1d63b195bd38cad51d7eea718c9d228d
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-Jul-30 08:52:21 |
Plugin Output
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 31/72 (Scanned on 2025-01-21 08:36:57) |
APEX:
Malicious
Antiy-AVL: Trojan/Win32.SchoolGirl Bkav: W64.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.17374152299d228d CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_70% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) FireEye: Generic.mg.1d63b195bd38cad5 Fortinet: W64/CoinMiner.526230!tr GData: Win64.Trojan.Agent.N91JD2 Google: Detected Gridinsoft: Trojan.Win64.Agent.bot!s1 Ikarus: Trojan.Win64.Agent K7AntiVirus: Riskware ( 00584baa1 ) K7GW: Riskware ( 00584baa1 ) Lionic: Trojan.Win32.Gen.tqzj Malwarebytes: Generic.Malware.AI.DDS McAfee: Artemis!1D63B195BD38 McAfeeD: ti!DAF4D71696A7 Microsoft: Program:Win32/Wacapew.C!ml Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.RealProtect.dm VBA32: TrojanPSW.Win64.Banker Varist: W64/Bulz.BB.gen!Eldorado VirIT: Trojan.Win32.Banker1.BMNA Zillya: Trojan.Generic.Win32.838255 tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2019-Jul-30 08:52:21 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x16200 |
| SizeOfInitializedData | 0x22a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3e000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
.text
.rdata
.pdata
.data
.rsrc
Imports
| msvcrt.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathAddBackslashW
PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW DefWindowProcW GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW EnableWindow DestroyWindow UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled GetSystemMetrics CreateWindowExW SetWindowLongPtrW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|