1b6e78da9cdfe1d646bb64ba1cb3fd4bfac78e25bd8d3a9c8bce161efa093c79

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-May-10 00:25:25
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to debugging or reversing tools:
  • ollydbg.exe
 Looks for VMWare presence:
  • vmware
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowA
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Manipulates other processes:
  • Process32Next
  • Process32First
Malicious VirusTotal score: 8/65 (Scanned on 2026-08-31 17:03:40) APEX: Malicious
Bkav: W32.Malware.E18509CD
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: DLOADER.Trojan
McAfeeD: ti!1B6E78DA9CDF
Skyhigh: BehavesLike.Win32.NetLoader.nh

Hashes

MD5 317aa5704a329ffb8d6563bca37c7276 🔍
SHA1 b093dca259b1603f76bbf833da6ccd8a11de5f2b 🔍
SHA256 1b6e78da9cdfe1d646bb64ba1cb3fd4bfac78e25bd8d3a9c8bce161efa093c79 🔍
SHA3 a8a2c7be08bf7df5740adb278b63a4f1a33d6de3effa3163803d4b524f711158 🔍
SSDeep 1536:EytiZzg9DJ1Ge6Y1PELP0ZoJmYI58hmb:EJgJtSLP0Zos58h4 🔍
Imports Hash a4baf136808cca09e54c4a14a20f9844 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2026-May-10 00:25:25
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 9.0
SizeOfCode 0xf800
SizeOfInitializedData 0x8800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000746B (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x11000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.0
ImageVersion 0.0
SubsystemVersion 5.0
Win32VersionValue 0
SizeOfImage 0x36000
SizeOfHeaders 0x400
Checksum 0x21fd4
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 9800a7d3c974fd7d12d4a6f545ccaabd 🔍
SHA1 49654e2718c534a9d8a631a79e0ef463c8e95bd5 🔍
SHA256 927b6d4d5f3836b6c74716acc34ac6c213bcbf2193f489c52a594b31d3ceb347 🔍
SHA3 ca4e7058b65dbaccfe43f697dcd41279c39efd0bbde7623846237b45f9ed20d2 🔍
VirtualSize 0xf706
VirtualAddress 0x1000
SizeOfRawData 0xf800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.60879

.rdata

MD5 7053cbacd282aeae7f15d976d7eb381e 🔍
SHA1 f70a3048134a951e1d94010e211aed4fbc75bdb0 🔍
SHA256 da0cb313f737e2530ac0667afaa5bdd67a9e4ab588cfc35b881c64f0ad03ed9c 🔍
SHA3 bffbe3eafefbc9630d0f9c1c2c2e22ca6dee008a6e2255d6b41c730efc1caa25 🔍
VirtualSize 0x5316
VirtualAddress 0x11000
SizeOfRawData 0x5400
PointerToRawData 0xfc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.26826

.data

MD5 72c648017895c82fb7aacdebd369b856 🔍
SHA1 223f3bbdd0cc07777dccefab5bee6e7d9436fbf1 🔍
SHA256 5a98d847088cbc5eacdcc415d141f31dd8f1753af358da5a163d7de4a0e65541 🔍
SHA3 65d8d28eb6fc511d82a2b63cbaca57cd170db3d07c4ec0630a789526aaf0052f 🔍
VirtualSize 0x1bf20
VirtualAddress 0x17000
SizeOfRawData 0x1200
PointerToRawData 0x15000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.93448

.rsrc

MD5 5f9a3b23c849da6c1fe42969d8ef6099 🔍
SHA1 598aa0121405620ea077ad0f7cc9809b01a362a5 🔍
SHA256 392261205f13d8f59fe5cd41ba255dca1932c9ab0a3338d5a03321de16d139d8 🔍
SHA3 d4b8e4fb1a5a2d10c4bc90bd01875f9340ca96f4f1981ea22e23aa8a8e692388 🔍
VirtualSize 0x1b4
VirtualAddress 0x33000
SizeOfRawData 0x200
PointerToRawData 0x16200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.11429

.reloc

MD5 e56b6eae5b509f0252f1f5bfa12e1c59 🔍
SHA1 3cd3896cadf170ce54589f2061d30b4099c38044 🔍
SHA256 747ae5090b846789038fba19435220a74463878bf7592c16762344128ed41701 🔍
SHA3 33367188de38f19520ab31bc19806162e270e22d692d05184b0b5e83757d2ad2 🔍
VirtualSize 0x1fae
VirtualAddress 0x34000
SizeOfRawData 0x2000
PointerToRawData 0x16400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.67665

Imports

WS2_32.dll htons
KERNEL32.dll LeaveCriticalSection
VirtualFree
VirtualAlloc
VirtualQuery
HeapReAlloc
HeapAlloc
SetThreadContext
GetThreadContext
CloseHandle
HeapFree
GetLastError
Thread32Next
GetCurrentThreadId
GetCurrentProcessId
Thread32First
CreateToolhelp32Snapshot
SuspendThread
OpenThread
ResumeThread
FlushInstructionCache
GetCurrentProcess
VirtualProtect
Sleep
InterlockedCompareExchange
InterlockedExchange
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
GetFileAttributesA
GetModuleHandleA
SetLastError
Process32Next
Process32First
WriteFile
LoadLibraryA
QueueUserAPC
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
CreateDirectoryA
ExitProcess
RtlUnwind
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
EnterCriticalSection
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
USER32.dll SendMessageA
IsWindow
FindWindowA
SHELL32.dll SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32.dll CoTaskMemFree

Delayed Imports

NullSub

Ordinal 1
Address 0x2c00

2

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x15a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.79597
MD5 24d3b502e1846356b0263f945ddd5529 🔍
SHA1 bac45b86a9c48fc3756a46809c101570d349737d 🔍
SHA256 49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e 🔍
SHA3 1244ed60820da52dc4b53880ec48e3b587dbdbd9545f01fa2b1c0fcfea1d5e9e 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x10017218
SEHandlerTable 0x100144d0
SEHandlerCount 49

RICH Header

XOR Key 0x5d62b06c
Unmarked objects 0
150 (20413) 1
ASM objects (VS2008 build 21022) 18
Total imports 109
Imports (VS2012 build 50727 / VS2005 build 50727) 11
C objects (VS2008 build 21022) 105
C++ objects (VS2008 build 21022) 40
Exports (VS2008 build 21022) 1
Resource objects (VS2008 build 21022) 1

Errors

Leave a comment

No comments yet.