1a9b481d7539a589e13b526f9e6cdc05

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Dec-05 22:51:56
Detected languages English - United States

Plugin Output

Suspicious PEiD Signature: UPolyX V0.1 -> Delikon
Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryExA
  • GetProcAddress
Can access the registry:
  • RegQueryValueExA
  • RegSetValueExA
  • RegEnumKeyA
  • RegEnumValueA
  • RegOpenKeyExA
  • RegDeleteKeyA
  • RegDeleteValueA
  • RegCloseKey
  • RegCreateKeyExA
Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
Can create temporary files:
  • CreateFileA
  • GetTempPathA
Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 7038815 bytes of data starting at offset 0x17200.
The overlay data has an entropy of 7.99987 and is possibly compressed or encrypted.
Overlay data amounts for 98.6722% of the executable.
Malicious VirusTotal score: 52/64 (Scanned on 2017-07-07 00:21:42) CAT-QuickHeal: Trojan.NSIS.Miner.SD
Cylance: Unsafe
Zillya: Trojan.CoinMiner.Win32.4514
CrowdStrike: malicious_confidence_100% (W)
K7GW: Trojan ( 004d394f1 )
K7AntiVirus: Trojan ( 004d394f1 )
TrendMicro: WORM_CO.331300D2
Baidu: Multi.Threats.InArchive
F-Prot: W32/Adware.ALRW
Symantec: Trojan.Coinbitminer
TotalDefense: Win32/Tnega.XAUQ!suspicious
TrendMicro-HouseCall: WORM_CO.331300D2
Avast: Win32:Malware-gen
ClamAV: Win.Trojan.Virtob-1633
Kaspersky: Trojan.Win32.CoinMiner.bn
BitDefender: Application.BitCoinMiner.IG
NANO-Antivirus: Trojan.Win32.BitCoinMiner.ddjqfi
Paloalto: generic.ml
ViRobot: Trojan.Win32.Agent.4227072
Tencent: Win32.Trojan.Coinminer.Eaed
Endgame: malicious (high confidence)
Emsisoft: Application.BitCoinMiner.IG (B)
F-Secure: Trojan.AgentWDCR.ERF
DrWeb: Trojan.BtcMine.1033
VIPRE: Trojan.Win32.Generic.pak!cobra
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.TrojanCoinMiner.vc
Ikarus: Trojan.NSIS.Coinminer
Cyren: W32/Adware.DEZV-3749
Jiangmin: Worm.Remoh.f
Avira: TR/Dropper.Gen
Fortinet: Riskware/BitCoinMiner
Antiy-AVL: Trojan/Win32.CoinMiner.bn
Arcabit: Application.Bitcoinminer.HH
AegisLab: AdWare.W32.OneInstaller.lZ9E
ZoneAlarm: Trojan.Win32.CoinMiner.bn
Microsoft: Trojan:Win32/CoinMiner.AQ
AVG: Win32:Malware-gen
Sophos: Mal/Miner-C
AhnLab-V3: Trojan/Win32.CoinMiner.R174018
McAfee: Artemis!1A9B481D7539
AVware: Trojan.Win32.Generic.pak!cobra
MAX: malware (ai score=89)
Malwarebytes: Trojan.Agent.VBS
ESET-NOD32: NSIS/CoinMiner.N
Rising: Malware.Generic.2!tfe (cloud:8f1Eqku6bM)
Yandex: Riskware.Agent!
SentinelOne: static engine - malicious
GData: Application.BitCoinMiner.IG
VBA32: Trojan.Miner
Panda: Trj/CI.A
Qihoo-360: Win32/Application.f14

Hashes

MD5 1a9b481d7539a589e13b526f9e6cdc05
SHA1 d5a4b7e808c6a79885cc21875997f2037fefdeae
SHA256 dc79521c411ad6caab5db3014e9f4d99baf90735e239dfa7f268c861a92c77e8
SHA3 5cb7612b7f8a79095945903aca85c4a069b2508f29d91866e891d982475c9591
SSDeep 98304:ttg+5xfeKowXS0gMoiLMT374q30tV2Cjcdg7lxipzX7ccET6SV5XiIFsdyaCq7QU:HmiXSkoYMTkSUAgRxiFAcEOSX/fqM4Ek
Imports Hash d9e6a5e6bae798e211941a3a501049ea

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2009-Dec-05 22:51:56
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x5c00
SizeOfInitializedData 0x3bec00
SizeOfUninitializedData 0x2000
AddressOfEntryPoint 0x0000323F (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x7000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x416000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d74313478edfeadd4ae9198d22cdeda9
SHA1 53a0e95153f7a8edab3fffea70874e47f007d45c
SHA256 0400e73df150cd859bf303461b04ce5b344408f239588aa5ece8e5b4e0248595
SHA3 4e5077de0e40c4e96585ac951a3e72db307a45560330bf1806b32968ca1b5053
VirtualSize 0x5ba6
VirtualAddress 0x1000
SizeOfRawData 0x5c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50228

.rdata

MD5 f179218a059068529bdb4637ef5fa28e
SHA1 6035d27db526131eb0f29aee60cfcdbb5072ed7d
SHA256 f80bf00310bd25e46e26c4b2042fa8215c3e5ce759947fe081d25b454dfc0fbe
SHA3 1a90c2506162a31f6264cafaafb479568941dc807c95a93babd7ebe526f2181f
VirtualSize 0x1190
VirtualAddress 0x7000
SizeOfRawData 0x1200
PointerToRawData 0x6000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.18163

.data

MD5 1eec454322408e9a5283db3ef5e21fee
SHA1 59c058b864d3e89b64ce0f976a06858f4313ef0c
SHA256 e11c4d4a2da3a7658e0215b2945ca01809e08bf36667bd3ffce88783c92079cb
SHA3 2b37e5e85d31156e93ee1d16c541e1cbb2996cf6f9bea0ad2175a59afb22b129
VirtualSize 0x3bc7d8
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.70993

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x40000
VirtualAddress 0x3c6000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 c88cb879277d508d637544c52761e9c9
SHA1 b69fc65fef7f0fc1e063e4d17ad33e05440f9cea
SHA256 46320955cb5863b153ce1f689b7f41cf494706ce0b7315f7247d0cca122530a2
SHA3 fd354f6c8edeef53f5c04f1894b3c2acf9c585f94f0d38ce8b27d2f0e3847604
VirtualSize 0xfbd8
VirtualAddress 0x406000
SizeOfRawData 0xfc00
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.02457

Imports

KERNEL32.dll CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
USER32.dll EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
GDI32.dll SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
SHELL32.dll SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
ADVAPI32.dll RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
COMCTL32.dll ImageList_AddMasked
ImageList_Destroy
#17
ImageList_Create
ole32.dll CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
VERSION.dll GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x90c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97656
Detected Filetype PNG graphic file
MD5 95134efcdfce7ac6ab58d6ea58bfa293
SHA1 33f383cc549e92e12cdc97bfadaf6421aab0e09e
SHA256 38c892491bdd049041bd970b9159ce116b2f76fc32541f2a5cbd02e9146c779b
SHA3 a892043d2b4f5f1b21c1151a50f97226a965a488cb78400032406a1f13347d9c

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.32545
MD5 ca902e21ab39ae323a3e4b260bcd55f3
SHA1 47994111300d2084e92f9b7445524dd989afff2a
SHA256 7c13671e13189c63f8e6d45bc844b929aa6ea1b31bcae4d51835d6d5aa2163a1
SHA3 e9f566a9e511f8f1f6028a7ae29288156c3b673085095b5d982404ce13131691

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.80027
MD5 4dd31120ed56886a35a75d408ba895b0
SHA1 2fe28a74d936248cce795360ffd57a668db2c487
SHA256 40e6f20113ebd1e733aca4cc0dce0253bf8eaa818bd509a0425657aa1ddc2d0b
SHA3 2a6e156726dc0172e419701240ff81269baf4e48ab9d06d40fe185954561e541

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.12941
MD5 209d23b2213cc82d5906c38b0439efb3
SHA1 71b7cdb919b91a67f0358a5d9a9ca101154b9a56
SHA256 bca856b933705af922f9c978974b66f9ca6a97ac2b626380350c0e4549d86859
SHA3 e19d897b3ca8a60515796701db11cd2bfd14c5b7039ff09366dcf3b0a0fe2858

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.76716
MD5 bd7c53d9b22bf29b2e1634c58793c137
SHA1 ed7124be070836de8155c536d58c827f08409870
SHA256 da6198d10b702ed57043d15d29e2d499dfb8a2b72c7907a1cb47f8813f9f0ffe
SHA3 db80a427fc8c1c9eb5947331650e7bbc8c157a968f68d0acbb497991dc83cc49

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19606
MD5 1b543c87704fb41949e23527412c86b6
SHA1 dcda3e6d7d2b50c1bb9a760283dcd2ee059a905a
SHA256 1221477d6bc6c1e5ce5cdb69561a2146411d137e694c2c403bfb0eb11b604fa0
SHA3 eee67f9b9f22340d40ffd80d015c3ea066ec22b89b7818fb2f27bfddf185394d

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.29006
MD5 e956cac5ec0baeff55395a81e33ebaf4
SHA1 3f2a061c84bfb8d29068092e0c6601ee6be12461
SHA256 75e7cd38ef205503efc988d254c113504b4c0b2a504b66b2bdd9de02c41fb923
SHA3 859a5025a1ec17563d80c19daf56316a90205f2375616c99753ed4542c1dc748

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.50369
MD5 256d859f237a3307b615d1e2c268b65f
SHA1 aac9b0bdd5b92d00b746beb783ae9369a03b51d7
SHA256 39aa3542ff44ce6b43423d10bf3829d521696dea53f1dcf9a86d6320861b6c85
SHA3 9227e63072fecf01a81159fb5863fe3c0a26d699a971314a2a2b4d3e733d3d0d

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32968
MD5 0050f44107b6c5c33c41d43b0d5da3b3
SHA1 4435c1b1dd23a171a5ff76d8ceddb9afeece8fa3
SHA256 cbb892f23a9268e99203544cefc56c2d3cada9b5221ebc03465c077d4a9d781a
SHA3 229e3a84223ceea8840557d29815a4b07b23e12369924667fdb4cea6558adb1b

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.42711
MD5 0b807bb12a2525eb72a50c5a9d02195e
SHA1 265ecbc33eadf3a503df42fe760eb0b13e38b9ff
SHA256 210efae6f7fded96961d4b84d42fc3eb399f04cc8238dd9318656321ca491e68
SHA3 1ef29804a5082ff3b1c82d9e0ae71fef18f31465ef110d65fac2d99cc609de8b

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x100
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66174
MD5 3409f314895161597f3c395cc5f65525
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b
SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96
SHA3 b3b19241cc6454389e45833e50b742ae1927a5f161017350a99f2cbc66914f26

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x11c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88094
MD5 2d12c45dc2c029044aaff357141cb900
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b
SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729
SHA3 349b5d605c9c3efe5e0c4e2faa12dd21022fc5f9b053f2cbf4e2a6b8bc656442

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x60
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.48825
MD5 6be4e1387d369cf86e68eacbdd0e81dd
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17
SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0
SHA3 45e552e173141e06d113209b6cc915042ad0b4d5531464b8dbe5637029f489cb

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x92
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.90294
Detected Filetype Icon file
MD5 fca88edc3079914574040766bef9144a
SHA1 572233a9a02f2fa273d6f4ce4b970b32514490b6
SHA256 4a41b687c12d86c9f495b0bf44ab307c89ef8a79cace5a11ef54eb4109d87bd9
SHA3 c93ebdd86edd3cd92a35234fecfade1f5275cf708756d00e9571528fa5578031

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x2cc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.20956
MD5 37372627292eec159b196ddf6318d57d
SHA1 ab320a1fdbc1c227918ff0a084fcec2761feda8e
SHA256 c037f720a7dcbaad22cba3ae374ecb86f9126684a2ed985862a1c3ebeafb12d4
SHA3 780b6d08aa1f6f24f352191b1671e2d4e1b8e80106c3c00d59556ae82278607e

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xab92c978
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 155
Imports (VS2003 (.NET) build 4035) 17
48 (9044) 12
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!