170a55f7c0448f1741e60b01dcec9cfb

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-May-04 02:40:47
Detected languages English - United States
Korean - Korea

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Possibly launches other programs:
  • WinExec
Malicious VirusTotal score: 24/69 (Scanned on 2019-09-09 07:18:01) MicroWorld-eScan: Gen:Variant.Graftor.487501
Qihoo-360: Win32/Trojan.e04
McAfee: Trojan-HidCobra
CrowdStrike: win/malicious_confidence_100% (W)
F-Prot: W64/Trojan3.AOLF
ESET-NOD32: a variant of Win32/NukeSped.AU
Paloalto: generic.ml
Kaspersky: UDS:DangerousObject.Multi.Generic
ViRobot: Trojan.Win64.S.Agent.197632
Endgame: malicious (moderate confidence)
McAfee-GW-Edition: Trojan-HidCobra
Sophos: Mal/Generic-S
Ikarus: Trojan.Win32.NukeSped
Cyren: W64/Trojan3.AOLF
MAX: malware (ai score=99)
Microsoft: Trojan:Win32/Casdet!rfn
AegisLab: Trojan.Win32.Generic.4!c
ZoneAlarm: UDS:DangerousObject.Multi.Generic
AhnLab-V3: Trojan/Win32.Akdoor.C2332488
ALYac: Trojan.Nukesped.A
Rising: Backdoor.Escad!8.18BD (TFE:6:S6ANyXOKFj)
Fortinet: W32/HidCobra.9CFB!tr
AVG: Win32:Dh-A [Heur]
Avast: Win32:Dh-A [Heur]

Hashes

MD5 170a55f7c0448f1741e60b01dcec9cfb
SHA1 b6b84783816cca123adbc18e78d3b847f04f1d32
SHA256 084b21bc32ee19af98f85aee8204a148032ce7eabef668481b919195dd62b319
SHA3 e05444ed70580fa0eb5fd7a427f1d2f9e367a6f61d9e75dd37d53b199afb53d1
SSDeep 6144:XT1NVhDJSUaZcdHItR3SG88+Tlm5T7BRWj:xx9tuVSe+Tlm5Tt
Imports Hash 0675d7e21ce264449360c0b797c279e7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2017-May-04 02:40:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 12.0
SizeOfCode 0xae00
SizeOfInitializedData 0x27600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001250 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x36000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 aaf67ea89d12bea95c148274c71ebac5
SHA1 4dc5a5a2464e8fda563a775e2fe21fe444ce627a
SHA256 6151f72179edae3ae228524bdf04db949c7b28976e4658a5509a80ce1ded1a5e
SHA3 827237ad75f1e1f2d71ba8d712d21560036526232198817c18c802f00e1792cc
VirtualSize 0xac94
VirtualAddress 0x1000
SizeOfRawData 0xae00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.44074

.rdata

MD5 91171a72af025ca7098ba6c94ecbb2a0
SHA1 57355723d239e45f042aef2419e9ccbfa0d2c1f0
SHA256 c421b60e61a116d406ab7fc91c54c5a83ca8b98a0d3324af8f381fdbec0c1698
SHA3 b3fc45dee580f2932554cea263a76b364a9fed04e44f0957430d57e350eaca8f
VirtualSize 0x62fe
VirtualAddress 0xc000
SizeOfRawData 0x6400
PointerToRawData 0xb200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.9358

.data

MD5 fc2a61b6f1b29162f93fad1660c4b8af
SHA1 679c57db2ef2418e9b0d93f9fc5af86002d62742
SHA256 ae7b952add55006a49176c6bf2c8603fc6d220ed530dd2fc8f772e7994de3082
SHA3 d4c57453e506f7b9525d7ca33eec9f7ae4ad72957a23bbd0ce4adc08fb936976
VirtualSize 0x1f9b8
VirtualAddress 0x13000
SizeOfRawData 0x1d600
PointerToRawData 0x11600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.37989

.pdata

MD5 114b795f9c567e0a81a04cec6ae1a0b4
SHA1 427d879dbbac78279c17a7e074808b51603d1be9
SHA256 f7899c905b4bb11d4a9030772c74252bde33f14dc9a3fd32e632690cbcd85e0c
SHA3 9d3b877fffb54a4fbcf154d32daf0efe3ec71dabd58b6fd694c13f3b3b71bbdd
VirtualSize 0x8b8
VirtualAddress 0x33000
SizeOfRawData 0xa00
PointerToRawData 0x2ec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.2875

.rsrc

MD5 17c80d03f2f5729407ec55eca7e1f5b2
SHA1 c3a005e032538ce29e114684e9d669c15d68a7ad
SHA256 54e97c844b559f11e42e423a77e652c0b87364f9082489ca000945c72af490b3
SHA3 0f10de89d7805a24630a5d0e9fb76ecfeef7823ad62535c8df7d1c8f86e84840
VirtualSize 0x7b0
VirtualAddress 0x34000
SizeOfRawData 0x800
PointerToRawData 0x2f600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.94856

.reloc

MD5 c9243c94e36bc012d7d5eb0a3f588dfb
SHA1 4aefb3317db5d44b1b73ed4d55a7305e170793cb
SHA256 ea23f85e8f5fb1d2c492ee792523683c5f3693a4421d4b2451cce2d51047ddcf
SHA3 643fea7c1a9268cfb9663c6d45fac8e904978c10fd2a73ba6d1a34a1b149041a
VirtualSize 0x520
VirtualAddress 0x35000
SizeOfRawData 0x600
PointerToRawData 0x2fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.07983

Imports

KERNEL32.dll CreateFileA
WriteFile
WinExec
CloseHandle
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetModuleFileNameW
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW

Delayed Imports

DoStart

Ordinal 1
Address 0x1010

101

Type RT_BITMAP
Language Korean - Korea
Codepage UNKNOWN
Size 0x4e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.479332
MD5 75ffe59e7220567fe657110de52aa027
SHA1 dc9763c14eceb0261e93ffdcdc9ba7229115c8b4
SHA256 aa1216312c16ac0b247283323d1b47f81f5243f999e6adfa6ac031505295e999
SHA3 20f8c3e13704e0233aabe008773e71f83afcbd3df1c8012cb24423bbb6a35a54
Preview

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x224
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.04378
MD5 245b863be176aab16ef1dbe168defe03
SHA1 c0a369f6f0e77b89c5d9d37fb94e1d5e2d431b5b
SHA256 59ba97d56a01766792386c3b379946bb613c8921e3daf8a878855a268ad5e4aa
SHA3 7efbe82f17422b353f747a146c1e8f1b9df37e90648150f2020442ff9477341e

Version Info

TLS Callbacks

Load Configuration

Size 0x70
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180013000

RICH Header

XOR Key 0xc2662857
Unmarked objects 0
Imports (65501) 3
Total imports 80
C++ objects (20806) 24
C objects (20806) 96
ASM objects (20806) 8
229 (VS2013 build 21005) 3
Exports (VS2013 build 21005) 1
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 build 21005) 1

Errors