| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Jun-14 11:43:03 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 54/70 (Scanned on 2025-02-03 19:18:15) |
ALYac:
Gen:Variant.Fugrafa.284513
APEX: Malicious AVG: Win32:BotX-gen [Trj] AhnLab-V3: Trojan/Win.BotX-gen.C5441530 Alibaba: TrojanBanker:Win32/Generic.cd489692 Antiy-AVL: Trojan[Banker]/Win32.Qbot Arcabit: Trojan.Fugrafa.D45761 Avast: Win32:BotX-gen [Trj] Avira: TR/AD.KBot.cxhta BitDefender: Gen:Variant.Fugrafa.284513 Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.172922642550e881 CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: BackDoor.Qbot.792 ESET-NOD32: a variant of Generik.GOVJGTE Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Fugrafa.284513 (B) F-Secure: Trojan.TR/AD.KBot.cxhta FireEye: Generic.mg.15ed589908a80c2e Fortinet: W32/PossibleThreat GData: Gen:Variant.Fugrafa.284513 Google: Detected Ikarus: Trojan.SuspectCRC K7AntiVirus: Trojan ( 005a7c071 ) K7GW: Trojan ( 005a7c071 ) Kaspersky: HEUR:Trojan-Banker.Win32.Qbot.gen Kingsoft: Win32.Trojan-Banker.Qbot.gen Lionic: Trojan.Win32.Qbot.11!c MaxSecure: Trojan.Malware.74816637.susgen McAfee: GenericRXWD-JJ!15ED589908A8 McAfeeD: Real Protect-LS!15ED589908A8 MicroWorld-eScan: Gen:Variant.Fugrafa.284513 Microsoft: Trojan:Win32/Cutwail!ic NANO-Antivirus: Trojan.Win32.Qbot.jwwilr Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Trojan.Kryptik@AI.89 (RDML:iKA+EG2OvKIVzgwgkoyx/g) SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Generic.vm Sophos: Mal/Generic-S Symantec: Trojan Horse Tencent: Malware.Win32.Gencirc.13d3fba8 Trapmine: malicious.moderate.ml.score VIPRE: Gen:Variant.Fugrafa.284513 Varist: W32/ABTrojan.TKIZ-5549 VirIT: Trojan.Win32.Genus.RGS Xcitium: Malware@#211noq8ifz5fb Yandex: Trojan.Agent!Ms08HwBEApc Zillya: Trojan.Qbot.Win32.15144 alibabacloud: Trojan[stealer]:Win/Cutwail.Gen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2023-Jun-14 11:43:03 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x15800 |
| SizeOfInitializedData | 0x268e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000C7FC (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x17000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x283000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
EnterCriticalSection
LeaveCriticalSection InitializeCriticalSection CloseHandle GetLastError DeleteCriticalSection CreateThread GetCurrentThreadId GetCurrentProcessId CreateFileMappingA MapViewOfFile OpenFileMappingA UnmapViewOfFile ExitProcess VirtualAlloc CreateMutexA ReleaseMutex ExitThread IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetLastError HeapAlloc FreeLibrary GetModuleHandleW GetModuleHandleExW GetProcAddress HeapFree InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LoadLibraryExW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap GetStringTypeW MultiByteToWideChar WideCharToMultiByte HeapSize HeapReAlloc GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Jun-14 11:43:03 |
| Version | 0.0 |
| SizeofData | 1404 |
| AddressOfRawData | 0xd5e98 |
| PointerToRawData | 0xd4a98 |
| Size | 0x5c |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x67d7f8 |
| SEHandlerTable | 0 |
| SEHandlerCount | 0 |
| XOR Key | 0xee2ae326 |
|---|---|
| Unmarked objects | 0 |
| Unmarked objects (#2) | 2 |
| ASM objects (24237) | 18 |
| C++ objects (24237) | 34 |
| C objects (24237) | 17 |
| 241 (40116) | 9 |
| 243 (40116) | 121 |
| 242 (40116) | 26 |
| Imports (65501) | 3 |
| Total imports | 93 |
| C++ objects (24245) | 2 |
| Resource objects (24245) | 1 |
| Linker (24245) | 1 |