0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2018-Feb-01 19:43:01 |
Plugin Output
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource F9F68AAFA41588E690E310ED9EF7AF4A is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 18/70 (Scanned on 2026-08-11 12:05:44) |
CTX:
exe.trojan.generic
CrowdStrike: win/malicious_confidence_100% (W) Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Google: Detected MaxSecure: Trojan.Malware.8426628.susgen McAfeeD: ti!0F7F86530B7F Paloalto: generic.ml Panda: PUP/Gamehack Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Infected.ch Sophos: Generic ML PUA (PUA) Symantec: Trojan Horse TrellixENS: Artemis!CD6CDDAC2686 TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101H126YZ Varist: W64/ABApplication.HOCB-6021 tehtris: Generic.Malware |
Hashes
| MD5 | cd6cddac2686df01814705f21e6da343 🔍 |
|---|---|
| SHA1 | f29ad4efdc160ffba5cb63e01349ec9b84123e30 🔍 |
| SHA256 | 0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992 🔍 |
| SHA3 | 502e2ddc6f26184ec8926f3085296662feb297d01cad06ec9f5216ee73b8aaed 🔍 |
| SSDeep | 3072:yuo1MlSEqhqJhJy0WTHW69B9VjMdxPedN9ug0/9TBfsdZK0:y5oaqJhJMHW69B9VjMdxPedN9ug0/9Tk 🔍 |
| Imports Hash | f326f88ca83c9aacaa44acfb8884f1d4 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2018-Feb-01 19:43:01 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x16800 |
| SizeOfInitializedData | 0x11600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2d000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
| MD5 | aa16f98b8fe7f2b775e16d029f583896 🔍 |
|---|---|
| SHA1 | 34e97b72a1fcaef8157041e282534310959990dc 🔍 |
| SHA256 | 706fbc4bc301513caf498304e53c8d0e9d9834fd8487b2bb22969621d0d7ea48 🔍 |
| SHA3 | b86a4e04887ca1818c6e0e3266169ccd6c06a6a1c40e52744d2ecb091d44b1a0 🔍 |
| VirtualSize | 0x5b79 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x5c00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.50757 |
.text
| MD5 | 981bc6e1f1f7aa59aff461d618525a35 🔍 |
|---|---|
| SHA1 | 247ca166fa1bf5d879a3a724ccfc830fcf8eaf30 🔍 |
| SHA256 | abda454cea154bc08c6d53450aa6c740869e5db4a84cfdc802c83f2f510e908b 🔍 |
| SHA3 | 04a7cece69e700914d199f8ad236c713654825cd745fbfa8716550ad97d7cb34 🔍 |
| VirtualSize | 0x10a35 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0x10c00 |
| PointerToRawData | 0x6000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.32703 |
.rdata
| MD5 | 626f5b2f4c9e5c74296566e1aedb36b8 🔍 |
|---|---|
| SHA1 | 0092830f8ddc1171d4898b5128a920810d7a4a87 🔍 |
| SHA256 | deeac67e6cf212e045b8ce74c329ee0307f029af39fdd6ce41b8c11613b53e80 🔍 |
| SHA3 | 23eba5d04b3fd5e18f6c3c24183827de7b2032af540885ad1f58bde7f93b29a7 🔍 |
| VirtualSize | 0x4b8d |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x4c00 |
| PointerToRawData | 0x16c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.67803 |
.pdata
| MD5 | 160e0be5ce9d191773103a22e378fe5d 🔍 |
|---|---|
| SHA1 | 431008086d1bb076b2d34df95d6dd3371b429670 🔍 |
| SHA256 | 4d3a5da5a0f6244664299dd364d5df3ed6114a0870621130e5c82479192754b9 🔍 |
| SHA3 | 605e88291eb3d1998ed0500671bd4e9e35674224bd2cb642950d105e0bb7481e 🔍 |
| VirtualSize | 0x1134 |
| VirtualAddress | 0x1d000 |
| SizeOfRawData | 0x1200 |
| PointerToRawData | 0x1b800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.99368 |
.data
| MD5 | 21c9a825e380fa805c2efe06cc5d1adb 🔍 |
|---|---|
| SHA1 | f9342fadc33e1263074a842082d156bb8c5d349b 🔍 |
| SHA256 | 3cde20b735ad2ccd7bcdf1dd806279e1e4c621a1e20cc7795eafcb3887636e86 🔍 |
| SHA3 | 30d72fac1b55f8637c6eb5b4d0333a2b0da35f8acd16435ca51d2cbdc6cb3bfa 🔍 |
| VirtualSize | 0x23a8 |
| VirtualAddress | 0x1f000 |
| SizeOfRawData | 0x1600 |
| PointerToRawData | 0x1ca00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.38063 |
.rsrc
| MD5 | ede0b08941d6148bff99c8c9f8b2736d 🔍 |
|---|---|
| SHA1 | 1ac4609381655d72f2acdd2392de1d543a45fce0 🔍 |
| SHA256 | 08b554bfb953e73ce25af4b8f7f5bb2dc26035425c5a850372f50f29b654fabc 🔍 |
| SHA3 | 26d93cad409533211a994890838f81b6a77b3ba3eb470fd86fb65c9bafccb78d 🔍 |
| VirtualSize | 0xa080 |
| VirtualAddress | 0x22000 |
| SizeOfRawData | 0xa200 |
| PointerToRawData | 0x1e000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.81975 |
Imports
| msvcrt.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp wcscat memcpy tolower malloc |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle SetConsoleCtrlHandler HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW PeekNamedPipe TerminateProcess GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess DuplicateHandle CreatePipe CreateProcessW GetExitCodeProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection GetLastError SetLastError UnregisterWait GetCurrentThread RegisterWaitForSingleObject |
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathAddBackslashW
PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW DefWindowProcW GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW EnableWindow DestroyWindow UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled GetSystemMetrics CreateWindowExW SetWindowLongPtrW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.48251 |
| MD5 | bac75a92b934ae4ea8be684b6d5f1723 🔍 |
| SHA1 | e8767a3c781382db150e0ef7ed59bb97a3452faa 🔍 |
| SHA256 | 49135180dbdd0abee1ad26e7b41a603e0e10ec17857b1257ac46882dbe47c0b9 🔍 |
| SHA3 | 5a3000c63141cd334bd2248c232d3f49f1acc1b2754c27484800a0db2a81d8cf 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.31158 |
| MD5 | 5027dba1fb1cfa80bfab8aeb195350af 🔍 |
| SHA1 | 47552d89b6d4b8e5d1491cfe88766485f7196b03 🔍 |
| SHA256 | a51d421ec989e898da2296a8356380f7de467929ce128648f5e3c0e0769b7987 🔍 |
| SHA3 | bf469f801e5a31fa03480d138e5e2b9c76c77488b0e590fd4d04848d5555a8b0 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.19471 |
| MD5 | fd64042ae3a4c2b13accdf2666ff6c09 🔍 |
| SHA1 | aa5ae43810e178e11cbb229e8330ba428abf02a7 🔍 |
| SHA256 | 81657aeccdf04b0a9073fdbe1d12a0586d31c8ea623d36f8da351e4347d19496 🔍 |
| SHA3 | b7f7d16bc7e897c8e8de812efc21d9fddf4a20af7fa269e48a072dfc3c0bb56e 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.03387 |
| MD5 | a78213719c559d08386879765dd86e41 🔍 |
| SHA1 | 741db54cc4c4488480d842014f20c488da00035c 🔍 |
| SHA256 | d12fc8501f91429eae982cfdf47f2088496a5e721257f7bc57cdce418fdd0a51 🔍 |
| SHA3 | 67ab7e3e32c98205f1b734b68215df72d1e0481d4ffb2f765ebd5d32aa2e1472 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xf1a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.90213 |
| Detected Filetype | PNG graphic file |
| MD5 | 6120be92512b71c36f51bcd928854c7a 🔍 |
| SHA1 | 6f332c6846e5bea1248ef78dbb0a0939981b6ed0 🔍 |
| SHA256 | 03cb584369815e84c6b1300dbbb717106252b5109bda456163ad9ce49290ca23 🔍 |
| SHA3 | 8762bacce99200e55ec85e851aa180cc5bed2f6d7e22f37a89a1d1b339b12ed3 🔍 |
6795914FDFDAD1E4291F588ADA4B6259
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x15 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.59447 |
| MD5 | 8a80582c2476ecb274129fb4b0f4091b 🔍 |
| SHA1 | 3024de04b29d6bb25fcb832b422dbd54252d4965 🔍 |
| SHA256 | 1ee8510d721f4b420e792768ad9195a64fa7a3235eacc7ccafe517d932e102e3 🔍 |
| SHA3 | 5f2f70f154bd2d616d379900db55efae6daa189acda64751e7a538fda6b908ed 🔍 |
B02185B4CB
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 0 |
| MD5 | 55a54008ad1ba589aa210d2629c1df41 🔍 |
| SHA1 | bf8b4530d8d246dd74ac53a13471bba17941dff7 🔍 |
| SHA256 | 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a 🔍 |
| SHA3 | 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7 🔍 |
F9F68AAFA41588E690E310ED9EF7AF4A
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x469d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99012 |
| MD5 | 0e4b2937a411207ba366a651e7ceb087 🔍 |
| SHA1 | 95bd6abd106d1acd751a4fc28c0c9c4ba08cadb5 🔍 |
| SHA256 | e8fbae2bdbfe49ba55882fb569c75465484c76d4e9dbff2d6db3a89c42b67032 🔍 |
| SHA3 | 9e442d6f949ca0b7996c5cfad5e61b98cc1023072da7c11655947770db0403a2 🔍 |
FFDBE721BBF4A73BEF024DBC050DE04F5827E6C9
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0xd |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.70044 |
| MD5 | 514c604f95b1aaf4348bb209e2d148d3 🔍 |
| SHA1 | bf748a06c78b079134d03c91dcee318208080465 🔍 |
| SHA256 | 75e32aaa3c88f7029d030501d08b8b1ea97f4b8f47a3f47afeca5140b219ae01 🔍 |
| SHA3 | 680986c8f3ca84351a68a108b22b1e1bff8f5470cf385a52ce8af129cb09c0f7 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x4c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.64638 |
| Detected Filetype | Icon file |
| MD5 | c7078e456b26f59b0f5eb4d0789ee2a6 🔍 |
| SHA1 | e4000e3ff17b8835694656faafc7495153955005 🔍 |
| SHA256 | 4a79de1cff9e4016219c8785546597107c297291b410666d116cfa6aad445e35 🔍 |
| SHA3 | 95459f76a38fd752308c9a64c4ee91cb93ce89129077322d9801a57d047ec89c 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x2a0 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.08821 |
| MD5 | ffd3b06250ba95d239365ef050b3627b 🔍 |
| SHA1 | 16e3981245d8dbd44f33d93b203c02a44f3c2b95 🔍 |
| SHA256 | 1c3703755b6e9a690e8eafaa0cc318f667cd5d4c06935b6e3cd07296df9e9dcd 🔍 |
| SHA3 | 2c6baa84c172762978837565c2b2ed4f7716c0edaab79bda3a3ef74724426773 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
💸 New Message from Coinbase. OPEN ⭐➤ graph.org/YOU-HAVE-A-NEW-BI
9 hours ago
💸 New Message from Coinbase. OPEN ⭐➤ graph.org/YOU-HAVE-A-NEW-BITCOIN-TRANSFER-FROM-COINBASE-08-27?hs=22d84d7a76d273dbd90a7a98d22ed4b6& №RI6436 💸