1fb1bbfafb94fc1b9e7a90cd6c4f2fad984348a2012f52679a0196ba8ed0a630

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2102-Jul-18 20:00:26
Comments
CompanyName
FileDescription Apollo
FileVersion 1.0.0.0
InternalName Apollo.exe
LegalCopyright Copyright © 2021
LegalTrademarks
OriginalFilename Apollo.exe
ProductName Apollo
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Info Interesting strings found in the binary: Contains domain names:
  • http://192.168.45.232
Malicious VirusTotal score: 44/70 (Scanned on 2026-06-25 14:18:12) ALYac: Generic.Trojan.Apollo.Marte.A.3C0B0794
APEX: Malicious
AVG: Win32:MalwareX-gen [Bd]
AhnLab-V3: Trojan/Win.Mythagent.C5656327
Antiy-AVL: Trojan[Backdoor]/MSIL.Apollo
Arcabit: Generic.Trojan.Apollo.Marte.A.3C0B0794
Avast: Win32:MalwareX-gen [Bd]
Avira: BDS/W32.MalwareX
BitDefender: Generic.Trojan.Apollo.Marte.A.3C0B0794
Bkav: W32.Malware.97A04BEE
CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4
CTX: exe.trojan.apollo
CrowdStrike: win/malicious_confidence_90% (D)
DeepInstinct: MALICIOUS
DrWeb: BackDoor.MythicApolloNET.1
ESET-NOD32: MSIL/Agent.DVI trojan
Elastic: malicious (high confidence)
Emsisoft: Generic.Trojan.Apollo.Marte.A.3C0B0794 (B)
F-Secure: Backdoor.BDS/W32.MalwareX
Fortinet: Riskware/Mythic
GData: Generic.Trojan.Apollo.Marte.A.3C0B0794
Google: Detected
Ikarus: Trojan.MSIL.Agent
K7AntiVirus: Trojan ( 005690671 )
K7GW: Trojan ( 005690671 )
Kaspersky: HEUR:Backdoor.MSIL.Apollo.gen
Malwarebytes: Malware.AI.4046405032
MaxSecure: Trojan.Malware.300983.susgen
MicroWorld-eScan: Generic.Trojan.Apollo.Marte.A.3C0B0794
Microsoft: Trojan:MSIL/MythicApollo.AMP!MTB
Rising: Backdoor.Apollo!8.1B4C0 (TFE:dGZlOgwk8V/EnsOMyQ)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Skyhigh: Apollo!7F97DCC2E8DE
Sophos: ATK/Apollo-D
Symantec: Hacktool.Mythic
Trapmine: suspicious.low.ml.score
TrellixENS: Apollo!7F97DCC2E8DE
TrendMicro-HouseCall: Trojan.Win32.VSX.PE04CA3
VBA32: Backdoor.MSIL.MythicApollo.Heur
VIPRE: Generic.Trojan.Apollo.Marte.A.3C0B0794
Varist: W32/MSIL_Agent.KLW.gen!Eldorado
ZoneAlarm: ATK/Apollo-D
huorong: Trojan/MSIL.Agent.pe

Hashes

MD5 7f97dcc2e8de6e8366787d2a925ca023
SHA1 428f61087b964b5926a747e3739f59925656513a
SHA256 1fb1bbfafb94fc1b9e7a90cd6c4f2fad984348a2012f52679a0196ba8ed0a630
SHA3 b42ad2e2a78889326045df51dbb839eabe4f88a8159ce7b13431a47503a8fcec
SSDeep 49152:6kqXfd+/9AqbXHeW/02D6xHTyD3evvKPydYKte2g2YNDjw0TlgEZ:6kqXf0FfbXHRLLivKPydYceNPwOlV
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2102-Jul-18 20:00:26
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x205400
SizeOfInitializedData 0x800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0020734E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x20c000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c1865ef4679f050fb506dde627777854
SHA1 dd709b922cd2ef0bc8a5da8e97efc109865f5173
SHA256 d958698f77c1f5e48edc166578fa6c1ca15d6d5ec3359f2f0a416afed29f0766
SHA3 985a72a705277e32fece50bcfe9be5108730196a5bc2d4069785c179891fb6d5
VirtualSize 0x205354
VirtualAddress 0x2000
SizeOfRawData 0x205400
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.99079

.rsrc

MD5 edc2035f490ceb124bd5a9754c9bb18d
SHA1 82108e00b2747a45f45cc317e0aaa476800b6765
SHA256 604142bb3f471b47fb097d9549d5a30873ab20523d69dfd6b78a25e57e202da6
SHA3 8c43cc4e120c8d45acc5d508bf5bfe2fdb7c40cba588989e4c0feb1b67053b70
VirtualSize 0x59c
VirtualAddress 0x208000
SizeOfRawData 0x600
PointerToRawData 0x205600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.03493

.reloc

MD5 3ddb4da8be6e7104565155495acecaac
SHA1 e0338f97ff319c9844108ad0ab2f342e433a0281
SHA256 75dd7616449f12cf21eb34af6551917eb7f5a773d2e0d33eaa4571c9233b2c7e
SHA3 756f15aeb17259165351e06d69d6096641d7f1f07210e637caf1409ee64ad5bd
VirtualSize 0xc
VirtualAddress 0x20a000
SizeOfRawData 0x200
PointerToRawData 0x205c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x30c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.22316
MD5 b5a995d33e379fe26681b0627a730fc5
SHA1 56765ee3e19c8e59a2853bc7aca2f9da2c23fb0c
SHA256 9beaac95fffc02757aa637e3e2b91a1407f86657b791564d95f3e6a69facbfdb
SHA3 f1fbd09b113d42df1a2fa69938e9c4b823262bb5096369c8b73f1069620daa4b

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription Apollo
FileVersion (#2) 1.0.0.0
InternalName Apollo.exe
LegalCopyright Copyright © 2021
LegalTrademarks
OriginalFilename Apollo.exe
ProductName Apollo
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0x2054f8

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.