔍
SHA256 0c8fd65f2f266fdbbca36653198b250d7b0a1f5f8cfb4425d075171b534f09d5 🔍
SHA3 fb3465afa7086080d663991606cb0298f27d716dcfb65fa4d60b5ee730f40855 🔍
VirtualSize 0x444c8
VirtualAddress 0xdc000
SizeOfRawData 0x44600
PointerToRawData 0xd7c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.75768

.reloc

MD5 3dbc7c2c0417636052ae4eff33009b1e 🔍
SHA1 5322261949187ce1705bd10527974357e1178535 🔍
SHA256 e836a8416d80f7ef77dce2642ced4fff90a91799f0fa886ad1768e0b8c53e33b 🔍
SHA3 52dbe2287fb43679ac26718cbbbdad3e43d74b2ce6df37ee2c87c92d4e064f2f 🔍
VirtualSize 0x864
VirtualAddress 0x121000
SizeOfRawData 0xa00
PointerToRawData 0x11c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.05076

Imports

kernel32.dll CloseHandle
CompareStringOrdinal
CompareStringW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLargePageMinimum
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetPhysicallyInstalledSystemMemory
GetProcAddress
GetProcessHandleCount
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimes
GetTempPathW
GetUserDefaultLCID
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
shell32.dll CommandLineToArgvW
user32.dll GetClientRect
GetDesktopWindow
GetSystemMetrics
api-ms-win-core-synch-l1-2-0.dll WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
ntdll.dll NtReadFile
NtWriteFile

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x588
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 5.266
MD5 ac171e50ad043066bac79c80c88f69a3 🔍
SHA1 0de33e174268a759a983c53647f5376bdd3ee607 🔍
SHA256 c6a50c46e580cc54ab634bb213e219534b0ed5b98d946869b6877b2b4da07f33 🔍
SHA3 38881a9aa23ca3cbdc316e52224b604ed5c4f1803823641026f06377a97dedb4 🔍

1 (#2)

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x40158
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 5.69572
Detected Filetype PNG graphic file
MD5 cb7b1739ff016348aa0589b8a56c0037 🔍
SHA1 eb4f9c30770f00a3fe2ffd344b209a70fb9d8ace 🔍
SHA256 4325e065123aceca271c63f32dc7db84e23e3f8836baebbb3a091fddca2f3f80 🔍
SHA3 67dc7302153b626f46243260ba935dc6ff9a30f0c7f02d25b6493a6fbf33f148 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2474
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 5.82114
Detected Filetype PNG graphic file
MD5 bed2c8743609e5e6ae98f2167636650e 🔍
SHA1 058f0be07bb4002b6a5ca3db32e3405cde5749d5 🔍
SHA256 42bdcdf736d67995dace99702930df5a10d1a0f7a2e6e1b5bb94f73508d71a6f 🔍
SHA3 ea7be3a2cfeef929c7f4fe5a5c71e76c4cdc3e1767b44cc412e68d7889bfd543 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1064
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 5.91412
Detected Filetype PNG graphic file
MD5 8d190e8d66f06562467592156dfd9218 🔍
SHA1 4fe8a3874c7ba171600e702757ec3bb9ee7aa657 🔍
SHA256 3d5f77a6d0969da72ce3dc1c0d8a862a666e22189b12b98c61da9e7d98944fc3 🔍
SHA3 914d4f1db2ff3b2c00e7ffd79f3180702cffc9f83dd33313909c8c8c006121be 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x454
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 5.98328
Detected Filetype PNG graphic file
MD5 1d4565cad02cc3ed0bacc18cb6cbcb37 🔍
SHA1 d06ccdf1ce0c9e7e8b55842776861b16b46bef3f 🔍
SHA256 4c6df4eadd6514ee0d547152e2dc5d7e7394aaf79a2567be5cc3a58b3703ee11 🔍
SHA3 daf8ec80b8d9e53642d7fc579847d24cd4ca0731c6f7529b553307e45b27a136 🔍

1 (#3)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 2.46418
Detected Filetype Icon file
MD5 dfa900010343b02eb96e5b32707d3786 🔍
SHA1 a6f8a7624ca9685bd0cf747b55c93453d3395ce2 🔍
SHA256 fefea84cf6710ac491667865afedacc8a490970b764ef96a9947f9ae360202a4 🔍
SHA3 f520ba117c339cdf02a3cd6576ea74040113290aed37d4d462db0a885c92c2d2 🔍

1 (#4)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x290
TimeDateStamp 2026-Oct-15 18:16:38
Entropy 3.41398
MD5 f8e9257b354d2c9ecd89734d15df0d0a 🔍
SHA1 eb20a884f4fd218198de4dc8f76ecaeecb1ea85c 🔍
SHA256 88ce92263bb6491d3cd04b2ca408b6af89438963f03c79a53a6af77d08218755 🔍
SHA3 c6e62e55f01faf200ed3350ba87f5b7e0a1b588fe8142f9bd1a07eacb8a8c49d 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 26.3.10.83
ProductVersion 26.3.10.83
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Slaherk Works, Inc.
FileDescription Kegoaskak Service
FileVersion (#2) 26.3.10.83
InternalName Kegoaskak
OriginalFilename Kegoaskak.exe
ProductName Kegoaskak
ProductVersion (#2) 26.3.10.83
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Oct-15 18:16:38
Version 0.0
SizeofData 38
AddressOfRawData 0x86f8c
PointerToRawData 0x8598c
Referenced File kegoaskak.pdb

TLS Callbacks

StartAddressOfRawData 0x1400db000
EndAddressOfRawData 0x1400db148
AddressOfIndex 0x1400d818c
AddressOfCallbacks 0x140087050
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x0000000140012E40

Load Configuration

Size 0x140
TimeDateStamp 2026-Oct-15 18:16:38
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400d76c0

RICH Header

Errors

Leave a comment

No comments yet.