23f2690aafe0e77bdbddcdcb7b92212b91ae712121caa33e2c621b2cada09c1f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-May-09 08:39:07
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • 2010-aia.verisign.com
  • 2010-crl.verisign.com
  • aia.verisign.com
  • aia.ws.symantec.com
  • crl.microsoft.com
  • crl.thawte.com
  • crl.verisign.com
  • crl.ws.symantec.com
  • csc3-2010-aia.verisign.com
  • csc3-2010-crl.verisign.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl04
  • http://csc3-2010-aia.verisign.com
  • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
  • http://csc3-2010-crl.verisign.com
  • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif04
  • http://ocsp.thawte.com0
  • http://ocsp.verisign.com0
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • https://www.verisign.com
  • https://www.verisign.com/cps0
  • https://www.verisign.com/rpa
  • https://www.verisign.com/rpa0
  • logo.verisign.com
  • microsoft.com
  • symantec.com
  • thawte.com
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • verisign.com
  • ws.symantec.com
  • www.verisign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • NtQuerySystemInformation
 Possibly launches other programs:
  • system
 Can create temporary files:
  • CreateFileW
  • GetTempPathA
 Interacts with services:
  • EnumServicesStatusA
  • CreateServiceA
  • QueryServiceConfigA
  • OpenSCManagerA
  • DeleteService
  • ControlService
  • OpenServiceA
Malicious VirusTotal score: 29/61 (Scanned on 2026-07-22 11:05:02) ALYac: Trojan.GenericKD.80694169
Antiy-AVL: Trojan/Win64.Gamehack
Arcabit: Trojan.Generic.D4CF4B99
BitDefender: Trojan.GenericKD.80694169
Bkav: W32.Malware.514CBA5F
CTX: exe.trojan.vulndriver
CrowdStrike: win/malicious_confidence_90% (W)
Cylance: Unsafe
DrWeb: Tool.VulnDriver.22
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.80694169 (B)
Fortinet: W64/GameHack.Q!tr
GData: Trojan.GenericKD.80694169
Google: Detected
Lionic: Trojan.Win32.Vulndriver.4!c
Malwarebytes: Malware.AI.3589454322
McAfeeD: ti!23F2690AAFE0
MicroWorld-eScan: Trojan.GenericKD.80694169
Microsoft: Trojan:Win32/Egairtigado!rfn
Paloalto: generic.ml
Panda: Trj/PhxIK.A
Rising: Exploit.Vulndriver!8.1B9F1 (TFE:5:4xM3DmfvV5V)
SentinelOne: Static AI - Suspicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
VIPRE: Trojan.GenericKD.80694169
Varist: W64/ABTrojan.JLFC-2104
alibabacloud: Trojan:Win/Wacatac.B9nj
huorong: Exploit/Vulndriver.c!crit

Hashes

MD5 a6a9fe9f8eb959ed35e9b7b89b345de9
SHA1 424392aae0e52679ad589eb005a6cc53c90a4af3
SHA256 23f2690aafe0e77bdbddcdcb7b92212b91ae712121caa33e2c621b2cada09c1f
SHA3 6c32caf209953b719bb17e96731a0d16967c00229ab341a04ee1800cfbfac715
SSDeep 3072:zTMD3BEiWxBOm7KBF/S7zlzxuP0mnMuAOu1N19yPKhE0GFW+mJTQSaMm5/6fixC:Ha6LxBzKF/SPlFbmnMhOuX2CHWlyr
Imports Hash 596c33974b4438cff2fa513a95658d22

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-May-09 08:39:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1b800
SizeOfInitializedData 0xf000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000001B5D8 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2f000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e1ee2c608646b42e82b6abf982f673f9
SHA1 468f698b01ad14f66043b315ff426d28e0cf239a
SHA256 f17f267d601b32d87b63e70d4e7d7d861195ff3d6d931bd2974c5f98ba23ed5e
SHA3 39b709910381634cc47ac79c69944d8f04845bc1036c33c22418ee3b48caa5fc
VirtualSize 0x1b63c
VirtualAddress 0x1000
SizeOfRawData 0x1b800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.61877

.rdata

MD5 94e8395ef064426beb428a41d3f17322
SHA1 53b0c26811c5ecededd61e5d9c2d146b26328876
SHA256 6a3e2aa0fc4f5cf12d30a5337ebec7ec8cc74d592b87ff77265c76788b6136ac
SHA3 cd08670242ef97f280fb7eefc69c5fee319f70b16f0b3a6aaf25dfbf4e7e35bf
VirtualSize 0xd5bc
VirtualAddress 0x1d000
SizeOfRawData 0xd600
PointerToRawData 0x1bc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.10545

.data

MD5 efb79fb042e20faa344938154ea57cbd
SHA1 23b32cac828fe9e1961254a62b7392421380296f
SHA256 c8e4fc9caf44f66c0d9eb2c2fe6106a457af28868ad2f36227098285a62eced3
SHA3 d3234333ef90d0eb300881247bd4b8eaa9ec794a545410bfd4f4596ffca33973
VirtualSize 0xb80
VirtualAddress 0x2b000
SizeOfRawData 0x600
PointerToRawData 0x29200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.08108

.pdata

MD5 7fe79e20d5eee44abd77041d13d76e8c
SHA1 b18a97a277888b3c00f494bdee6a3b6acbae97e5
SHA256 967199a1cbd9f463bdf7e9680cda7d02962518042a60e3954086658336023b82
SHA3 7d0934527ccebee700ba5ab70397fa47b990097523f9857f15dc862a5180c872
VirtualSize 0x9fc
VirtualAddress 0x2c000
SizeOfRawData 0xa00
PointerToRawData 0x29800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.26976

.rsrc

MD5 264e317304c9b21a342169b33c0a791a
SHA1 19e4516cd5ef576d6e330570723e58fa40836f70
SHA256 e47d9980be8807870dc0a31757a99d3d80d119a710c08997596cc6aa82b89ef7
SHA3 b1b9dabd447182e6593808e753d961d0c1a9e1e2fbf9cafc8fad3725f4c477d5
VirtualSize 0x1e0
VirtualAddress 0x2d000
SizeOfRawData 0x200
PointerToRawData 0x2a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71768

.reloc

MD5 3e591493ca9aa00ba8278d311327b3c8
SHA1 dea85967d5641eb947cd1c1d2d45db1860426969
SHA256 c155c6e4ec94738166ccc390f3805d58cfe66aba82ec659292d490ffd398ef44
SHA3 6008ac0de780eabaeb9900e77127ef60aa64bda82020a3bc3d06a477cbb05ede
VirtualSize 0xf8
VirtualAddress 0x2e000
SizeOfRawData 0x200
PointerToRawData 0x2a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.10913

Imports

KERNEL32.dll GetVersionExA
GetProcAddress
DeleteCriticalSection
LoadLibraryA
DeviceIoControl
CreateFileW
GetTempPathA
CloseHandle
GetCurrentProcessId
GetLastError
Sleep
InitializeCriticalSectionEx
VirtualAlloc
GetStdHandle
VirtualFree
SetConsoleTextAttribute
SetConsoleTitleA
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentThreadId
LocalFree
FormatMessageA
GetLocaleInfoEx
AreFileApisANSI
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
USER32.dll BlockInput
ADVAPI32.dll EnumServicesStatusA
CreateServiceA
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
OpenServiceA
VERSION.dll GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
MSVCP140.dll ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll.dll NtQuerySystemInformation
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memset
memmove
_CxxThrowException
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
__current_exception_context
__current_exception
strstr
memcpy
api-ms-win-crt-heap-l1-1-0.dll free
_callnewh
_set_new_mode
malloc
api-ms-win-crt-runtime-l1-1-0.dll _crt_atexit
_register_onexit_function
_seh_filter_exe
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
exit
terminate
_exit
__p___argc
_invoke_watson
__p___argv
_initialize_onexit_table
system
_register_thread_local_exe_atexit_callback
_cexit
_c_exit
api-ms-win-crt-conio-l1-1-0.dll _getch
api-ms-win-crt-stdio-l1-1-0.dll fgetc
fclose
fflush
fputc
setvbuf
fgetpos
ungetc
fsetpos
fread
_fseeki64
_get_stream_buffer_pointers
_set_fmode
__p__commode
fwrite
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
remove
_lock_file
api-ms-win-crt-string-l1-1-0.dll _stricmp
api-ms-win-crt-locale-l1-1-0.dll ___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-May-09 08:39:07
Version 0.0
SizeofData 912
AddressOfRawData 0x27608
PointerToRawData 0x26208

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-May-09 08:39:07
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400279b8
EndAddressOfRawData 0x1400279c0
AddressOfIndex 0x14002bad0
AddressOfCallbacks 0x14001d5e8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14002b040

RICH Header

XOR Key 0xc5b7ec10
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
ASM objects (35207) 4
C objects (35207) 10
C++ objects (35207) 35
Imports (35207) 6
Imports (33145) 11
Total imports 235
C++ objects (LTCG) (35226) 6
Resource objects (35226) 1
Linker (35226) 1

Errors

Leave a comment

No comments yet.