| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jun-15 20:42:04 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains another PE executable:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: .fptable
Unusual section name found: .rcd7cb Section .rcd7cb is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 54/71 (Scanned on 2026-06-28 15:09:52) |
ALYac:
Trojan.GenericKD.80606067
APEX: Malicious AVG: Win64:MalwareX-gen [Misc] AhnLab-V3: Trojan/Win.Lazy.R720011 Alibaba: TrojanDownloader:Win64/MalwareX.7439ad16 Antiy-AVL: Trojan/Win32.Phonzy Arcabit: Trojan.Generic.D4CDF373 Avast: Win64:MalwareX-gen [Misc] Avira: TR/Patched.Gen BitDefender: Trojan.GenericKD.80606067 Bkav: W32.Malware.EE6CB6E3 CAT-QuickHeal: Trojan.Win64 CTX: exe.trojan.generic ClamAV: Win.Malware.Malwarex-10058788-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.DownLoader49.35384 ESET-NOD32: Win64/TrojanDownloader.Agent.CQY trojan Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.80606067 (B) F-Secure: Trojan.TR/Patched.Gen Fortinet: W64/Agent.BPJ!tr GData: Win64.Virus.Fidxinf.A Google: Detected Gridinsoft: Trojan.Heur!.03012023 Ikarus: Trojan.Patched Jiangmin: Trojan.Generic.hssry K7AntiVirus: Trojan-Downloader ( 006dab321 ) K7GW: Trojan-Downloader ( 006d9c241 ) Kaspersky: Trojan.Win64.Patched.t Kingsoft: malware.kb.a.972 Malwarebytes: Malware.Heuristic.2003 MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!667C83E1DE7C MicroWorld-eScan: Trojan.GenericKD.80606067 Microsoft: Trojan:Win32/Sabsik.FL.A!ml Paloalto: generic.ml Rising: Trojan.Midie!8.12D29 (TFE:1:WvQqQDUantJ) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Trojan-DL.Win64.Agent.cbd Trapmine: malicious.high.ml.score TrellixENS: Artemis!667C83E1DE7C TrendMicro: Trojan.Win32.ZYX.USBLFM26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFM26 VBA32: TrojanDownloader.Win64.Agent VIPRE: Trojan.GenericKD.80606067 Varist: W64/Agent.LXR.gen!Eldorado Zoner: Probably Heur.ExeHeaderL alibabacloud: Trojan[downloader]:Win/Zusy.Gen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Jun-15 20:42:04 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x17600 |
| SizeOfInitializedData | 0x95600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000B2000 (Section: .rcd7cb) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xce000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| WINHTTP.dll |
WinHttpSetTimeouts
WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect |
|---|---|
| ADVAPI32.dll |
RegOpenKeyExW
RegQueryValueExW RegCloseKey |
| USER32.dll |
MessageBoxA
wsprintfW |
| SHELL32.dll |
CommandLineToArgvW
|
| KERNEL32.dll |
HeapReAlloc
HeapSize FlushFileBuffers LCMapStringW GetConsoleOutputCP SetFilePointerEx FlsAlloc CompareStringW LoadLibraryExW VirtualProtect GetVolumeInformationW HeapFree SetConsoleTextAttribute GetCommandLineW GetCurrentProcess GetStdHandle WriteConsoleA WriteFile WaitForSingleObject CreateFileW SetFileAttributesW MultiByteToWideChar Sleep GetCurrentThread ReadConsoleW CloseHandle FreeConsole HeapAlloc FlushConsoleInputBuffer WriteConsoleW GetProcAddress LocalFree MoveFileExW ExitProcess GetProcessHeap CreateProcessW GetModuleHandleW WideCharToMultiByte SetConsoleOutputCP AllocConsole SetConsoleTitleW IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx GetLastError SetLastError FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetConsoleCP GetModuleFileNameW TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetConsoleMode SetConsoleMode ReadConsoleInputW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetExitCodeProcess GetFileAttributesExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-15 20:42:04 |
| Version | 0.0 |
| SizeofData | 840 |
| AddressOfRawData | 0xa8838 |
| PointerToRawData | 0xa7238 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400ab000 |
| XOR Key | 0x9549d2e5 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 156 |
| C objects (33145) | 12 |
| ASM objects (33145) | 7 |
| ASM objects (35721) | 9 |
| C objects (35721) | 17 |
| C++ objects (35721) | 39 |
| Imports (33145) | 11 |
| Total imports | 123 |
| C++ objects (LTCG) (36247) | 1 |
| Resource objects (36247) | 1 |
| Linker (36247) | 1 |
No comments yet.