Manalyze report for 1c5f3e49238f078baf3597a7c97c38f25f03a6988b12d1d62ac95076f93c7272

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2025-Oct-30 22:50:25
Detected languages	English - United States

Plugin Output

Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect`
Malicious	VirusTotal score: 35/71 (Scanned on 2026-07-31 21:02:38)	`ALYac: Gen:Variant.Application.Ulise.125900` `AVG: Win64:MalwareX-gen [Misc]` `Antiy-AVL: HackTool/Win32.Crack` `Arcabit: Trojan.Application.Ulise.D1EBCC` `Avast: Win64:MalwareX-gen [Misc]` `Avira: TR/W64.Agent` `BitDefender: Gen:Variant.Application.Ulise.125900` `Bkav: W32.Malware.DE6C5BD1` `CTX: dll.trojan.crack` `CrowdStrike: win/malicious_confidence_70% (D)` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `Emsisoft: Gen:Variant.Application.Ulise.125900 (B)` `F-Secure: Trojan.TR/W64.Agent` `Fortinet: Riskware/Application` `GData: Gen:Variant.Application.Ulise.125900` `Google: Detected` `Ikarus: PUA.Generic` `Lionic: Trojan.Win32.Crack.4!c` `Malwarebytes: Malware.AI.488355287` `MaxSecure: Trojan.Malware.273267368.susgen` `McAfeeD: ti!1C5F3E49238F` `MicroWorld-eScan: Gen:Variant.Application.Ulise.125900` `Microsoft: HackTool:Win32/Crack!MTB` `Paloalto: generic.ml` `Skyhigh: Artemis` `Sophos: Mal/Generic-S` `Symantec: Trojan.Gen.MBT` `Trapmine: suspicious.low.ml.score` `TrellixENS: Artemis!F6254D2D2D25` `TrendMicro: Trojan.Win32.ZYX.USBLER26` `TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLER26` `VIPRE: Gen:Variant.Application.Ulise.125900` `Varist: W64/ABApplication.AQKL-2897` `alibabacloud: Riskware:Win/Crack.Gen`

Hashes

MD5	`f6254d2d2d25a12496c0b3009166b82f`
SHA1	`88959497172f52abcfb20851487a7b5b2f7c0ac8`
SHA256	`1c5f3e49238f078baf3597a7c97c38f25f03a6988b12d1d62ac95076f93c7272`
SHA3	`14b7bf493b21fe4b64ee062bc542522dd77332ffa0e562f297eedcad2fbc6cfc`
SSDeep	`393216:PopgBp1XU/vsS3hAcixegITLymtw7i3wTye5+1cg:P2K1WL/LZa7i3EySRg`
Imports Hash	`66d5876d65de145ff7d75ef28b1645a4`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2025-Oct-30 22:50:25
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x130400`
SizeOfInitializedData	`0x1101200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000000000012FED4 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x180000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x1236000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`e4bf893057ad9dd3ca9ca2b5c85ee334`
SHA1	`2b350c2defe3da3f15924aec055908ca8b65bf24`
SHA256	`4216e45cd7a0ff19f48e50e4803edf2ebac995ada3091fdb5df8c2266e9c2ddb`
SHA3	`cde348e095de90911bc379914d81156b0ef65e7a91ca0aa64d0019075124c755`
VirtualSize	`0x130397`
VirtualAddress	`0x1000`
SizeOfRawData	`0x130400`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.84132`

.rdata

MD5	`96ba85ddbea65fbe18608957ebbf18fc`
SHA1	`e13116b84b66f169ece18ebb72c2716d5119ff40`
SHA256	`cf739ebfb79a239de7bcfb3cedcdb15354a0cb2d948181361e21cdf68672965d`
SHA3	`35e80c99662fb682d3716436696465a69ac1ba2cdce4a783ed3c5202a94de49a`
VirtualSize	`0x22c9c`
VirtualAddress	`0x132000`
SizeOfRawData	`0x22e00`
PointerToRawData	`0x130800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.81696`

.data

MD5	`c750782878aab22db69fc3e68c311fc2`
SHA1	`1e17c4dd9aa425e7132de37c4b7f664dc82f3dfe`
SHA256	`5e1526dd628a6173f17a9efc36b044ed3b1c13cb6e15188cc46a549d621c328d`
SHA3	`941f0025376a254bd13979ea3f2a7b4a2e17aef00670790b26ab1f527ed41a03`
VirtualSize	`0x10dd4a8`
VirtualAddress	`0x155000`
SizeOfRawData	`0x10dc600`
PointerToRawData	`0x153600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.74056`

.pdata

MD5	`6c7bc5f1349ff4e71b0cc1f76b56b243`
SHA1	`458eccd66d2019a4b0436d7cab30c1a6cbb0bf2e`
SHA256	`ddcafdd1361345ca6a041fae198b6e708a9370409268e61a584dbfdcce788338`
SHA3	`03d8ff2b7b905e7d373582dcd9fe3772b28221e682085a4db5fe1ce7114214bd`
VirtualSize	`0x96c`
VirtualAddress	`0x1233000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x122fc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.90555`

.rsrc

MD5	`a0da04825adc7f7adbf6f035125ab30e`
SHA1	`7606ffc50012a3d783bfab0af34a92ff3f367148`
SHA256	`2c4ed81a20289e33d6f8320dce844854fd4cb05bd341651f7aba729adfbf91b1`
SHA3	`e69b80635909091a6d5376ca792d6ceb1477fde256716809c663d306cfc20d0d`
VirtualSize	`0x1e0`
VirtualAddress	`0x1234000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1230600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.73383`

.reloc

MD5	`add8fc08fe80f3f9680c236a61e0cc0e`
SHA1	`17a24fe0fc75fb387749e3ffb2535331eb88e2d2`
SHA256	`696b889f4b7eab0f29a0a36a20434bde9a739b780b882734a0a200f40454b999`
SHA3	`d20db264d946c61771623ee46f1990fe3329dc0fef6debf4334db14c268c1284`
VirtualSize	`0xb8`
VirtualAddress	`0x1235000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1230800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`2.3553`

Imports

KERNEL32.dll	`VirtualFree` `VirtualAlloc` `GetSystemInfo` `VirtualQuery` `HeapCreate` `VirtualProtect` `HeapFree` `GetCurrentProcess` `Thread32Next` `Thread32First` `GetCurrentThreadId` `SuspendThread` `ResumeThread` `CreateToolhelp32Snapshot` `Sleep` `GetLastError` `HeapReAlloc` `CloseHandle` `HeapAlloc` `GetThreadContext` `GetProcAddress` `GetCurrentProcessId` `FlushInstructionCache` `SetThreadContext` `OpenThread` `LoadLibraryA` `Beep` `AddVectoredExceptionHandler` `CreateThread` `AcquireSRWLockExclusive` `WakeAllConditionVariable` `SleepConditionVariableSRW` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `UnhandledExceptionFilter` `SetUnhandledExceptionFilter` `TerminateProcess` `IsProcessorFeaturePresent` `IsDebuggerPresent` `QueryPerformanceCounter` `GetSystemTimeAsFileTime` `InitializeSListHead` `LocalFree` `FormatMessageA` `GetLocaleInfoEx` `CreateDirectoryW` `CreateFileW` `FindClose` `FindFirstFileW` `GetFileAttributesExW` `AreFileApisANSI` `GetFileInformationByHandleEx` `MultiByteToWideChar` `WideCharToMultiByte` `ReleaseSRWLockExclusive`
USER32.dll	`MessageBoxA`
MSVCP140.dll	`?_Xlength_error@std@@YAXPEBD@Z` `?_Syserror_map@std@@YAPEBDH@Z` `?_Winerror_map@std@@YAHH@Z` `?_Xout_of_range@std@@YAXPEBD@Z`
VCRUNTIME140_1.dll	`__CxxFrameHandler4`
VCRUNTIME140.dll	`memset` `_CxxThrowException` `__std_type_info_destroy_list` `__std_exception_destroy` `__std_exception_copy` `memmove` `__C_specific_handler` `memcpy`
api-ms-win-crt-heap-l1-1-0.dll	`malloc` `free` `_callnewh`
api-ms-win-crt-runtime-l1-1-0.dll	`_configure_narrow_argv` `_seh_filter_dll` `_initialize_onexit_table` `_register_onexit_function` `_initterm_e` `_execute_onexit_table` `_crt_atexit` `_initterm` `_cexit` `abort` `_initialize_narrow_environment` `_invoke_watson`
api-ms-win-crt-math-l1-1-0.dll	`ceilf`
api-ms-win-crt-locale-l1-1-0.dll	`___lc_codepage_func`

Delayed Imports

2

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2025-Oct-30 22:50:25
Version	`0.0`
SizeofData	`852`
AddressOfRawData	`0x152e90`
PointerToRawData	`0x151690`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2025-Oct-30 22:50:25
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x180153208`
EndAddressOfRawData	`0x180153210`
AddressOfIndex	`0x181231a20`
AddressOfCallbacks	`0x180132370`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x180155040`

RICH Header

XOR Key	`0x7881b779`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`16`
Imports (35207)	`6`
ASM objects (35207)	`4`
C objects (35207)	`8`
C++ objects (35207)	`27`
Imports (33140)	`5`
Total imports	`201`
C++ objects (LTCG) (35217)	`15`
Resource objects (35217)	`1`
Linker (35217)	`1`

Errors

Leave a comment

No comments yet.