2022c964fc2ea4117a60d0348d6901d91cd2e48809f7bc23de3ce47cb3aa5b09

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Aug-09 22:28:35
TLS Callbacks 1 callback(s) detected.
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: UPX -> www.upx.sourceforge.net
UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
The PE only has 6 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Info The PE's resources present abnormal characteristics. Resource 108 is possibly compressed or encrypted.
Resource 110 is possibly compressed or encrypted.
Resource 113 is possibly compressed or encrypted.
Suspicious The file contains overlay data. 40602 bytes of data starting at offset 0x2f600.
Malicious VirusTotal score: 46/70 (Scanned on 2026-07-30 13:28:17) ALYac: Application.Generic.4264937
APEX: Malicious
AVG: Win32:MalwareX-gen [Misc]
AhnLab-V3: Unwanted/Win.Keygen.C5916558
Antiy-AVL: HackTool/Win32.KeyGen
Arcabit: Application.Generic.D4113E9
Avast: Win32:MalwareX-gen [Misc]
Avira: TR/W32.Agent
BitDefender: Application.Generic.4264937
Bkav: W32.Malware.8A2F21A
CTX: exe.hacktool.keygen
CrowdStrike: win/malicious_confidence_90% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
Elastic: malicious (moderate confidence)
Emsisoft: Application.Generic.4264937 (B)
F-Secure: Trojan.TR/W32.Agent
Fortinet: W32/PossibleThreat
GData: Application.Generic.4264937
Google: Detected
Gridinsoft: Hack.Win32.Patcher.cl
Ikarus: PUA.HackTool.Win32.Keypz
Lionic: Hacktool.Win32.Keygen.3!c
Malwarebytes: Generic.Malware/Suspicious
MaxSecure: Trojan.Malware.3405.susgen
McAfeeD: Real Protect-LS!DFCFF72B1D31
MicroWorld-eScan: Application.Generic.4264937
Microsoft: HackTool:Win32/Keygen
Paloalto: generic.ml
Panda: PUP/Crack
Rising: Hacktool.Keygen!8.B29 (CLOUD)
SUPERAntiSpyware: Hack.Tool/Gen-KeyGen
Sangfor: Hacktool.Win32.Keygen.V80s
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win32.Trojan.dc
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.moderate.ml.score
TrellixENS: Artemis!DFCFF72B1D31
TrendMicro: Trojan.Win32.ZYX.USBLED26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLED26
VBA32: BScope.Trojan.Click
VIPRE: Application.Generic.4264937
Varist: W32/ABApplication.FOBQ-4713
ViRobot: HackTool.S.Keygen.234650
Xcitium: ApplicUnwnt@#8r9hjdubx7m4

Hashes

MD5 dfcff72b1d31ce13b678807ff00bda58
SHA1 2aaee6be8fb2bad76ce812e1583afce86989ba1e
SHA256 2022c964fc2ea4117a60d0348d6901d91cd2e48809f7bc23de3ce47cb3aa5b09
SHA3 6e8c6fb6f94cebac932a227600d82e2a7fb092318063433d93d8ed75e76f57b2
SSDeep 6144:mPgCATIQ7mILaewyOlF5+FIf1CBdeiNj855:moCATIxI+fzFf1CCUj855
Imports Hash 75e750329b5c14ec562b528d8fde25e7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2024-Aug-09 22:28:35
PointerToSymbolTable 0x50c00
NumberOfSymbols 1856
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x2c000
SizeOfInitializedData 0x4000
SizeOfUninitializedData 0x31000
AddressOfEntryPoint 0x0005D610 (Section: UPX1)
BaseOfCode 0x32000
BaseOfData 0x5e000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x62000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x31000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 5e3788c0500c8d64039d7bd3abd0bb82
SHA1 3c572529538680183e635acec001ed80250acd6a
SHA256 ddcb1855c04029bdde78436a572eb11416321cf1b5b52a3365edb43477af41a9
SHA3 a30eaa1551e3a3b841a1e184a06111c3deb86184d7ee6d7e6dd83d2f2bbb6df2
VirtualSize 0x2c000
VirtualAddress 0x32000
SizeOfRawData 0x2ba00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.91858

.rsrc

MD5 1ea368696906150b6209eac8566f6219
SHA1 3fefc9afa7b87b6d171627c33580ec47b24a3088
SHA256 4b879caaed91cdf8b03f95164ff5073be7433dfb9e02b9a436504edaa61bc3e1
SHA3 3326751290e342b3627ac687274343d0a8aa9e35faf4dbd981aaca605cc093f2
VirtualSize 0x4000
VirtualAddress 0x5e000
SizeOfRawData 0x3a00
PointerToRawData 0x2bc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.7698

Imports

KERNEL32.DLL LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
msvcrt.dll atoi
USER32.dll EndDialog

Delayed Imports

108

Type DLL
Language UNKNOWN
Codepage UNKNOWN
Size 0x8604
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88433
MD5 2daa1718e2b57ca48049a4796eac36c2
SHA1 49f7160fb772dbe038151667257452d1e7e116c1
SHA256 2abb38afb022ab5a6f4dcfec1915a98efebc60d2caa8c4e4672acaeb2fc2662f
SHA3 f20b972d37a15016281bec91f8e06c0cdbbfc239bce4f5e99a7e83da9f3f3ca9

110

Type MODULE
Language UNKNOWN
Codepage UNKNOWN
Size 0x55f2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.84515
MD5 25f7239e2fef7a842ee530edf4bfbd8a
SHA1 7747a6b7290091591670f6b3786f9b508a5be495
SHA256 e45fc52016071afa9131bb87391c942cc8d585d067d1c4b52c10b95ae285ddb6
SHA3 61970e416329ca8957412b5145a21f6239c633568ee5a4f201d83cfc7a07d661

113

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0xa388
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88368
MD5 6d6ee7f49b01bf1b9b29e38f67fce40d
SHA1 dee5c6c0f7dd26c9e10e5e4714206e386c25f19b
SHA256 d484583ba647aab65da9d266eff75ee6aa3b445d7d8a37dbeab4cdf4f88fc6e7
SHA3 c363448d8471a502427fb907f87c7d4036504541244761d64bc3eb544c1219fe
Preview

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x3228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.48293
MD5 4825320853327b6fec67146b79e4ae0b
SHA1 3cb562ef18b5a194fc48e526d0ec0b0249cec01f
SHA256 45787887ed52146513f5eb0f78c1f80d487a0d54aece3e2e406b870cbbb407ba
SHA3 811f0da124ab74a437025b928bc58c33777e6c267343fcdfc61455ec58dbc2f6

105

Type RT_DIALOG
Language UNKNOWN
Codepage UNKNOWN
Size 0x2c4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31206
MD5 fc075ac703f52a4d9532dbd7382d0627
SHA1 2ff15fad21959f26b52e2d8c3ca52eb2bc8f5086
SHA256 cbc12717c8854c58b4f45f24e161dea8f03c6a3b80982cbab6e23fb90fa63a24
SHA3 084ff853f8144f760253cc0a3e9f13f44c7b45e7b9264f9c77e864ad18e52d67

104

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.91924
Detected Filetype Icon file
MD5 da1a4e2bc252d81a7bee8207f398d70c
SHA1 e447bbc0d488bd520c3997146c266d86966129f4
SHA256 bd9e5e2d09143126611f9aba2c03e9e5d83a351eb43c69bf4b22b0d6500747f4
SHA3 91dccf0eb31d078f355cd011c264055421653bcdd15a40044a5600b0904685cb

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x29b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.99499
MD5 9c6e6313802fb3bd5e8367f23e5eaeb0
SHA1 e298abe98ebd8991559c0914c73c955712bf1910
SHA256 e23d7b6957661c5f8692d2041902e5e59489c1ec4d74b8327c7d3c2ce4f0ab9f
SHA3 da435d7896b1ae8897c17ecebcbf1be3e660c04549574387c9c0b691cbb156e6

Version Info

TLS Callbacks

StartAddressOfRawData 0x45d820
EndAddressOfRawData 0x45d824
AddressOfIndex 0x40f084
AddressOfCallbacks 0x45d824
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x0045D7E9

Load Configuration

RICH Header

Errors

[!] Error: Could not read a COFF symbol. [*] Warning: Section UPX0 has a size of 0!
Leave a comment

No comments yet.