1a29613c4d28cbb45edf6e18849c702d61b94cb8d4a9f8ba816bc443b8a2518f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Detected languages English - United States
FileDescription Host Process
FileVersion 1.3.0.0
InternalName ApplicationHost.exe
OriginalFilename ApplicationHost.exe
ProductName Host Process
ProductVersion 1.3.0.0

Plugin Output

Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegSetValueExA
 Has Internet access capabilities:
  • URLDownloadToFileA
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 14/70 (Scanned on 2026-08-21 10:29:43) Bkav: W32.Malware.9B0C8783
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.Themida.L suspicious application
Elastic: malicious (high confidence)
Malwarebytes: Malware.Heuristic.2025
McAfeeD: ti!1A29613C4D28
Microsoft: Trojan:Win32/Wacatac.B!ml
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.moderate.ml.score
tehtris: Generic.Malware

Hashes

MD5 9af4772a7ed799b354ccd39b3365232f 🔍
SHA1 15d17ec79986594033803ce6e22c08756197da5e 🔍
SHA256 1a29613c4d28cbb45edf6e18849c702d61b94cb8d4a9f8ba816bc443b8a2518f 🔍
SHA3 9024616d4b7e2abb09e39f4638a45e6d693d92b343a2e8cf58a450b4745e0a1d 🔍
SSDeep 98304:NuaBolOE3Fc36jqrHY0bcC6s7OAAeYggscCWPL9bX45YSQ/pcACgYEHY:3B0OE+3NbAC6sbAeYnscC1YS6pDDHY 🔍
Imports Hash 9017d386b763771d330b51a10232485a 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x140

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 13
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x88d600
SizeOfInitializedData 0x2d5600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000F21058 (Section: .boot)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1119000
SizeOfHeaders 0x600
Checksum 0x6a1c3c
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 214fa77e1fe7f829052035c5e7c7125e 🔍
SHA1 8ce6f0a6ab6b90769c911468651595470c40677d 🔍
SHA256 a0f19e0ae124728f1117fb4b25fe32f5548936aea815625ba51fc47ae2e6e44e 🔍
SHA3 4a983b48d9688d40bf9b423aac3a9aa0b0630de0ac8447247a9476593be8ea84 🔍
VirtualSize 0x88d51c
VirtualAddress 0x1000
SizeOfRawData 0x36d200
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.9854

(#2)

MD5 09648d7f617b6fa2ae9145c0326c2a05 🔍
SHA1 1fcfc731b18e1ce97da228f9a5c46e4e5ccb109c 🔍
SHA256 81fc37807894c68356ff990cee2e393cac07d1964ff48ac50c81dd96b187bd85 🔍
SHA3 88ce1404b5facf01a7252ab66261a6967f73fbeaef0a6a38d0360f97d9c148fc 🔍
VirtualSize 0x22ce8e
VirtualAddress 0x88f000
SizeOfRawData 0xe3a00
PointerToRawData 0x36d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.97773

(#3)

MD5 4d5e1402cc4c2485f19e952709c50569 🔍
SHA1 2010ce2fe94b3f40162b940d8d06d21db61bb1dd 🔍
SHA256 a94ff0a286075e703488146de9ecb268cabac2cc581eba7b796f31b53bc21d3b 🔍
SHA3 c32e6256ed829dd97e2c2db238dea56f62c23150b5f6e3fdb0b2c4c7fa63c5cf 🔍
VirtualSize 0x43c8c
VirtualAddress 0xabc000
SizeOfRawData 0x11200
PointerToRawData 0x451200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.96762

(#4)

MD5 85a4f56bb874be581f6be6c12e1ff8fb 🔍
SHA1 32252ea349f85d544ee556db6b70a2f8e02fc44c 🔍
SHA256 5c6dd0f9329b04ed70ae5b941e3202a3c195f69f27b942e906e0e2f8843c2add 🔍
SHA3 564bcfe8589b654b423965fa18bb30843442a7974f7e1c325dce9170df17c657 🔍
VirtualSize 0x520c8
VirtualAddress 0xb00000
SizeOfRawData 0x2ee00
PointerToRawData 0x462400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.6825

(#5)

MD5 331169da7c21dce44ece99734e139c20 🔍
SHA1 1b8cfaa5bd85f8a97f9672f1ec8729e88df3c520 🔍
SHA256 de6c1328f29c513cc5097484eb7ca0a190435637e8499f7807513f2495a3fff4 🔍
SHA3 d683eff3b51f3e10babdbf67d5c3e2740e073b2c7c271d56d7a851f850b18d60 🔍
VirtualSize 0x100
VirtualAddress 0xb53000
SizeOfRawData 0x200
PointerToRawData 0x491200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.10191

(#6)

MD5 40e388e23a19eab629224a4547867039 🔍
SHA1 5209307ecbdadd24a550c4dfad9e886ef1d93dd9 🔍
SHA256 229ef9309b1dcea17b23d8fba3912422d712f651f0c49ba267f8d227b419b9ce 🔍
SHA3 703d998002d6f5a540d27e791438cfc92ccd21923d07e59567ddd3edf4e7c292 🔍
VirtualSize 0x498
VirtualAddress 0xb54000
SizeOfRawData 0x400
PointerToRawData 0x491400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.10885

(#7)

MD5 0a932636fd70cee4fef05e1ee65cde04 🔍
SHA1 e806653b34df556273232cc64fa1bbe0a287229e 🔍
SHA256 fe81b80fd5f08e15af5538d5d72d5ff8fcee805dbdf1629010101c48f9c2661e 🔍
SHA3 2aeba76a6936e626e6e1483b0c35a7c4f5023b39afb59017e378d94ee51e9b19 🔍
VirtualSize 0x11c18
VirtualAddress 0xb55000
SizeOfRawData 0x7e00
PointerToRawData 0x491800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.79593

.idata

MD5 e5ca3f2561f46bfe3c6054664fd3770e 🔍
SHA1 327344d64e78cc65ea51326dddb1e556bd5b392d 🔍
SHA256 42a8d54a9e0b705adc0e884146de1bc20457d70f956be6ac80ebf5ebf9453ff2 🔍
SHA3 2e32e5351b96b5e19036ec3fd639b406c1ac44007eb63fe53f6281e284b1b5bf 🔍
VirtualSize 0x1000
VirtualAddress 0xb67000
SizeOfRawData 0x800
PointerToRawData 0x499600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.26619

.tls

MD5 5200b33b9eed2d8b3c1f892cae4616bb 🔍
SHA1 0de490097eeff2e09c18ac03c0a7ed40cdf8c6fb 🔍
SHA256 20145c3341d591ea791d3a030def3740323318bca5cf36ffcf420ef57929b670 🔍
SHA3 20afbc39b12413cad17e0da713813afaf5bed6c2ae3ab3b75bbd3bc9954fdcd9 🔍
VirtualSize 0x2000
VirtualAddress 0xb68000
SizeOfRawData 0x1c00
PointerToRawData 0x499e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0459931

.rsrc

MD5 5da0f08882271599d8eac318c1133e0d 🔍
SHA1 bf2912bf8765020a997cea28fc455df1fe8c9e98 🔍
SHA256 f01c1495d81aebbb42a8b17f9720e30ac0a503cc3cc518e662d059c4a8ee18bc 🔍
SHA3 3257a6741aee9e69e94ad7c1fdb08ca9271fa48261bfaae12a6e84194a2184bf 🔍
VirtualSize 0x1000
VirtualAddress 0xb6a000
SizeOfRawData 0x600
PointerToRawData 0x49ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.45968

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x3b6000
VirtualAddress 0xb6b000
SizeOfRawData 0
PointerToRawData 0x49c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 7b53f667cca0e135b7d78ffd6bee6c73 🔍
SHA1 c2cc0deaced841f3e8a2acefa03bdbe57026d921 🔍
SHA256 2ebb2e050c851b4aa8cf17a87aa47ff3609574ebb31dab1f2f8888f1735a99b6 🔍
SHA3 77abf61ecab98ab14f8a9cafc522748d835a76a619d41ba90ec09746b254b806 🔍
VirtualSize 0x1f6600
VirtualAddress 0xf21000
SizeOfRawData 0x1f6600
PointerToRawData 0x49c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.93511

.reloc

MD5 cdb75b1b5b262a49545b00d661c2d27d 🔍
SHA1 f033ebc5c28ad90419a0151b3e4c0792997ad099 🔍
SHA256 4d05bc4b11e181e01cdeedf29215aee4fc9af36d40a6d254bce93aacdc307c67 🔍
SHA3 e772a8eb322ee12f4d2f29079823aec6c318dc3542119584ebbf1b3a5cf6842b 🔍
VirtualSize 0x1000
VirtualAddress 0x1118000
SizeOfRawData 0x10
PointerToRawData 0x692600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 2.6494

Imports

kernel32.dll GetModuleHandleA
CRYPT32.dll CertGetCertificateContextProperty
ADVAPI32.dll RegSetValueExA
ole32.dll CoUninitialize
SHELL32.dll CommandLineToArgvW
SHLWAPI.dll PathFileExistsA
dbghelp.dll SymSetOptions
urlmon.dll URLDownloadToFileA
USER32.dll IsWindowUnicode
GDI32.dll CreateFontW
COMDLG32.dll GetOpenFileNameW
WS2_32.dll recv
bcrypt.dll BCryptDestroyHash
api-ms-win-core-path-l1-1-0.dll PathCchRemoveFileSpec
ntdll.dll NtUnloadDriver
RPCRT4.dll RpcStringFreeA
dwmapi.dll DwmSetWindowAttribute
WINMM.dll timeEndPeriod
d3d11.dll D3D11CreateDevice
dcomp.dll DCompositionCreateDevice
api-ms-win-core-synch-l1-2-0.dll WaitOnAddress
IMM32.dll ImmReleaseContext
D3DCOMPILER_47.dll D3DCompile

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x278
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2654
MD5 af59952317ed53b7b4877aaecfa11142 🔍
SHA1 e8b0f7008b7e93b386b988cddf796320140150e3 🔍
SHA256 01cf234599d004f88fddce0fdc4bff54a5c322f93ecb1201a8968d61e67fcc8a 🔍
SHA3 da4e12a364f2fc4f2c10f751bf9cbdf1e21f76ac7a7d2cd010e4f14b8e2f41db 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.3.0.0
ProductVersion 1.3.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription Host Process
FileVersion (#2) 1.3.0.0
InternalName ApplicationHost.exe
OriginalFilename ApplicationHost.exe
ProductName Host Process
ProductVersion (#2) 1.3.0.0
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x140b68000
EndAddressOfRawData 0x140b69b58
AddressOfIndex 0x140b69b58
AddressOfCallbacks 0x140b69b60
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

XOR Key 0xa1f2a4fe
Unmarked objects 0
C++ objects (35222) 197
C objects (35721) 18
ASM objects (35721) 10
C++ objects (35721) 117
ASM objects (35222) 34
C objects (35222) 43
Imports (2207) 2
Imports (VS2008 SP1 build 30729) 4
C objects (CVTCIL) (35222) 1
Imports (35222) 43
Total imports 489
C objects (36248) 934
Unmarked objects (#2) 48
C++ objects (36248) 16
C++ objects (LTCG) (36248) 109
ASM objects (36248) 1
Resource objects (36248) 1
151 1
Linker (36248) 1

Errors

[*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.