0f661a97f8e5dc26fefc907ca0c5a3b7b65af8804f99a4ab8894f9b7206ab45b

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2079-Nov-26 09:56:48
Comments
CompanyName
FileDescription Application
FileVersion 1.0.0.0
InternalName clientForCrypters.exe
LegalCopyright Copyright © 2026
LegalTrademarks
OriginalFilename clientForCrypters.exe
ProductName Application
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): .NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • SchTask
  • rundll32.exe
  • schtask
 Contains references to internet browsers:
  • chrome.exe
  • firefox.exe
  • iexplore.exe
 Contains references to security software:
  • rshell.exe
 Tries to detect virtualized environments:
  • HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0
  • HARDWARE\Description\System
 Looks for VMWare presence:
  • VMWARE
  • VMWare
  • VMware
  • vmware
 Looks for Sandboxie presence:
  • SbieDll.dll
 Looks for VirtualBox presence:
  • SOFTWARE\Oracle\VirtualBox Guest Additions
 Looks for Qemu presence:
  • QEMU
 May have dropper capabilities:
  • %temp%
  • CurrentVersion\Run
 Accesses the WMI:
  • root\Security
 Miscellaneous malware strings:
  • System32\drivers\etc\hosts
  • cmd.exe
 Contains domain names:
  • .roblox.com
  • geolocation-db.com
  • google.com
  • http://ip-api.com
  • https://api.my-ip.io
  • https://api.my-ip.io/ip.json
  • https://geolocation-db.com
  • https://google.com
  • https://ipinfo.io
  • https://ipwhois.app
  • https://t.me
  • ip-api.com
  • roblox.com
Malicious VirusTotal score: 46/70 (Scanned on 2026-08-22 20:20:09) ALYac: Gen:Variant.Adware.MSILHeracles.1895
AVG: Win32:MalwareX-gen [MRA]
AhnLab-V3: Trojan/Win.Generic.C5889760
Antiy-AVL: Trojan/MSIL.ClipBanker
Arcabit: Trojan.Adware.MSILHeracles.D767
Avast: Win32:MalwareX-gen [MRA]
Avira: TR/W32.MalwareX
BitDefender: Gen:Variant.Adware.MSILHeracles.1895
Bkav: W32.Malware.441B973C
CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4
CTX: exe.adware.msilheracles
ClamAV: Win.Packed.Adwarex-9851111-0
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
DrWeb: Trojan.DownLoader49.34723
ESET-NOD32: MSIL/PSW.Agent.SHS trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Adware.MSILHeracles.1895 (B)
F-Secure: Trojan.TR/W32.MalwareX
Fortinet: MSIL/Agent.FQI!tr
GData: Gen:Variant.Adware.MSILHeracles.1895
Google: Detected
Jiangmin: Trojan.Reconyc.l
K7AntiVirus: Trojan ( 005690671 )
K7GW: Trojan ( 005690671 )
Kaspersky: HEUR:Trojan.Win32.Generic
Malwarebytes: Trojan.Crypt
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!0F661A97F8E5
MicroWorld-eScan: Gen:Variant.Adware.MSILHeracles.1895
Microsoft: Trojan:MSIL/ClipBanker.GC!MTB
Panda: Trj/GdSda.A
Rising: Trojan.Injector!1.F60F (CLASSIC)
SentinelOne: Static AI - Malicious PE
Skyhigh: Trojan-FRAX!234EE3DC1E28
Sophos: Troj/MSIL-TKP
Symantec: ML.Attribute.HighConfidence
Tencent: Trojan-Psw.Msil.Stealer.16000477
TrellixENS: Trojan-FRAX!234EE3DC1E28
VBA32: Trojan.MSIL.InfoStealer.gen.D
VIPRE: Gen:Variant.Adware.MSILHeracles.1895
Varist: W32/MSIL_Troj.C.gen!Eldorado
VirIT: Trojan.Win32.MSIL_Heur.A
ZoneAlarm: Troj/MSIL-TKP
huorong: TrojanSpy/Steam.h

Hashes

MD5 234ee3dc1e28ed9e32750615ce03c47f 🔍
SHA1 dcc41d2a69e5bb03244454943cbee2f4c67eabed 🔍
SHA256 0f661a97f8e5dc26fefc907ca0c5a3b7b65af8804f99a4ab8894f9b7206ab45b 🔍
SHA3 c06a6309dba8fe07fc66e3d8cb09281aa2a1a8d4b8e7521f5307f15eca6148d0 🔍
SSDeep 49152:FDgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4RKwVgMhY:tgVUuHjkDGjYQDGuRxzewigMhY 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2079-Nov-26 09:56:48
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x26ee00
SizeOfInitializedData 0x6a200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00270DEE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x272000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2de000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a87c232eb455b55e5b94856bfae89190 🔍
SHA1 24c5a2456d2ba897405f8b58263cc2c8f6e3a568 🔍
SHA256 90c25ea6a95a970140829353b3ddd53b6426d7616f73767127bedcd5b174025e 🔍
SHA3 99db1d790e08a0b65dda295604886d705a9c62bf35f555ff4305c134423d0010 🔍
VirtualSize 0x26edf4
VirtualAddress 0x2000
SizeOfRawData 0x26ee00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.71954

.rsrc

MD5 ad011fc911c409e953e9fcd090890277 🔍
SHA1 98b4aacd90458624f86d23697e482495ffeae383 🔍
SHA256 fa6ff86385937c155d2b3ecb76796b01e05e8643ea4864c830bea943cb568fe7 🔍
SHA3 a43b04471de2fb66abe1e4750acfa67de3e25d8138201c5862db81fd829565e4 🔍
VirtualSize 0x69fa4
VirtualAddress 0x272000
SizeOfRawData 0x6a000
PointerToRawData 0x26f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.66897

.reloc

MD5 6698571cde0500685a0426dc1ac30b67 🔍
SHA1 f5b8732b93dd6132459d3391cae7c02fa1c84550 🔍
SHA256 5d9099d2feb04f88cb100afae567dd3805beab0ee56370113c55ce6115185a80 🔍
SHA3 a1e89ed14568823b52b7ec9a27e00cf703fdbfd74c53f05fd21ae1a27b802c87 🔍
VirtualSize 0xc
VirtualAddress 0x2dc000
SizeOfRawData 0x200
PointerToRawData 0x2d9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27191
MD5 53241850c0725ad03813b504f1d43c61 🔍
SHA1 599451cd138023ba36b8b7138b4bcbfdfee67e34 🔍
SHA256 ce0327adb70c2ba8bcc24d32313a7d2a4e36714cba3803564ea4a1c36014bf35 🔍
SHA3 8a9ef79a2d7e5f344233c7fd7dc48e8f25081ec0d1c1cf9e9c07f3298549ebf4 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27132
MD5 19d8821ad48407f8a4c5298f2e971fcd 🔍
SHA1 0351304255515c8cbdfb18c91eef0395e91ff521 🔍
SHA256 78e0bd9c1bc274f5214c26d1482c91fdf9746132cd33888c72bae9d63ffa53ee 🔍
SHA3 d2e4b9f1ad1a7dff997a0bc5fd5fca8caeff2ffa99d704e4a709c26a5e034c93 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28709
MD5 37402935e8f392cb955bf7a53abd031d 🔍
SHA1 27969429acf20ed970a99cb6858f6af81da15fc2 🔍
SHA256 b2d0763d3ba84b91da0e61b0916cc25fae97ea3a8f88fdf82fe3fab0bcfc660b 🔍
SHA3 e1cb168812b39cbffbc446adfe719063db2c486a47be93c59e6b5508cdff2fa5 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00002
MD5 66fc0ff5eff46dd51529bf6f12fab41f 🔍
SHA1 1953c675ce9b36d42317763584768ac4b047ca4d 🔍
SHA256 d58b0bb6e79b2474e7186d2f024dacd1bb7bfbeac2fab889775fd9c6ffe4f75c 🔍
SHA3 a690ce8e30ccb493516c46f756301a9e0197ccdcf9fe3cd0b5b4d06c342a73f6 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.02385
MD5 556e85dc5a8d6d85b066f9bc0ea4af6f 🔍
SHA1 c5ba544e1c5a2c708f43c0c61a19968fdaf14f9e 🔍
SHA256 d54e32d575e139052cd4a97334fb27fbbcee8326c25150b8e3013d6a7f5be017 🔍
SHA3 b7a32a668bbda3b218eadb6ce09cb80c5e8be83f1deb3acbc5bf0b5f8ac5468b 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.9238
MD5 db20c9985eccc1d7994b6e0165be104b 🔍
SHA1 5cc41b0f3221dbb4182fd4045ef51bbfa518e604 🔍
SHA256 f3c523be983218755edf408275acc83846e542f8f4135ca2f7291ecb3d60afd7 🔍
SHA3 2ddbb97ab2a1ba6408f0bd11582eec49ff4ec6cb89229ab858f9bafbfc6ff6a7 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.80387
MD5 06b9ef06cf4eba5f3bf3a91c3765cf76 🔍
SHA1 88032153c13f9c5627790cff0616853eab473ee4 🔍
SHA256 40b814ce9ec4c322b5dbe14b9edcde6531363f6e21be9e5517e6b5f923a267ff 🔍
SHA3 000982bfdd55331c8015988e2e17e55c67603e2964629864f2254bb07616b415 🔍

8

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.69552
MD5 d72e23d0411580c28e3e7400cbd2c7ce 🔍
SHA1 746c6adeb44e9c921d2f27578c1f0e8abbf7f41e 🔍
SHA256 c3c1fc3b711228be9abe686500c99c325427ba00f1a17a146ca3bcba11681f5b 🔍
SHA3 0c33fd36a56f8bd91ae56be491c889b60254924ea6cd9fb4aa3732d2b53c5291 🔍

9

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.48412
MD5 7d2eaacf71b8f09b7ba7d232c8ad7f84 🔍
SHA1 caa9bdad4550736226cb99a341f6c70100317260 🔍
SHA256 931ee69abd31ace75f5e9741bb36be05d0dfe778de96ea5226995743416613df 🔍
SHA3 6929895c9e28372a06e9d72da6aaa0ae18dd7e437e2ac3cb96596c6e962583b3 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.54377
Detected Filetype Icon file
MD5 523d6e3b8dcf65c632ece62958326648 🔍
SHA1 d0db4f80e0f60e6a7a163d1854782a4edfce6001 🔍
SHA256 a22e1d733794578340a32d77f9d8d23404edf852edbfcbddf176dfb237e0fd1c 🔍
SHA3 8ee5db47d06743698ca9442c7c72c883902310b505c88bea229e8eb6acddb828 🔍

1 (#3)

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x344
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27263
MD5 19138982ce5027f4b95c83bb71e25fb7 🔍
SHA1 44bcb0bef97ac6b55c58f44007ff44d8234b21ee 🔍
SHA256 5cc8ca65f6ac2d5ad141b17f812f7d2129353c502c22153a65c91ab9a0631c2f 🔍
SHA3 a62dad485884e3fd008971bbd2cf3e7a85b2d9fd9fb0a444fb046222b85d7e72 🔍

1 (#4)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x143
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.82158
MD5 e3f33e56a21a5196d7fedbbdd75fd68d 🔍
SHA1 820cbadb1bf9f4b201518dcd99a97423d3883a9f 🔍
SHA256 59a4a65181abecf282438bda7f06aa2ed1e5516b3904df2edc923a67f38866a2 🔍
SHA3 88bc1cdf259cce43b26aa2275f171e6aeda459f23ef3b38ceb55b6141fc4546b 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription Application
FileVersion (#2) 1.0.0.0
InternalName clientForCrypters.exe
LegalCopyright Copyright © 2026
LegalTrademarks
OriginalFilename clientForCrypters.exe
ProductName Application
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.