27599c22e0eba42f3e91e27fe1d04598
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2007-May-07 12:58:10 |
| Detected languages |
Process Default Language
Russian - Russia |
Plugin Output
| Suspicious | PEiD Signature: |
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h) UPX -> www.upx.sourceforge.net UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser |
| Suspicious | The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable. Unusual section name found: UPX1 Section UPX1 is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 60/72 (Scanned on 2024-01-01 10:22:13) |
ALYac:
Trojan.FakeAlert.RS
APEX: Malicious AVG: Win32:WormX-gen [Wrm] AhnLab-V3: Win-AppCare/Renos.30720.D Alibaba: Trojan:Win32/Renos.2bdcb21c Antiy-AVL: HackTool[Hoax]/Win32.Renos Arcabit: Trojan.FakeAlert.RS Avast: Win32:WormX-gen [Wrm] Avira: TR/Dldr.Zlob.Gen BitDefender: Trojan.FakeAlert.RS BitDefenderTheta: Gen:NN.ZexaF.36608.cmGfamRyy9iI Bkav: W32.AIDetectMalware ClamAV: Win.Trojan.Fakealert-33 CrowdStrike: win/malicious_confidence_90% (D) Cylance: unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.Fakealert ESET-NOD32: Win32/Adware.SpySheriff Elastic: malicious (moderate confidence) Emsisoft: Trojan.FakeAlert.RS (B) F-Secure: Trojan.TR/Dldr.Zlob.Gen FireEye: Generic.mg.27599c22e0eba42f Fortinet: Riskware/Renos GData: Trojan.FakeAlert.RS Google: Detected Gridinsoft: Trojan.Win32.Renos.zv!s2 Ikarus: not-a-virus:Hoax.Win32.Renos Jiangmin: Trojan/Agent.fnv K7AntiVirus: Adware ( 004c1c281 ) K7GW: Adware ( 004c1c281 ) Kaspersky: UDS:Trojan.Win32.Generic Lionic: Trojan.Win32.Renos.4!c MAX: malware (ai score=100) Malwarebytes: Adware.Agent MaxSecure: Trojan.Malware.300983.susgen McAfee: GenericRXAA-AA!27599C22E0EB MicroWorld-eScan: Trojan.FakeAlert.RS Microsoft: Trojan:Win32/Renos!ic NANO-Antivirus: Virus.Win32.Gen.ccmw Panda: Adware/BraveSentry Rising: Hoax.Renos!8.1140 (TFE:5:tkcL0R1CgNE) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win32.Fasong.pm Sophos: Mal/Generic-R Symantec: SpySheriff Tencent: Malware.Win32.Gencirc.1173c566 Trapmine: malicious.moderate.ml.score TrendMicro: TROJ_RENOS.SZ TrendMicro-HouseCall: TROJ_RENOS.SZ VBA32: Trojan-DownLoader.Revelation.Tupak VIPRE: Trojan.FakeAlert.RS Varist: W32/FakeAlert.G.gen!Eldorado VirIT: Trojan.Win32.Fakealert.JN Webroot: W32.Trojan.FakeAlert Xcitium: Application.Win32.Adware.SpySheriff@oso Yandex: Trojan.Renos.Gen.9 Zillya: Tool.Renos.Win32.1408 ZoneAlarm: Hoax.Win32.Renos.fi |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2007-May-07 12:58:10 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x4000 |
| SizeOfInitializedData | 0x7000 |
| SizeOfUninitializedData | 0xe000 |
| AddressOfEntryPoint | 0x00012790 (Section: UPX1) |
| BaseOfCode | 0xf000 |
| BaseOfData | 0x13000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1a000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
UPX0
UPX1
.rsrc
Imports
| ADVAPI32.dll |
RegCloseKey
|
|---|---|
| COMCTL32.dll |
InitCommonControlsEx
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess GetProcAddress VirtualProtect |
| ole32.dll |
CoInitialize
|
| SHELL32.dll |
Shell_NotifyIconA
|
| USER32.dll |
IsChild
|
| WSOCK32.dll |
sendto
|
Delayed Imports
1
101
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x45dda252 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS98 build 8168) | 24 |
| 14 (7299) | 11 |
| Unmarked objects (#2) | 5 |
| 19 (8034) | 13 |
| Total imports | 85 |
| C++ objects (VS98 build 8168) | 4 |
| Resource objects (VS98 cvtres build 1720) | 1 |
Errors
[*] Warning: Section UPX0 has a size of 0!