0d3ad155fca18388e450c726cdac1a2f23326fbd07ed998ae196f9430472f465

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Jul-21 15:55:19
Detected languages English - United States
French - France

Plugin Output

Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
The PE only has 8 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can access the registry:
  • RegCloseKey
Info The PE's resources present abnormal characteristics. Resource 110 is possibly compressed or encrypted.
Resource 139 is possibly compressed or encrypted.
Resource 140 is possibly compressed or encrypted.
Resource 141 is possibly compressed or encrypted.
Resource 149 is possibly compressed or encrypted.
Resource 150 is possibly compressed or encrypted.
Resource 151 is possibly compressed or encrypted.
Resource 101 is possibly compressed or encrypted.
Malicious VirusTotal score: 39/70 (Scanned on 2026-10-20 14:47:44) ALYac: Trojan.Generic.37902780
APEX: Malicious
AhnLab-V3: HackTool/Win64.Keygen.C2070505
Alibaba: HackTool:Win32/VMProtect.8d8bf393
Antiy-AVL: Trojan[Packed]/Win32.VMProtect
Arcabit: Trojan.Generic.D24259BC
BitDefender: Trojan.Generic.37902780
CAT-QuickHeal: Trojan.IGENERIC
CTX: exe.trojan.vmprotect
CrowdStrike: win/grayware_confidence_100% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/Packed.VMProtect.ABD trojan
Emsisoft: Trojan.Generic.37902780 (B)
Fortinet: W32/PossibleThreat
GData: Trojan.Generic.37902780
Google: Detected
Gridinsoft: Trojan.Win64.Packed.oa!s2
Ikarus: Trojan.Win32.VMProtect
K7AntiVirus: Riskware ( 005cfd771 )
K7GW: Riskware ( 005cfd771 )
Lionic: Worm.Win32.Runouce.neru
Malwarebytes: Generic.Malware/Suspicious
MicroWorld-eScan: Trojan.Generic.37902780
Microsoft: HackTool:Win32/Keygen!MSR
Paloalto: generic.ml
Panda: PUP/Patcher
Rising: Trojan.Wacatac!8.10C01 (CLOUD)
SentinelOne: Static AI - Suspicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!EF046F4DFCAC
TrendMicro: TROJ_GEN.R06CC0RK124
TrendMicro-HouseCall: TROJ_GEN.R002H09DS21
VIPRE: Trojan.Generic.37902780
Varist: W64/Trojan.NFJJ-8608
Xcitium: Malware@#rlosyze8ft2j
Yandex: Trojan.VMProtect!ZpH00+GVSgc
alibabacloud: Suspicious

Hashes

MD5 ef046f4dfcac3e6aae57d972e3dde08b 🔍
SHA1 a8989f9149f28fd1d22560b28465cba997a39d21 🔍
SHA256 0d3ad155fca18388e450c726cdac1a2f23326fbd07ed998ae196f9430472f465 🔍
SHA3 74ba861492b14fb28500c35d489ff0722761617908a453e47f62deb8f937fc89 🔍
SSDeep 49152:XMqLNaBy+dj6TZ6m7/7Bn8WqR6dc8h1rcRAqDHK/PMw:XBNuj56V6KZ8WYG1r0AW9w 🔍
Imports Hash f5a55689e22597e07279fb45d37fb025 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 3
TimeDateStamp 2017-Jul-21 15:55:19
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 12.0
SizeOfCode 0x213000
SizeOfInitializedData 0x4b000
SizeOfUninitializedData 0x8d000
AddressOfEntryPoint 0x00000000002A0C30 (Section: UPX1)
BaseOfCode 0x8e000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2ec000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8d000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 5cf514595a2c512da10d56aefef33182 🔍
SHA1 84fdfdfa86847658d25857e8af09f5749e6027b0 🔍
SHA256 52808f5aa34546e61717087edaee4030cd2bfffb0278ddc29cabe4378cece1a1 🔍
SHA3 fbe7e5fd6659271d24f6369c16a8a20cd63b0d0b6cfcb6f7659222d5a72680b2 🔍
VirtualSize 0x213000
VirtualAddress 0x8e000
SizeOfRawData 0x213000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.92854

.rsrc

MD5 abce74089df87ed478290174866e2049 🔍
SHA1 efb09659cf2428311e1b89fe6ddde5a590931a68 🔍
SHA256 0f400dbfc5133e213a0c39dc35842de673251cc3a0a7c4bc2dc54392a23d413e 🔍
SHA3 c53f3e69dfa9d9f79f2b9bf9755cb8c5477d23231ef39d1735006b0adf8621db 🔍
VirtualSize 0x4b000
VirtualAddress 0x2a1000
SizeOfRawData 0x4ae00
PointerToRawData 0x213400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.93491

Imports

ADVAPI32.dll RegCloseKey
GDI32.dll BitBlt
KERNEL32.DLL LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
SHELL32.dll CommandLineToArgvW
USER32.dll EndPaint

Delayed Imports

110

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0xb41aa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93121
MD5 1ae6b42574f8b66f03621d10d4e67175 🔍
SHA1 12cfa5fac7fb51c7139cacf0ef2e90d84ec15305 🔍
SHA256 fed8002cc5d00474d4b16439107daf14adeccca6ac3560ccf7f3ae776f4840d7 🔍
SHA3 15d25829a7c9a9866938063bd86aa642fb65ff881c7299d5b099c49b0c4231f2 🔍

139

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x266a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.81041
MD5 f618c68606b9051460406b61dda3679f 🔍
SHA1 0dee395e1c36f29a5bc7655d8d1e60838097de0c 🔍
SHA256 8e85788df74bbd322785e66caea214e495a7ed2587f0c260a11715ed1bfc60c1 🔍
SHA3 98f9682b13d53e6cf2e88bc81a6d2be0ffda2cfd143b19c4cc947870a2aba551 🔍

140

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x266a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.82054
MD5 e3f5c7319dc491d406179d5d01d7f109 🔍
SHA1 cb30c2e27d0d7fe4a70ddb41d51e07d139fe7169 🔍
SHA256 3dce06c42c4cdb2e44d0cb43f078a4f84fba71832bccae33750518630081b366 🔍
SHA3 7529a15acae9fb5faa29c48d5cdcfcaca4543f0c986dbdc594be0219881f1c2d 🔍

141

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x266a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.80391
MD5 44502fb0153db18f2e6a3195674c2a8c 🔍
SHA1 9981d0d8035bef344c947ea63d38fa86f5d8d29c 🔍
SHA256 42902adc881a997e314a785a406a7f1c3f5ed6e3ef46ec4855f2f30bb5bbf5ad 🔍
SHA3 2c86a2525953c58da8cad8ebcad818b33618effc905ba0e279ac83655775d657 🔍

149

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x266a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.79633
MD5 dc3e898e3fe8b1c407e864c4bf8c1358 🔍
SHA1 0666357dbe0b418afde4acd782120bda4c63d9a4 🔍
SHA256 c9ba0d0265850cf73e4cc6cc46933600227dea8eb4bfacce42f40f7ccee1d0fd 🔍
SHA3 c3c54e40dbc364f72519a1598780625e1b2942a442e45af6d0fc73387a25125f 🔍

150

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x266a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83353
MD5 9bea00dbe62c9cc89bcc782e2c3094c2 🔍
SHA1 510e34319bf0f9c28946d6f9a55fbaf025cea355 🔍
SHA256 3f8ffb7a1440ec6491b9ab025dedfc4ea084db55efab77cdaa8221c9f60b58fd 🔍
SHA3 a0f8255e888fdc10c5e03a73b3f474808ff4a6f01c5d7a390202e8d590431da2 🔍

151

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x266a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.78171
MD5 4e97343e44cd26f5790193746cfb52fb 🔍
SHA1 7da92987d67f3e7316bc25bc02cf0bb331fba927 🔍
SHA256 8bacbba0dd0b5c89037340f6028a77975e5e40c5880895a22f194e4e650e66b0 🔍
SHA3 af0c84c04477e94438daeb3cfb47f153d525567357d53278903bf2097aceb52e 🔍

1

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79023
MD5 48d10fd37c23fe4881c14b0c3f9ebe05 🔍
SHA1 009bfdd7dc454d143dd75382ff4e265cc09a7221 🔍
SHA256 22e38d2e83a5f4d3c817c7cf723ddc9ce0c1ce36903b5089f85dc96e816849ed 🔍
SHA3 a6a88b678536ecd426d553a19e7a1adb0a2d51be75f977f73f80d32994c054e5 🔍

2

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.20578
MD5 fb5a7d4671bd29f0272fa5269aeba349 🔍
SHA1 5936b9508154a3c7976c9bb6b4dfdb41457c18e4 🔍
SHA256 7c8aaa0551238ff6785bed68299f204eac9d8a94dac463102fbe0427f100596a 🔍
SHA3 7fbc1f89b99b695a38d0a551827c3a5055a54926dbee35fb0dbb408b50c8705f 🔍

3

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.50879
MD5 01d4109c6bd9192ea51f328c1905ee1d 🔍
SHA1 6120d483a8a2a9091156a9e3ad3c0d1642820a1a 🔍
SHA256 bc9768eec78643b66ed8779cb9fd0f1e7be6ff8e57ddfea492c881be46d53c2f 🔍
SHA3 8ef2cb69eadfd9fc049e118480e6b42d5964d797ebb78f168829782c48723652 🔍

4

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.75768
MD5 a16f2d8dfb91b8da29420c5df994723d 🔍
SHA1 00e696da21f96feaa273c6976c7edbcf6bff5a5c 🔍
SHA256 71421078a7e609ed8742de534f47630432e8cca34599c0269bf680fec203d121 🔍
SHA3 045068f85eabb7fb62271b69c0a0662c9e44332e1bcb82a7876080e62bb5a689 🔍

5

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.42697
MD5 af12ea5bd34d4fc23adaff0365aa38bc 🔍
SHA1 f8d88a9fce6e12e1a968c43242e01dfd95b7316e 🔍
SHA256 6c74c0b2e6a7269f7fba8cdc84e22cc097856b532e8455afb269f032eaadcc74 🔍
SHA3 ef5ec2c01ff8dba6e3ed22c3af65cdcd2ecec6b9ce9b8b5fb80f76bb507d349e 🔍

6

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62122
MD5 f297c44fa81895fdaab4d92dba4881d3 🔍
SHA1 580309960b2c0c573191c39e24221932de1b75fa 🔍
SHA256 a42bef34c89769a0b2f7153ce53affa2f721245a6f498ba525fff3b56315fb94 🔍
SHA3 2556aca1729d7c63ff33be29700726392a05c010964585f22bf675b668993afb 🔍

101

Type RT_DIALOG
Language French - France
Codepage UNKNOWN
Size 0x216
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.20662
MD5 0d7c80d53520abacf55957beb07811a7 🔍
SHA1 2f501fdf278cda49a2e22b9b1a508031b70715d6 🔍
SHA256 e97436ba7bf568a3099331b650f10abbf452df28a324e0f7ab48ee1a90548fb3 🔍
SHA3 dcbcf647287960dfaf13e7569e5a5835fa9342a6215122013a5fb2f3d265a985 🔍

138

Type RT_GROUP_ICON
Language French - France
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.76847
Detected Filetype Icon file
MD5 eb6687d1a33a41be1affb9fc2a8466ca 🔍
SHA1 b592c96fc8892f23de4872ba82c9f94e9eaa5ff0 🔍
SHA256 0df3d118fa4155e80498ef678b0585524a78998fe1b5a8b7ae77c24de794a6bc 🔍
SHA3 d2e2011aaeb9dc81115740f225aae51fed55e4b962cb63f9d2c8e413c2781670 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x70
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140017000

RICH Header

XOR Key 0x482eb208
Unmarked objects 0
C++ objects (20806) 30
C objects (20806) 105
ASM objects (20806) 8
Imports (65501) 11
Total imports 112
229 (VS2013 build 21005) 6
ASM objects (VS2013 build 21005) 1
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 build 21005) 1

Errors

[*] Warning: Section UPX0 has a size of 0! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed!
Leave a comment

No comments yet.