0ff630d526e0765c86ebcde19ebc0d0e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2021-Nov-09 18:03:59

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 5315623 bytes of data starting at offset 0x4c600.
The overlay data has an entropy of 7.9851 and is possibly compressed or encrypted.
Overlay data amounts for 94.442% of the executable.
Malicious VirusTotal score: 3/71 (Scanned on 2023-09-18 17:23:08) Bkav: W32.AIDetectMalware.64
McAfee-GW-Edition: BehavesLike.Win64.Dropper.tc
MaxSecure: Trojan.Malware.121218.susgen

Hashes

MD5 0ff630d526e0765c86ebcde19ebc0d0e
SHA1 145e8e861245f6331448a10cdddf071cc5108118
SHA256 77d77a7ef5086dfd70eb9620206dc77eedebb98e997a526b20a445d0257d4886
SHA3 a0442184f8e5cae2263b64bb60de35868bc85ce07dc7bf9cf3c6616c36a04251
SSDeep 98304:oC8tURVQWJuhswoYv5eONVkzxdIelLOOrCfdi4GkIPnkO+BMhbzSN/:oC2URuWJysVYvsOgtdIQLOMIdiwip1z
Imports Hash 51a5e6ba413b3d4c2f9ffde72d1f2a95

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2021-Nov-09 18:03:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x27c00
SizeOfInitializedData 0x24600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000009B10 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x61000
SizeOfHeaders 0x400
Checksum 0x56d779
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 296184d617a998fb5244b87ad131770c
SHA1 b83b94d0ce2237fec9576958fe024c910ea63e73
SHA256 dfc8c37a8ad0811fcb837ddd5e6819e10d3641e96c87edb30919a6a7031ab2f9
SHA3 4a4cc38f27ce1230ae4a9c1e7e0335c9d1cbbb8d99254f7216ba1ac9c7d42ebd
VirtualSize 0x27be0
VirtualAddress 0x1000
SizeOfRawData 0x27c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.49368

.rdata

MD5 ef931db6e8a997c4ba0b405b31b5349c
SHA1 de2c370a47660b4f5024b85d98c6fd4263368d5b
SHA256 89a2b8b84485690ba54472af2768449cc724c560ddd4f46fbc0064e21657ef11
SHA3 f428c56bf9ef7112543deff36b5a35df4f2fd2c248f152c173b36442a4843e22
VirtualSize 0x1183a
VirtualAddress 0x29000
SizeOfRawData 0x11a00
PointerToRawData 0x28000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.73001

.data

MD5 ffa48c07142397865c293efb2dc70cb6
SHA1 140db7c159e5e2fa3a061f4cbf7a51ea577cc344
SHA256 bd1fae9d7854b84627d2aeff83522f4a82afdf0ab666b0992845668974a6ab53
SHA3 1ee294f8e969937e382b0883ba576c3b086b0d7f2b0c779ea50ce6af34e1ff42
VirtualSize 0x103d8
VirtualAddress 0x3b000
SizeOfRawData 0xe00
PointerToRawData 0x39a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.81088

.pdata

MD5 2b2684f42c4fc5ca696311223fc0c0d3
SHA1 caf3accb3d619954d47041d95ac0468624c5f129
SHA256 f6ae31a86828d52993c1b020f7fb5a1d66e6895498311609e2dd9bffcbcb54ef
SHA3 15b5589c50072c77e966a08d67ea96df82957d3faf98f002a129db323d647b7f
VirtualSize 0x2088
VirtualAddress 0x4c000
SizeOfRawData 0x2200
PointerToRawData 0x3a800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.27704

_RDATA

MD5 27cd2196d9e6b2418e3874d945121423
SHA1 fc3ca0bbf228e09c9a8d3ab84fcea03c3d04a699
SHA256 07db9b3754d056df24aa82e795adc3c6fea1f5e08a6ae355f2ce5f78aa4c4518
SHA3 59bb263a32006621c68d1a3c03bb13ea555d4536c4824071bded3a4dfbf4b464
VirtualSize 0xf4
VirtualAddress 0x4f000
SizeOfRawData 0x200
PointerToRawData 0x3ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.99242

.rsrc

MD5 8146c45c3ea9a74c9c8dae69c57dc245
SHA1 a797517fecc48ebff4a9747c01574f8d6b849421
SHA256 189a74315bbe05bc0b040973b86e7bcc5f427f4e980a10f1f69e2dbae863c2cd
SHA3 74d96fdd24b04b8f22bc99852858e7c6f42348a02376c675317a3fecb04cc31f
VirtualSize 0xf060
VirtualAddress 0x50000
SizeOfRawData 0xf200
PointerToRawData 0x3cc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.35653

.reloc

MD5 cf5992ed51a42f136642584614acc53c
SHA1 6a4ea6b6427f2e462a9786efa278ce6abcb5c7c8
SHA256 f9dc70b554356da80b80699e94eed403b9c9fba6af247860662a65908c46c9f7
SHA3 74d3924f4d4448c5068e1a44afda8eeae07590beda546d012ad280d806c0316c
VirtualSize 0x754
VirtualAddress 0x60000
SizeOfRawData 0x800
PointerToRawData 0x4be00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.25516

Imports

KERNEL32.dll GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetStartupInfoW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
CreateProcessW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5e3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28189
MD5 9a7769cb839638adb0df7ba98b73ae03
SHA1 2cd74328f8a2d91f396008e7905af6235d350214
SHA256 a4348b54b24770a287bb1ea2dcf2ff372404ee1e2210f6ce0c4751c7669de364
SHA3 a2bc5266eadcdf359e5c768e881de14b682779cf333a4c58f4e9e80692e705e2

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Nov-09 18:03:59
Version 0.0
SizeofData 756
AddressOfRawData 0x3798c
PointerToRawData 0x3698c

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003b008

RICH Header

XOR Key 0xb40017bd
Unmarked objects 0
ASM objects (29395) 7
C++ objects (29395) 186
C objects (29395) 10
253 (28518) 3
C++ objects (30034) 39
C objects (30034) 17
ASM objects (30034) 9
Imports (29395) 5
Total imports 117
C objects (VS2019 Update 11 (16.11.4-5) compiler 30136) 19
Linker (VS2019 Update 11 (16.11.4-5) compiler 30136) 1

Errors

<-- -->