15bef57f0835f738939efd94b48868afea66371a58ced5fe9416b0751b0cadff

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 8.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
 Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Checks if it has admin rights:
  • IsUserAnAdmin
Suspicious The PE header may have been manually modified. Resource DLL is possibly compressed or encrypted.
The resource timestamps differ from the PE header:
  • 2015-Dec-30 10:03:22
 Resources amount for 81.4474% of the executable.
Malicious VirusTotal score: 56/70 (Scanned on 2026-08-29 19:02:37) ALYac: Gen:Trojan.Heur.fGW@!haiBEi
APEX: Malicious
AVG: Win32:PUP-gen [PUP]
AhnLab-V3: HackTool/Win.Patcher.C5563946
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Trojan.Heur.E48E87
Avast: Win32:PUP-gen [PUP]
Avira: PUA/W32.PUP
BitDefender: Gen:Trojan.Heur.fGW@!haiBEi
Bkav: W32.Malware.E1282F22
CAT-QuickHeal: Trojan.Agent
CTX: exe.trojan.patcher
ClamAV: Win.Trojan.Agent-6267930-0
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/HackTool.Patcher.T potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Application.Keygen (A)
F-Secure: PotentialRisk.PUA/W32.PUP
Fortinet: W32/Patcher.T!tr
GData: Gen:Trojan.Heur.fGW@!haiBEi
Gridinsoft: Hack.Win32.Patcher.sd!s1
Ikarus: Trojan-Dropper
Jiangmin: Trojan.Heur.ebj
K7AntiVirus: Hacktool ( 005cf9df1 )
K7GW: Hacktool ( 005cf9df1 )
Kingsoft: Win32.Riskware.Patcher.fn
Lionic: Trojan.Win32.Pophot.lb4x
Malwarebytes: Patcher.Trojan.HackTool.DDS
MaxSecure: Trojan.Malware.11343022.susgen
McAfeeD: ti!15BEF57F0835
MicroWorld-eScan: Gen:Trojan.Heur.fGW@!haiBEi
Microsoft: Trojan:Win32/Tiggre!rfn
Paloalto: generic.ml
Panda: Trj/RnkBend.A
Rising: Trojan.Kryptik@AI.91 (RDML:yWGYNTX7AYYgu5nCP3Fvmg)
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win32.Dropper.nc
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score
TrellixENS: PUP-XDX-TE
TrendMicro: TROJ_GEN.R002C0DDQ21
TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA5
VBA32: Trojan.Tiggre
VIPRE: Gen:Trojan.Heur.fGW@!haiBEi
Varist: W32/ABApplication.SSMR-5446
ViRobot: Trojan.Win32.Agent.79872.AJ
Webroot: W32.Malware.gen
Xcitium: TrojWare.Win32.TrojanSpy.Pophot.b@f7ydp
Yandex: Trojan.GenAsa!E041y+f8tUw
Zillya: Tool.Patcher.Win32.42136
alibabacloud: HackTool:Win/Patcher.T

Hashes

MD5 0f934898e245f804814293795b6670e7 🔍
SHA1 7691d582f4425d24b3c55f3a9757e779343b3398 🔍
SHA256 15bef57f0835f738939efd94b48868afea66371a58ced5fe9416b0751b0cadff 🔍
SHA3 fab973aff7b4ab1587e622543831937e8633696fc52a1b9a6da2a8999a3d68bd 🔍
SSDeep 1536:lCOYpOiiVD7XB88n/01+VwIacLa8K18T65u1HHIDb3JMLh9rvVJQTD4Da:Uc2SVoia8KuT65Oof3Uf7VJ7 🔍
Imports Hash 34d31ea23032326e5f6c2907cc29a327 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x3200
SizeOfInitializedData 0x14200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00003FA8 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0x5000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x1f000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 a70aedb03dac56ccb46c6c3028bb18e4 🔍
SHA1 31b5a98bdb236335aeda013e8d2a95c87d158d6f 🔍
SHA256 20bb1144554b7a01a1ee59b1bcbd0364bf75d5fb27368f451223e49c14bc751d 🔍
SHA3 eb4c0533496174e2ce3b141e24ebde640221d3d933076a818e12129e8245ef7d 🔍
VirtualSize 0x3138
VirtualAddress 0x1000
SizeOfRawData 0x3200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.40429

DATA

MD5 2ed1370f0603aaf1ef2135d190181d48 🔍
SHA1 fc0dbd984149d508c5a97f0db252f93cf1c34d1a 🔍
SHA256 a451df8f90182d24f9147305d35e1a8933217f279381c922c0246c1ace9d3211 🔍
SHA3 b160a963b99106745a72441440e85b3abde62a1a55b376ece9e85fb9fdadff46 🔍
VirtualSize 0xa0
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.85733

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x671
VirtualAddress 0x6000
SizeOfRawData 0
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 6d9537c22dac116c535e45ed73335178 🔍
SHA1 d5792c5c7140dc243310c08d9543daed90bdc769 🔍
SHA256 da9aed85c825cab81f0a4fb288c5c61f78a1b85b5b2620ad3ad65f88bde77aef 🔍
SHA3 2960bdb0e0ec40960920626bfa8e0d177c0855adba26c2f21e7453e340a322b1 🔍
VirtualSize 0x5b6
VirtualAddress 0x7000
SizeOfRawData 0x600
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.16619

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8
VirtualAddress 0x8000
SizeOfRawData 0
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 291399bc49d6e95a41d4fb00a521fd37 🔍
SHA1 28aaf995b2261fea7e3c9049ff238b08ea016a53 🔍
SHA256 715a5b39c6334f64e2fe725cc3eade8551f80551bead97448d0d6cefbbada409 🔍
SHA3 c3e1f8bc0a4eaeb24ab0462bbacd869e1b7b217a3f034537ecced3b31f7a1b98 🔍
VirtualSize 0x18
VirtualAddress 0x9000
SizeOfRawData 0x200
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 0.204488

.reloc

MD5 4fb70d9ebdd0c3535b510b370a07bb4f 🔍
SHA1 965f84fda1cbea763397a00664b23d1b2ac6330c 🔍
SHA256 0fea49656e949853d101d60a998e4d00924ccb105f1e041bfd24eb631af33672 🔍
SHA3 7c4d4f2643db4eb268e8aa895054a481ceec8d5d783eae9e4c20c5077ebcbc58 🔍
VirtualSize 0x380
VirtualAddress 0xa000
SizeOfRawData 0x400
PointerToRawData 0x4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.07367

.rsrc

MD5 1fbf5afbb5dd78898d902b70379f4838 🔍
SHA1 7610606433f443f1c9dacfceef6eec834e1bf5ca 🔍
SHA256 0091b4fa2855133a0d2b02f3c3a27e79976fa056c119748141591bfd1293eec0 🔍
SHA3 6a0dbdef0a4a2510eb717a357bb8f95248859460bc155cec0ece535d01abf674 🔍
VirtualSize 0x14000
VirtualAddress 0xb000
SizeOfRawData 0x13400
PointerToRawData 0x4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 7.94958

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll GetKeyboardType
MessageBoxA
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
kernel32.dll (#3) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll (#2) GetKeyboardType
MessageBoxA
kernel32.dll (#4) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
shell32.dll IsUserAnAdmin

Delayed Imports

DLL

Type RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x11e00
TimeDateStamp 2015-Dec-30 10:03:22
Entropy 7.99743
MD5 52d4f64365c048328fd712dfd39d6d00 🔍
SHA1 7a9ca7f5fecc244515535a2df0310da35dd36c09 🔍
SHA256 7457f6b6e07abcf911c317ea357453c01d75dba43d349a66a3037e05a0f0439d 🔍
SHA3 5e59b03e7c0b0f1ce6473b3b5d64edcbdb8bc3ebd9fe8f5ad3d707855d6b2e0a 🔍

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 2015-Dec-30 10:03:22
Entropy 5.47055
MD5 0037d28535ae90790972f1ea2874d5c0 🔍
SHA1 7d236cfe30a7de670c4498f827c5027513be088d 🔍
SHA256 b15251a77294c52ece4cc450d201b9c6508a9c872cdbfcaa8c5711c04e0972ca 🔍
SHA3 e1d60b1b5b105d86451dd18dc645451560fb408ec537fe7b48517f00cff0160b 🔍

500

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2015-Dec-30 10:03:22
Entropy 1.7815
Detected Filetype Icon file
MD5 3c68f77c35c26ff079a1c410ee44fa62 🔍
SHA1 0b40150c95fc2c6414c90d44ee78b8d8814b3393 🔍
SHA256 a14e70ed824f3f17d3a51136aa08839954d6d3ccadaa067415c7bfc08e6636b0 🔍
SHA3 590dcbf2ec3f485a6c24e3e627f383ee7588eb49978321f12c07d8190a6c1396 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x382
TimeDateStamp 2015-Dec-30 10:03:22
Entropy 4.85663
MD5 3d015c7d35d5e650f594c23c7368cd6f 🔍
SHA1 b5fdca6e0c5847a306b43553ce96c7c37a40c680 🔍
SHA256 3e11f55df49746534018ddcb81f928559124029992dfaa0adb67318b2d41df15 🔍
SHA3 94d9e3898971601d603eb374856eca2677a11d61314d956b1f82e18cd60c9b4c 🔍

Version Info

TLS Callbacks

StartAddressOfRawData 0x408000
EndAddressOfRawData 0x408008
AddressOfIndex 0x405084
AddressOfCallbacks 0x409010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0!
Leave a comment

No comments yet.