2b53fd2afb59f7a131622f31d46f88020c15c59749e343df085502d7dc0dd57e

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-18 21:25:06
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • github.com
  • http://sajatypeworks.comAaron
  • https://github.com
  • https://scripts.sil.org
  • https://scripts.sil.org/OFL
  • https://scripts.sil.org/OFLMicrosoft
  • scripts.sil.org
  • youtube.com
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • CreateRemoteThread
  • OpenProcess
  • VirtualAlloc
  • VirtualAllocEx
  • WriteProcessMemory
 Possibly launches other programs:
  • ShellExecuteW
  • ShellExecuteA
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualAllocEx
  • VirtualProtectEx
  • VirtualProtect
 Manipulates other processes:
  • OpenProcess
  • ReadProcessMemory
  • WriteProcessMemory
  • Process32First
  • Process32Next
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious The PE is possibly a dropper. Resource 101 detected as a PE Executable.
Malicious VirusTotal score: 9/70 (Scanned on 2026-09-20 00:23:40) Bkav: W32.Malware.692B886F
CrowdStrike: win/grayware_confidence_90% (D)
Elastic: malicious (high confidence)
McAfeeD: Real Protect-LS!2AEFF5A203F9
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Sangfor: Trojan.Win32.Save.a
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!2AEFF5A203F9

Hashes

MD5 2aeff5a203f9a848fd7edf6990756dad 🔍
SHA1 41ed2a9d0af8295e66b3f13d6ec8dbf11f4d0eae 🔍
SHA256 2b53fd2afb59f7a131622f31d46f88020c15c59749e343df085502d7dc0dd57e 🔍
SHA3 a7e9df96cac6989e99757470bf32f9139f250d3c57fb640005add54a808a9ed2 🔍
SSDeep 98304:KtQOzKocQwj1SXHws9arA5NAgnAIPr1M4:KtQOTJ+kXHZkra6gnl5M 🔍
Imports Hash 64c7d8f7bbb10b1b7db31155b596d4a6 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2026-Sep-18 21:25:06
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0xce400
SizeOfInitializedData 0x355a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000AB2F0 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xd0000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x427000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 beaf7ae414cf317347781b1539accfda 🔍
SHA1 f6cf958a8098a750ab108a519d853cd104efa99d 🔍
SHA256 50f6b94aad5cdf082720314128977a27188ed811e0049cd49bcf8aedb787b022 🔍
SHA3 4547365d72341d37b60dea9086e6bb85630ab59630967412df41e49c3bc5ea08 🔍
VirtualSize 0xce2c2
VirtualAddress 0x1000
SizeOfRawData 0xce400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.64104

.rdata

MD5 e60868b7cf1fa791bddacb612427b182 🔍
SHA1 f2156cc2b1270720b68c04d9754f8e83ff089a2a 🔍
SHA256 3ea803456b751bdc28f01490fed8b0e4a80b2f391790b8efafe13a665d6bdad3 🔍
SHA3 0d96e37f4ae1f1c7f5040f58cb4b7bf5d59fadfaa3ef097b7d06d678af95c5ff 🔍
VirtualSize 0x1259d4
VirtualAddress 0xd0000
SizeOfRawData 0x125a00
PointerToRawData 0xce800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.56142

.data

MD5 79f2b2bc983a9f62f9532fa235bf5175 🔍
SHA1 90938d57a834b73a0db98657eaed9b6834f845fc 🔍
SHA256 73d5a7ecd04c1caf9fb2be6ceca314d0fc6133d3f4f6ab724da8e724b681ba04 🔍
SHA3 a846697eef7a16133feeb213e561ee290155c8fd759f453c8572c664547fd925 🔍
VirtualSize 0x2fcc
VirtualAddress 0x1f6000
SizeOfRawData 0x1e00
PointerToRawData 0x1f4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.78384

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x80
VirtualAddress 0x1f9000
SizeOfRawData 0x200
PointerToRawData 0x1f6000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 9db3808753590558ae9e4373988ce075 🔍
SHA1 19cb85260882977de4cb1765160ef69ec44e2842 🔍
SHA256 f3d0a871d27c816f076e3f7884c6f52e26eb645ad6de5767919321d46a24459a 🔍
SHA3 f3db5a4356d547f733720e56fde8f49b6819588a5dac36d65b59491c58e39b42 🔍
VirtualSize 0x21ff98
VirtualAddress 0x1fa000
SizeOfRawData 0x220000
PointerToRawData 0x1f6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.68828

.reloc

MD5 28a17ddaf932f4e32ea74ff9a94a0550 🔍
SHA1 7152eab35ee434cb92ae8a0d3d619fa917824afb 🔍
SHA256 bf2a9ebcdc7560d2e5966ea5b95ec9c569b6b5e40cfda88f7a2d2d7e1c395822 🔍
SHA3 6ae5a81a6ce1e47554ffab1345758a8996f114306154cd2ebf6e6de777a709d5 🔍
VirtualSize 0xcc74
VirtualAddress 0x41a000
SizeOfRawData 0xce00
PointerToRawData 0x416200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.33835

Imports

KERNEL32.dll CreateRemoteThread
OpenProcess
VirtualAlloc
VirtualFree
VirtualAllocEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
LoadResource
LockResource
SizeofResource
LoadLibraryA
FindResourceA
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
Module32Next
CreateDirectoryA
DeleteFileA
GetFileAttributesExA
GetTickCount64
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetLocaleInfoA
IsDBCSLeadByte
SetEndOfFile
HeapSize
CreateFileW
GetStringTypeW
SetStdHandle
GetProcessHeap
ExitProcess
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
FlushFileBuffers
HeapReAlloc
LCMapStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileSizeEx
GetConsoleOutputCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
DecodePointer
GetFileType
GetCurrentProcessId
WaitForMultipleObjects
Sleep
CreateEventA
CreateMutexA
WaitForSingleObject
ReleaseMutex
HeapAlloc
HeapFree
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
ReadFile
LoadLibraryExW
TlsFree
TlsSetValue
OutputDebugStringA
ResetEvent
SetEvent
GetLastError
CreateThread
CloseHandle
FreeEnvironmentStringsW
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
WriteConsoleW
USER32.dll PostQuitMessage
DispatchMessageW
RegisterClassExW
CreateWindowExW
DestroyWindow
DefWindowProcW
PeekMessageW
TranslateMessage
UnregisterClassW
ShowWindow
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
LoadImageW
LoadCursorA
GetWindowLongW
AdjustWindowRectEx
UpdateWindow
GetSystemMetrics
SetWindowPos
GDI32.dll GetStockObject
COMDLG32.dll GetOpenFileNameW
SHELL32.dll ShellExecuteW
ShellExecuteA
ole32.dll CoInitializeEx
CoCreateInstance
CoUninitialize
d3d11.dll D3D11CreateDeviceAndSwapChain
dwmapi.dll DwmSetWindowAttribute
IMM32.dll ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
D3DCOMPILER_47.dll D3DCompile

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14c4f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98937
Detected Filetype PNG graphic file
MD5 46aba3a420659d4db648486fd580cdf7 🔍
SHA1 15e0c97de77a85c6330bec0681d807c027a5ef38 🔍
SHA256 d048206d37d679b69d6d79ca8ad82a6ba40d66c993bff5e9c5604e5ee21d0970 🔍
SHA3 05ebeda9ec73548a246418934e89f65bbe9f8efa1ebbc03412db232683ee6ea1 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1e24
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96156
Detected Filetype PNG graphic file
MD5 038193573bbbcdde6cedb2cfa3e70be1 🔍
SHA1 457ea389fbf2ef4053d072e2cf75745ad646e8f1 🔍
SHA256 43ce003651c5f448913ac10bda2e8085e8fe01292d168b571f67ede2aa6d8f38 🔍
SHA3 b52498e91d4580ae6765bdbbcf362eb46d0bc1a4935e0b514dc46666706cbd98 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x12ce
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94712
Detected Filetype PNG graphic file
MD5 714c1006dd372f86d1c2283538a396e3 🔍
SHA1 67e178715d4b59ed6a846371dcff66d02cc6e2fe 🔍
SHA256 6ba5c1500e46faa9dcf8e3b1b182a17b1a7491399c57aed4ccb1bc08cfebcb5e 🔍
SHA3 dcd419d8f4fc3b2e3113fb786791b25ada9dcd4471c941e163e8f767a9278f2e 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x9e4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88789
Detected Filetype PNG graphic file
MD5 02c1a5bafd81855ff8b1774ead983ed0 🔍
SHA1 eb8e50e26e9f041936853b7fb711ea0c317d2cab 🔍
SHA256 e1bfa4cbe8d3f5574f7f55a350c7f3415d4284c8108c255c4ebc773942f3d810 🔍
SHA3 741721864117ae4937e7aaf3c2e27d9edb6425b4f370d6bc779ed4e0ef80091c 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x368
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.65864
Detected Filetype PNG graphic file
MD5 25979c8fe0e2b39cd110e66233f0227f 🔍
SHA1 5a2874bd6c1337977b56b6c0425089439136f931 🔍
SHA256 8403cbb0f91c6cec12a7fe93782903497819f7e50421f8a149571675cf714553 🔍
SHA3 60a33faedede15c3d80c3858cd564a21f1c013c7d272b237efd6c3ea1266d89c 🔍

101

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x38600
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.46896
Detected Filetype PE Executable
MD5 3b7bc6fdd413507bb8e790ffd2924534 🔍
SHA1 565d2c644b4ee9268bddaf45b928d0a46b8aad9d 🔍
SHA256 d8d204566ed42ff870b8ba5f75d1917edbc4142e90cd2d3f59e5287deb591904 🔍
SHA3 2a3d5277c15e42552f9f95ec687ef72476af2798fb6e454aea5770997a80f5d9 🔍

102

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xafd70
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.70752
Detected Filetype TrueType font file
MD5 211e70eb248ef61022cc671e2950586b 🔍
SHA1 c00188fae30a428ede51f2988d8323e5d74ef0f2 🔍
SHA256 c122567c3423a5809d3e4e3f1cd47ce2a609e1764fe3144d581c577006c244b5 🔍
SHA3 9c36c6aefb4bcb51f77315c1d4493f76b903f8d375ca3d7617d050f2261537c1 🔍

103

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x105dde
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99442
Detected Filetype PNG graphic file
MD5 4f9306bfd3c9facb4f41da333a3553fd 🔍
SHA1 b3e7132a42c9b4b640ee4627c0b2a56b0aee4b5e 🔍
SHA256 eebe83deb1f2074f8aeb8cff0b501bc9c8530f815ef9ee387273fa21695b340e 🔍
SHA3 dfcc02847bbf59f6b7fc9502d955dfca00d9de6524fd87a42972bd16e4967336 🔍

105

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x18f5c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99021
Detected Filetype PNG graphic file
MD5 6f8fec7260ab6b0e138cfedc77429ac3 🔍
SHA1 c1fcf1be7393a0ec18885f1c16236660f3f30620 🔍
SHA256 96a9037d57088d10920d7611c02857b61f94c364a00d9a959b54e6ef0bf09d9c 🔍
SHA3 f2882887ab20086eb6a476b981cbebbea349d4266e111d0e0747445f71f53e5f 🔍

104

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.74097
Detected Filetype Icon file
MD5 2175af58517461329e5b1d602dd9abeb 🔍
SHA1 762dcb982ab6d9ff710bf0bb43e998eca91c40de 🔍
SHA256 b192a5d2c72c0be03963e1f763b68b01bc90fa5ba015b86fbb080db4adf9754b 🔍
SHA3 bb5bbe50608fd4cfeb56d8a4d4c81bc8bb28e17af8fe24c3a08497c454e8b15b 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-18 21:25:06
Version 0.0
SizeofData 944
AddressOfRawData 0x1f21b0
PointerToRawData 0x1f09b0

TLS Callbacks

StartAddressOfRawData 0x5f2570
EndAddressOfRawData 0x5f2578
AddressOfIndex 0x5f8970
AddressOfCallbacks 0x4d0358
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x5f72c0
SEHandlerTable 0x5f1eac
SEHandlerCount 109

RICH Header

XOR Key 0x7965c64c
Unmarked objects 0
ASM objects (33145) 41
C++ objects (33145) 166
ASM objects (35207) 25
C objects (35207) 17
C++ objects (35207) 56
C objects (33145) 29
Imports (33145) 21
Total imports 227
C objects (35222) 24
C++ objects (35222) 10
Resource objects (35222) 1
151 1
Linker (35222) 1

Errors

Leave a comment

No comments yet.