2f0941e4c4714d207f866861555e1606fd54e12b865b9f4d3d50ceb9f78fd403

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-May-04 09:36:14
Detected languages English - United States
TLS Callbacks 4 callback(s) detected.

Plugin Output

Suspicious PEiD Signature: PeStubOEP v1.x
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Unusual section name found: .!HI
Unusual section name found: .w^q
Unusual section name found: ..XV
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • FindWindowA
 Can access the registry:
  • RegDeleteValueW
 Leverages the raw socket API to access the Internet:
  • gethostname
Malicious VirusTotal score: 24/68 (Scanned on 2026-07-10 11:03:16) Bkav: W32.Malware.1E477CF5
CTX: dll.trojan.artemis
CrowdStrike: win/malicious_confidence_90% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win64/Packed.VMProtect.AC suspicious application
Elastic: malicious (high confidence)
Fortinet: Riskware/Application
Google: Detected
Gridinsoft: Trojan.Heur!.022120A2
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Malware.Heuristic.2106
MaxSecure: Trojan.Malware.324995110.susgen
McAfeeD: ti!2F0941E4C471
Paloalto: generic.ml
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: Artemis
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!91EC65FCB166
TrendMicro: PUA.Win64.GameHack.CH
TrendMicro-HouseCall: PUA.Win64.GameHack.CH
Varist: W64/ABApplication.CKIO-5931
alibabacloud: VirTool:Win/Wacatac.B9nj

Hashes

MD5 91ec65fcb1665c1f55198a868bb8224f
SHA1 c244ec97d014809e568ef3611fb1bd625b52a35f
SHA256 2f0941e4c4714d207f866861555e1606fd54e12b865b9f4d3d50ceb9f78fd403
SHA3 7b1b1518b815c4b799141aa9779500772a2174585c27b72f55d4ae313ba20c86
SSDeep 393216:DBt6fSdHPPmgT9x/5qecpP3QU2cV6OkI/x0wlIWy3ZAHPoK3e3UAFW:T+2PFx/8NPsQ3x7+fIYrF
Imports Hash 50d6efb0a33b3efab64c994d9995fb78

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-May-04 09:36:14
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2c4e00
SizeOfInitializedData 0x142600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000002583E6A (Section: ..XV)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x25dd000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x2c4d4f
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x114bf4
VirtualAddress 0x2c6000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xb49c
VirtualAddress 0x3db000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1d55c
VirtualAddress 0x3e7000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x100
VirtualAddress 0x405000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.!HI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xd38ca6
VirtualAddress 0x406000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.w^q

MD5 48f73ca59c2836092dd2bee2b4454272
SHA1 7b179acf0c96397b40f13183f2898a48911b0a0b
SHA256 8336b0d4da76fdf8e435fb64cc2e644f5e3bb84c85a826bbe166376ab5aef2ef
SHA3 ed4734835c0e7efaad0c804986b5c1a0b93352db8728b2e9091dbbe57e9505a4
VirtualSize 0x100
VirtualAddress 0x113f000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.847304

..XV

MD5 47a3de07327991e1e83b3e072943f440
SHA1 e54d4cd93b35aeaddc0136a9b1ec910627cf489c
SHA256 4bd2abd8c42746c3c8d0315dea04bacff79a88f48c9a21226fa5144036f66e3d
SHA3 2518b7716f4201640555384f2345854224ac58983adb8fe0faacb12380691d3c
VirtualSize 0x149ad48
VirtualAddress 0x1140000
SizeOfRawData 0x149ae00
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.85478

.rsrc

MD5 148d9bdff028b0e976fa4f55d7beb375
SHA1 1317ba4b7b35e650edcdaf4030e8482589272068
SHA256 afe93e9d366a184e699b01a194779c618ad902238b09559c7fd137e5c98599ab
SHA3 7b1e2d5ef17cbba56d98faf5fe66fc956773e2c621ff0a9d9fbd348f8de74683
VirtualSize 0xe9
VirtualAddress 0x25db000
SizeOfRawData 0x200
PointerToRawData 0x149b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.54672

.reloc

MD5 63ce36029a363aea2589c8c239dfc2dc
SHA1 0bb9bad2eb63cd3b40155c4d0210237c57f5ee85
SHA256 ca518a8fc2cd22890dcc05c6d0d0c132890e5784dde27d80a9b71b698f6fa0f0
SHA3 79e0fe273862deca9a87c2ef8d198493965ff8c492dfc9e9c3447f5e8643528c
VirtualSize 0xb8
VirtualAddress 0x25dc000
SizeOfRawData 0x200
PointerToRawData 0x149b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.13308

Imports

RPCRT4.dll UuidToStringA
WS2_32.dll gethostname
ntdll.dll RtlPcToFileHeader
KERNEL32.dll CancelIo
ADVAPI32.dll RegDeleteValueW
ole32.dll CoTaskMemAlloc
WLDAP32.dll #79
IPHLPAPI.DLL if_nametoindex
Normaliz.dll IdnToAscii
CRYPT32.dll CertEnumCertificatesInStore
USER32.dll FindWindowA

Delayed Imports

Download

Ordinal 1
Address 0x59800

GetHashes

Ordinal 2
Address 0x6da70

GetRobloxVersion

Ordinal 3
Address 0x71e90

Validate

Ordinal 4
Address 0x62a00

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8858
MD5 f7ad1eab748bc07570a57ec87787cf90
SHA1 0b1608da9fef218386e825db575c65616826d9f4
SHA256 d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04
SHA3 6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a

Version Info

TLS Callbacks

StartAddressOfRawData 0x18113f0b8
EndAddressOfRawData 0x18113f0d0
AddressOfIndex 0x1803e5108
AddressOfCallbacks 0x1816ed6a8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x00000001823B173A
0x00000001801C4CB0
0x00000001801FDCFC
0x00000001802BD630

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1803dbe80

RICH Header

Errors

[*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section .!HI has a size of 0!
Leave a comment

No comments yet.