18dd5e7967a46e933cf61f4a46efd5c7230fddd3097647050d7a39828f1fa354
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Nov-30 19:24:45 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | This PE is packed with Themida |
Unusual section name found:
Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: .themida Section .themida is both writable and executable. Unusual section name found: .boot |
| Malicious | VirusTotal score: 50/70 (Scanned on 2026-06-29 11:31:10) |
ALYac:
Trojan.GenericKD.78079505
APEX: Malicious AVG: Win64:MalwareX-gen [Misc] AhnLab-V3: Trojan/Win.Generic.R766782 Alibaba: Trojan:Win64/Malgent.d6364128 Arcabit: Trojan.Generic.D4A76611 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Trojan.GenericKD.78079505 Bkav: W32.Malware.6658F64F CTX: exe.trojan.malgent CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS DrWeb: Trojan.Siggen32.28254 ESET-NOD32: Win64/Packed.Themida.L suspicious application Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.78079505 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: Riskware/Application GData: Trojan.GenericKD.78079505 Google: Detected Gridinsoft: Trojan.Win64.Packed.cl K7AntiVirus: Unwanted-Program ( 005ce11a1 ) K7GW: Unwanted-Program ( 005ce11a1 ) Kingsoft: Win64.Troj.malgent.v Lionic: Trojan.Win32.Malgent.4!c Malwarebytes: Malware.AI.3891399304 MaxSecure: Trojan.Malware.541797412.susgen McAfeeD: Real Protect-LS!36F1AF84DCA2 MicroWorld-eScan: Trojan.GenericKD.78079505 Microsoft: Trojan:Win64/Malgent!MSR Paloalto: generic.ml Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Dropper.rc Sophos: Mal/Generic-S Trapmine: malicious.moderate.ml.score TrellixENS: Artemis!36F1AF84DCA2 TrendMicro: Trojan.Win32.MALGENT.USBLLD25 TrendMicro-HouseCall: Trojan.Win32.MALGENT.USBLLD25 VBA32: Trojan.Win64.Malgent VIPRE: Trojan.GenericKD.78079505 Varist: W64/ABApplication.CYGJ-0771 ViRobot: Trojan.Win.Z.Agent.4271120 VirIT: Win32.Scribble.A Zillya: Trojan.Themida.Win64.19558 alibabacloud: Trojan:Win/Malgent.Gen tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 12 |
| TimeDateStamp | 2025-Nov-30 19:24:45 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x9a800 |
| SizeOfInitializedData | 0x5fe00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000071A058 (Section: .boot) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xaa9000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x41a4f2 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
(#2)
(#3)
(#4)
(#5)
(#6)
.idata
.tls
.rsrc
.themida
.boot
.reloc
Imports
| kernel32.dll |
GetModuleHandleA
|
|---|---|
| OPENGL32.dll |
glClear
|
| GDI32.dll |
SwapBuffers
|
| USER32.dll |
EnumDisplayDevicesW
|
| SHELL32.dll |
DragFinish
|
| MSVCP140.dll |
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
|
| SETUPAPI.dll |
CM_Locate_DevNodeW
|
| newdev.dll |
DiUninstallDriverW
|
| IMM32.dll |
ImmReleaseContext
|
| SHLWAPI.dll |
PathFileExistsW
|
| ADVAPI32.dll |
AllocateAndInitializeSid
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
memchr
|
| api-ms-win-crt-heap-l1-1-0.dll |
_callnewh
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_exit
|
| api-ms-win-crt-string-l1-1-0.dll |
strcmp
|
| api-ms-win-crt-utility-l1-1-0.dll |
srand
|
| api-ms-win-crt-stdio-l1-1-0.dll |
setvbuf
|
| api-ms-win-crt-time-l1-1-0.dll |
_time64
|
| api-ms-win-crt-convert-l1-1-0.dll |
strtoul
|
| api-ms-win-crt-filesystem-l1-1-0.dll |
_stat64i32
|
| api-ms-win-crt-math-l1-1-0.dll |
fminf
|
| api-ms-win-crt-locale-l1-1-0.dll |
___lc_codepage_func
|
Delayed Imports
1
101
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xdd59186d |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 20 |
| C objects (33140) | 3 |
| ASM objects (35207) | 4 |
| C objects (35207) | 10 |
| C++ objects (35207) | 34 |
| Imports (35207) | 6 |
| Imports (33140) | 27 |
| Total imports | 498 |
| C objects (33519) | 21 |
| C++ objects (LTCG) (35217) | 14 |
| Resource objects (35217) | 1 |
| 151 | 1 |
| Linker (35217) | 1 |
Errors
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .themida has a size of 0!
Leave a comment
No comments yet.