3218ff020dffa6c3d6f878d36f5da6c8421086fcdcea1f1252e63e469ca1c818

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Sep-03 22:20:00

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • github.com
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Functions related to the privilege level:
  • OpenProcessToken
Malicious The file contains overlay data. 4465878 bytes of data starting at offset 0x36a00.
The file contains a PE Executable after the PE data.
Overlay data amounts for 95.229% of the executable.
Malicious VirusTotal score: 5/71 (Scanned on 2026-09-04 02:19:22) APEX: Malicious
Bkav: W32.Malware.A5BA0AB9
Elastic: malicious (moderate confidence)
Microsoft: Trojan:Win32/Wacatac.B!ml
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 791b7960183249783baa8349ede4765f 🔍
SHA1 3db0f0c46bd15017c9c8e5a3549639a1ada17c72 🔍
SHA256 3218ff020dffa6c3d6f878d36f5da6c8421086fcdcea1f1252e63e469ca1c818 🔍
SHA3 8ad249a8e6957e558c295b5cbf666537ef1d15f02a47d401788b03e7ea466cfe 🔍
SSDeep 49152:TYt5w7VhGMiv2DtfqBfMRgLwcGuuRFvhl:TYt5w7VGv2DtfsA7cGuu7vh 🔍
Imports Hash e5fd6c75030a39603cf44cad39b49784 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Sep-03 22:20:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x22800
SizeOfInitializedData 0x14a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008810 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 32d30f448548776fc2975ef163478e34 🔍
SHA1 e922d0e7878eb88b8d7b00e9e1461089157086e9 🔍
SHA256 0a994a69ff5dba8540af3ee0eb8e2f67f4860b05d37770910929cadce1fca959 🔍
SHA3 0f0dae5695245d39829a7a31c6da18e3c4a771ffd27fd40c1495375ce3aee6ae 🔍
VirtualSize 0x22750
VirtualAddress 0x1000
SizeOfRawData 0x22800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46992

.rdata

MD5 df96263119ab098dd07ddc244f5a67e7 🔍
SHA1 858ed1839075d8da4cc8769f8d7eda29f8ef9d75 🔍
SHA256 c6eb14b6c4698e02bb9e85f8fee19bc9ce9bf724edd537bb46487749d56bfa21 🔍
SHA3 cf78b598a0462b1b5be8ab49c0baa44707cba8769f7c3636d73254b353c2bd7b 🔍
VirtualSize 0x10b52
VirtualAddress 0x24000
SizeOfRawData 0x10c00
PointerToRawData 0x22c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.21106

.data

MD5 73b555185a50b80df9cec85c882422c0 🔍
SHA1 53645457980ac9494c06b744862487639da200a3 🔍
SHA256 16f56aa899562993f7df0c5c1ecfc5e6ed6c8f48b3204c6b82a3fe3ffa5ff07b 🔍
SHA3 64a5f2bef0f935dd4e97ff943050e13e0b1e92e88f642cde3ad5f8a45bfc7d10 🔍
VirtualSize 0x17e8
VirtualAddress 0x35000
SizeOfRawData 0xc00
PointerToRawData 0x33800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.23416

.pdata

MD5 b94d84ae002d928b47951922fcd02aec 🔍
SHA1 36f9e48323476acfe1d1d4761442f8ddc9a4695f 🔍
SHA256 b2b46ade2ca4c284ce91beb5a7d29fa44c3d6fb4ab708b7dafed71ff4770e311 🔍
SHA3 3ca88d2babd4102beef2a5a80111853b87d21fbd2932dbe0bc1a17dd2927dfcb 🔍
VirtualSize 0x1b54
VirtualAddress 0x37000
SizeOfRawData 0x1c00
PointerToRawData 0x34400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.27849

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x39000
SizeOfRawData 0x200
PointerToRawData 0x36000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 446bd0c253afbaa1cebb58fe49838ece 🔍
SHA1 b972797ffccd3edd41ddb8f50de2ea67221e3d94 🔍
SHA256 a6297219795cce29b974bd3b8ed0d5fda80d1eb68035333077e889b8284d9883 🔍
SHA3 d43e6803da20f59553cc5e5c296b32bcebc457226674884e3acef6a1bc5e664a 🔍
VirtualSize 0x6c0
VirtualAddress 0x3a000
SizeOfRawData 0x800
PointerToRawData 0x36200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.02778

Imports

bcrypt.dll BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
COMDLG32.dll GetOpenFileNameW
ole32.dll CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
SHELL32.dll ShellExecuteExW
SHCreateItemFromParsingName
ADVAPI32.dll OpenProcessToken
GetTokenInformation
dxgi.dll CreateDXGIFactory1
KERNEL32.dll GetProcessHeap
HeapSize
HeapReAlloc
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
WriteConsoleW
GetStringTypeW
FlsFree
GetOEMCP
GetACP
CreateFileW
CloseHandle
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
GetCurrentProcess
WaitForSingleObject
GetExitCodeProcess
LoadLibraryW
FreeLibrary
CreateProcessW
LoadLibraryExW
FindResourceW
LoadResource
LockResource
SizeofResource
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetStdHandle
WriteFile
ExitProcess
TerminateProcess
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
ReadFile
GetConsoleMode
ReadConsoleW
HeapFree
GetFileType
HeapAlloc
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-03 22:20:00
Version 0.0
SizeofData 816
AddressOfRawData 0x311bc
PointerToRawData 0x2fdbc

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400350c0

RICH Header

XOR Key 0x13c93879
Unmarked objects 0
C++ objects (33145) 153
ASM objects (33145) 7
ASM objects (35403) 10
C objects (35403) 16
C++ objects (35403) 43
C objects (33145) 13
Imports (33145) 15
Total imports 115
Unmarked objects (#2) 1
Linker (35727) 1

Errors

Leave a comment

No comments yet.