Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2021-Sep-25 21:56:47 |
Detected languages |
English - United States
|
Info | Interesting strings found in the binary: |
Contains domain names:
|
Suspicious | The PE is an NSIS installer | Unusual section name found: .ndata |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Suspicious | The file contains overlay data. |
2610229 bytes of data starting at offset 0x2b000.
The overlay data has an entropy of 7.96373 and is possibly compressed or encrypted. Overlay data amounts for 93.6789% of the executable. |
Malicious | VirusTotal score: 48/72 (Scanned on 2023-12-22 22:48:38) |
Bkav:
W32.AIDetectMalware
Lionic: Trojan.Win32.Keygen.4!c MicroWorld-eScan: Trojan.GenericKD.66085663 CAT-QuickHeal: Trojan.Keygen Skyhigh: BehavesLike.Win32.Generic.vc ALYac: Trojan.GenericKD.66085663 Cylance: unsafe Zillya: Trojan.Keygen.Win32.10808 Sangfor: PUP.Win32.Keygen.V6aa K7AntiVirus: Unwanted-Program ( 0052f55b1 ) K7GW: Unwanted-Program ( 0052f55b1 ) Symantec: ML.Attribute.HighConfidence Elastic: malicious (high confidence) ESET-NOD32: Win32/Keygen.ACE potentially unsafe Cynet: Malicious (score: 100) APEX: Malicious ClamAV: Win.Malware.Score-6997747-0 BitDefender: Trojan.GenericKD.66085663 Avast: NSIS:TrojanX-gen [Trj] Emsisoft: Trojan.GenericKD.66085663 (B) VIPRE: Trojan.GenericKD.66085663 TrendMicro: TROJ_GEN.R014C0PCP23 FireEye: Generic.mg.21af4fe9f3565a34 Sophos: Generic Reputation PUA (PUA) Ikarus: Trojan-Dropper.Win32.Agent GData: Trojan.GenericKD.66085663 Webroot: W32.Adware.Gen Varist: W32/Zusy.KR.gen!Eldorado MAX: malware (ai score=82) Antiy-AVL: Trojan/Win32.SGeneric Kingsoft: Win32.Troj.Undef.a Gridinsoft: Crack.Win32.Heuristic.cl Xcitium: ApplicUnwnt@#1n47368ovfkyc Arcabit: Trojan.Generic.D3F0631F Microsoft: PUA:Win32/Keygen Google: Detected AhnLab-V3: Trojan/Win.Generic.R459739 McAfee: Artemis!21AF4FE9F356 Malwarebytes: Keygen.CrackTool.RiskWare.DDS Panda: Trj/CI.A TrendMicro-HouseCall: TROJ_GEN.R014C0PCP23 Rising: Trojan.Generic@AI.88 (RDML:Tqie4t9HHCvk9ZfkYVKbkQ) SentinelOne: Static AI - Suspicious PE Fortinet: Riskware/KeyGen BitDefenderTheta: Gen:NN.ZedlaF.36608.Tq4@aC9BWZh AVG: NSIS:TrojanX-gen [Trj] DeepInstinct: MALICIOUS CrowdStrike: win/grayware_confidence_100% (W) |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xd8 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 5 |
TimeDateStamp | 2021-Sep-25 21:56:47 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 6.0 |
SizeOfCode | 0x6800 |
SizeOfInitializedData | 0x22a00 |
SizeOfUninitializedData | 0x800 |
AddressOfEntryPoint | 0x00003640 (Section: .text) |
BaseOfCode | 0x1000 |
BaseOfData | 0x8000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 4.0 |
ImageVersion | 6.0 |
SubsystemVersion | 4.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x5e000 |
SizeOfHeaders | 0x400 |
Checksum | 0 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
ADVAPI32.dll |
RegCreateKeyExW
RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW |
---|---|
SHELL32.dll |
SHGetSpecialFolderLocation
SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW |
ole32.dll |
OleInitialize
OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree |
COMCTL32.dll |
#17
ImageList_Create ImageList_Destroy ImageList_AddMasked |
USER32.dll |
GetClientRect
EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu |
GDI32.dll |
SetBkMode
SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject |
KERNEL32.dll |
GetExitCodeProcess
WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW |
XOR Key | 0xd26650e9 |
---|---|
Unmarked objects | 0 |
C objects (VS2003 (.NET) build 4035) | 2 |
Total imports | 165 |
Imports (VS2003 (.NET) build 4035) | 15 |
48 (9044) | 10 |
Resource objects (VS98 SP6 cvtres build 1736) | 1 |