163fe0ab6b2d3f864b731ebbd4faa056

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Jul-17 20:58:26

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: \x00
Section \x00 is both writable and executable.
Unusual section name found: .rsrc
Unusual section name found: .idata
Unusual section name found:
Section is both writable and executable.
Unusual section name found: ljelsytd
Section ljelsytd is both writable and executable.
Unusual section name found: esqfixtx
Section esqfixtx is both writable and executable.
The PE only has 2 import(s).
Malicious VirusTotal score: 26/63 (Scanned on 2017-07-18 14:11:21) Bkav: W32.HfsAutoB.208C
MicroWorld-eScan: Trojan.GenericKD.5637223
Cylance: Unsafe
AegisLab: Ml.Attribute.Gen!c
K7GW: Trojan ( 0040f4ef1 )
K7AntiVirus: Trojan ( 0040f4ef1 )
Baidu: Win32.Trojan.WisdomEyes.16070401.9500.9668
Symantec: ML.Attribute.HighConfidence
ESET-NOD32: a variant of Win32/Packed.Themida.AHZ
Paloalto: generic.ml
Kaspersky: Trojan-Ransom.Win32.Cryptor.ig
Rising: Malware.Heuristic!ET#93% (rdm+)
Ad-Aware: Trojan.GenericKD.5637223
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.Trojan.tc
Emsisoft: Trojan.GenericKD.5637223 (B)
SentinelOne: static engine - malicious
Avira: TR/Crypt.TPM.Gen
Endgame: malicious (high confidence)
ZoneAlarm: UDS:DangerousObject.Multi.Generic
GData: Trojan.GenericKD.5637223
AVware: Trojan.Win32.Generic!BT
MAX: malware (ai score=87)
Malwarebytes: Trojan.MalPack
AVG: Win32:Malware-gen
Avast: Win32:Malware-gen

Hashes

MD5 163fe0ab6b2d3f864b731ebbd4faa056
SHA1 5ead398e46c604bc0b27194dab5410dc66a91510
SHA256 cff9ce6629ef7c7131e875f45ffbc6fce51f2dbcc7703d98fe13359cb4c2052b
SHA3 5bedd6987ee7fdd4325f11e062b0e0042e8fe9df7d88728ac4fdc5668356f8d6
SSDeep 49152:/7nh3LSHoewlD/Z/iPR0v2sGt6x3z/Q1:/7nh3LLlV/qWn26t
Imports Hash baa93d47220682c04d92f7797d9224ce

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2017-Jul-17 20:58:26
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x1f600
SizeOfInitializedData 0x1419200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x018F3000 (Section: esqfixtx)
BaseOfCode 0x1000
BaseOfData 0x21000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x18f4000
SizeOfHeaders 0x400
Checksum 0x1d7dbc
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

\x00

MD5 62d72401693a50ed7e403930d51fafbe
SHA1 766a4fe4c704f8f134f4b425fe9fbd075debed12
SHA256 a7c0aa5f168349eb56c13bb9f47ea314612d7c5d579d0653c1ad0f573f741304
SHA3 a0e5b43ca21c8d55a08c84153777285bbdb8fdcf068029110f26e10edfcd470c
VirtualSize 0x1438000
VirtualAddress 0x1000
SizeOfRawData 0x17e00
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.97786

.rsrc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1000
VirtualAddress 0x1439000
SizeOfRawData 0
PointerToRawData 0x18e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 31548e577e706827886c92f5d6d543d1
SHA1 bc23ad9a535e432b535412264caba40c1be1a13d
SHA256 6a1f70911fbc2649be010b38a09b8d009d73bfc01d841c8c66d7ed7a70fb9249
SHA3 79ff9fdcc635ba1e880459e209d610fd86a0c1026de067475c80d54f07548dad
VirtualSize 0x1000
VirtualAddress 0x143a000
SizeOfRawData 0x200
PointerToRawData 0x18e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.4229

MD5 8fc3147699a0afc83bf21f82ad675826
SHA1 34d38d0fc94cadaea5752673c018fe344e78adcb
SHA256 f87609108e3a53ef257e5297079e674f2305da7ec5a2145e9e6e763632add5b9
SHA3 adeb646b464c9b6a0632cd71447729965f44ae6c60fdbf99b900a6611a69ef97
VirtualSize 0x2fc000
VirtualAddress 0x143b000
SizeOfRawData 0x200
PointerToRawData 0x19000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.277186

ljelsytd

MD5 ab9f53f0be6428d6b86b69d16f755cf6
SHA1 e8c88ff46e6f7a9f54acaec834737aa30d8f78b4
SHA256 ba38109cb076af68139c5ee17560ab2a690d01017857f4bc8947fa6c5f5c6c4c
SHA3 9f0ce83e31738c665c9c674c5e1554feb4444852395eabd018940943d347cc55
VirtualSize 0x1bc000
VirtualAddress 0x1737000
SizeOfRawData 0x1bb600
PointerToRawData 0x19200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.95233

esqfixtx

MD5 ce9d8239a4acdd87c35785d0b26b4c14
SHA1 c224ed2970a1512779cdf3658e6f015709ef9a08
SHA256 0ca0a9ef8dd7b81b4308e58178590c70a8001b3f2207a77c6cdee8004b8900b1
SHA3 32a84fdad7c23eabf96c34cfaa61a5e009625b3aca5de9cc75c5912770b0fd9c
VirtualSize 0x1000
VirtualAddress 0x18f3000
SizeOfRawData 0x200
PointerToRawData 0x1d4800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.61478

Imports

kernel32.dll lstrcpy
comctl32.dll InitCommonControls

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x1838000
EndAddressOfRawData 0x1838008
AddressOfIndex 0x1cf2414
AddressOfCallbacks 0x1cf241c
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

XOR Key 0x82e4436b
Unmarked objects 0
ASM objects (24610) 13
C++ objects (24610) 161
C objects (24610) 22
ASM objects (24723) 22
C++ objects (24723) 59
C objects (24723) 34
Imports (24610) 15
Total imports 135
265 (VS2017 v15.2 compiler 25019) 4
Linker (VS2017 v15.2 compiler 25019) 1

Errors

[*] Warning: Section .rsrc has a size of 0!
<-- -->