Manalyze report for 323954c2c3f79b02d718ca0ff8fe6020fe37d3a29e969840eed6b27d4f15dd0c

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2009-Dec-18 06:52:33
Detected languages	English - United States

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Looks for VirtualPC presence: 0f 3f 07 0b` `Contains another PE executable: This program cannot be run in DOS mode.` `Contains domain names: oreans.com`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to AES`
Suspicious	The PE is possibly packed.	`Unusual section name found: \x00` `Section \x00 is both writable and executable.` `Unusual section name found: .Tut4you` `Unusual section name found:` `Section is both writable and executable.` `Unusual section name found: qwpneuhm` `Section qwpneuhm is both writable and executable.` `Unusual section name found: hvhfnuxi` `Section hvhfnuxi is both writable and executable.` `Unusual section name found: PE_ADS` `Section PE_ADS is both writable and executable.`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect`
Malicious	VirusTotal score: 46/69 (Scanned on 2025-03-23 00:44:52)	`ALYac: Gen:Trojan.Heur.GM.0000036082` `APEX: Malicious` `Alibaba: Trojan:Win32/Generic.68cc9b67` `Antiy-AVL: Trojan/Win32.TSGeneric` `Arcabit: Trojan.Heur.GM.D8CF2` `Avira: TR/Crypt.XPACK.Gen` `BitDefender: Gen:Trojan.Heur.GM.0000036082` `CAT-QuickHeal: Trojan.Ghanarava.1632157492c834d7` `CTX: exe.trojan.generic` `CrowdStrike: win/malicious_confidence_70% (W)` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `ESET-NOD32: a variant of Generik.CQMCHBI` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Trojan.Heur.GM.0000036082 (B)` `F-Secure: Trojan.TR/Crypt.XPACK.Gen` `FireEye: Generic.mg.f252963de02be887` `Fortinet: PossibleThreat` `GData: Gen:Trojan.Heur.GM.0000036082` `Google: Detected` `Gridinsoft: Trojan.Heur!.03810021` `Ikarus: Backdoor.Rbot` `K7AntiVirus: Riskware ( 0040eff71 )` `K7GW: Riskware ( 0040eff71 )` `Kaspersky: UDS:DangerousObject.Multi.Generic` `Kingsoft: Win32.HeurC.KVMH008.a` `Lionic: Trojan.Multi.Generic.4!c` `McAfee: Artemis!F252963DE02B` `McAfeeD: ti!323954C2C3F7` `MicroWorld-eScan: Gen:Trojan.Heur.GM.0000036082` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Paloalto: generic.ml` `Rising: Trojan.Zpevdo!8.F912 (CLOUD)` `Sangfor: Trojan.Win32.XPACK.Gen` `SentinelOne: Static AI - Suspicious PE` `Skyhigh: BehavesLike.Win32.Generic.vc` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `Tencent: Win32.Trojan.Crypt.Adhl` `Trapmine: suspicious.low.ml.score` `VBA32: BScope.Trojan.MulDrop` `VIPRE: Gen:Trojan.Heur.GM.0000036082` `Zillya: Trojan.Heur.Win32.5928` `Zoner: Probably Heur.ExeHeaderL` `tehtris: Generic.Malware`

Hashes

MD5	`f252963de02be8876aa851e1b5c834d7` 🔍
SHA1	`fb5e618212fa1d040be6b0c7fb14c2a5463f9227` 🔍
SHA256	`323954c2c3f79b02d718ca0ff8fe6020fe37d3a29e969840eed6b27d4f15dd0c` 🔍
SHA3	`b5bf265c9512ad226417df8c1e13058dad5bd1403db223775907760962aae039` 🔍
SSDeep	`98304:CLctUuuXIdjEnjCoV74ZXwJugPNtcLwE7Fsuyqhspu8kQJfhk:CoZjEnjCi74ZXKncp7FXLhs8/QJ` 🔍
Imports Hash	`29959d14dfd7a368f447647d38fd8e80` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0x7506`
e_oeminfo	`0x4898`
e_lfanew	`0x40`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`7`
TimeDateStamp	2009-Dec-18 06:52:33
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`9.0`
SizeOfCode	`0x3da00`
SizeOfInitializedData	`0x32800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x03E21600 (Section: PE_ADS)`
BaseOfCode	`0x1000`
BaseOfData	`0x3f000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`5.0`
ImageVersion	`0.0`
SubsystemVersion	`5.0`
Win32VersionValue	`0`
SizeOfImage	`0x3e26000`
SizeOfHeaders	`0x400`
Checksum	`0x6ab85a`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

\x00

MD5	`4158c1a01880822598e54a75192ef109 🔍`
SHA1	`9bb13a5bbda2cb60b677db1d262add0e5d1ec588 🔍`
SHA256	`76b80f84fc6a1e2018933ffa1fa56d0302e822962319d2fafd22aea315aa3bc7 🔍`
SHA3	`47d84f29a7d8163b044cc6d6e46075751de3f703c8e98c35c982a13ee6fbc80d 🔍`
VirtualSize	`0x3111000`
VirtualAddress	`0x1000`
SizeOfRawData	`0x5e000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.85922`

.rsrc

MD5	`172df2ee549c548bee261cdbac9145c9 🔍`
SHA1	`2252bfa64da20aceac98be4df77dc41424d2d480 🔍`
SHA256	`83c7866190eeebefbddb5ca9aa2f73975770f64bc17a808f2bf3c4a513ed786d 🔍`
SHA3	`9675d4b7d81dd3d556903dbba40b0d346eed1208fc2767acfac1e535a5eff642 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x3112000`
SizeOfRawData	`0x200`
PointerToRawData	`0x5e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.49551`

.Tut4you

MD5	`0ba3ff50c8dec354a9af17337e823237 🔍`
SHA1	`fa55a246896cb15e284d0a9f85e742b550546607 🔍`
SHA256	`7035e92be53f68411c9e4bde7af0d98aaeee91a508124eaa8bf2cb34952c8486 🔍`
SHA3	`f7862ceef97995dd9a9a1a259ee8e5f2fb7dfa71a82a5263faf73a499cc526d6 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x3113000`
SizeOfRawData	`0x200`
PointerToRawData	`0x5e600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.797562`

MD5	`2d37e9174e671ed5c729174cbf521fee 🔍`
SHA1	`6a9ffc0054711f8ad3a1a9c39e3a9269214d7094 🔍`
SHA256	`837976ab15c46a367b5601a6f9a4d82d21b75e899722e08d73a67d75d65b0d59 🔍`
SHA3	`dd4347e2fd1186dfd27350b200484dc0c99aebaeedb9ed020c752b502d52aa68 🔍`
VirtualSize	`0x426000`
VirtualAddress	`0x3114000`
SizeOfRawData	`0x425a00`
PointerToRawData	`0x5e800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.45291`

qwpneuhm

MD5	`4710007aae07af184fa86542201d2ce8 🔍`
SHA1	`3afb91a9ecac44a4d63d8ae8943d8b88757298ab 🔍`
SHA256	`25cbf7a14674a05bb17fafd98c563089c8a9199d0ee918b083bbe710082f1fa0 🔍`
SHA3	`8c785915e96f393d7b76296c1a5cbc21951aaaa0b905a721ed0a65edd2053fa5 🔍`
VirtualSize	`0x221000`
VirtualAddress	`0x353a000`
SizeOfRawData	`0x220c00`
PointerToRawData	`0x484200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.93349`

hvhfnuxi

MD5	`ba388350f72a6f2cd41db6668212f2bc 🔍`
SHA1	`db072163ac779d45a8909b832aa79ba945e49ac3 🔍`
SHA256	`544eaa6c3523bb6c27a4f0c7d28debd68980dcc294d967abc38b9195e7aa2e7f 🔍`
SHA3	`9f54971ad525ce64c361b7d19ca4ef8b188423100c08457b3bdeb894aa649dd6 🔍`
VirtualSize	`0x6c5000`
VirtualAddress	`0x375b000`
SizeOfRawData	`0x400`
PointerToRawData	`0x6a4e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.60923`

PE_ADS

MD5	`15abc1f0f99bcf486e4b50c555be8f9d 🔍`
SHA1	`c2831cd01bb54394aa0d54ab64687b281c5ea187 🔍`
SHA256	`5f4101cacebd28aaffb1d0ed55cb68fa7e9941e0c9ba971089fa9016a9799faf 🔍`
SHA3	`4b3362aaaf9fda722408d4f0a7876f844388cb8d6f045fec1e5ccbc2ac480f56 🔍`
VirtualSize	`0x6000`
VirtualAddress	`0x3e20000`
SizeOfRawData	`0x5000`
PointerToRawData	`0x6a5200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.84592`

Imports

kernel32.dll	`PeekNamedPipe`
kernel32.dll (#2)	`PeekNamedPipe`
kernel32.dll (#3)	`PeekNamedPipe`
kernel32.dll (#4)	`PeekNamedPipe`
kernel32.dll (#5)	`PeekNamedPipe`
kernel32.dll (#6)	`PeekNamedPipe`
kernel32.dll (#7)	`PeekNamedPipe`
kernel32.dll (#8)	`PeekNamedPipe`
kernel32.dll (#9)	`PeekNamedPipe`
kernel32.dll (#10)	`PeekNamedPipe`
kernel32.dll (#11)	`PeekNamedPipe`
kernel32.dll (#12)	`PeekNamedPipe`
kernel32.dll (#13)	`PeekNamedPipe`
kernel32.dll (#14)	`PeekNamedPipe`
kernel32.dll (#15)	`PeekNamedPipe`
kernel32.dll (#16)	`PeekNamedPipe`
kernel32.dll (#17)	`PeekNamedPipe`
kernel32.dll (#18)	`PeekNamedPipe`
kernel32.dll (#19)	`PeekNamedPipe`
kernel32.dll (#20)	`PeekNamedPipe`
kernel32.dll (#21)	`PeekNamedPipe`
kernel32.dll (#22)	`PeekNamedPipe`
kernel32.dll (#23)	`PeekNamedPipe`
kernel32.dll (#24)	`PeekNamedPipe`
kernel32.dll (#25)	`PeekNamedPipe`
kernel32.dll (#26)	`PeekNamedPipe`
kernel32.dll (#27)	`PeekNamedPipe`
kernel32.dll (#28)	`PeekNamedPipe`
kernel32.dll (#29)	`PeekNamedPipe`
kernel32.dll (#30)	`PeekNamedPipe`
kernel32.dll (#31)	`PeekNamedPipe`
kernel32.dll (#32)	`PeekNamedPipe`
kernel32.dll (#33)	`PeekNamedPipe`
kernel32.dll (#34)	`PeekNamedPipe`
kernel32.dll (#35)	`PeekNamedPipe`
kernel32.dll (#36)	`PeekNamedPipe`
kernel32.dll (#37)	`PeekNamedPipe`
kernel32.dll (#38)	`PeekNamedPipe`
kernel32.dll (#39)	`PeekNamedPipe`
kernel32.dll (#40)	`PeekNamedPipe`
kernel32.dll (#41)	`PeekNamedPipe`
kernel32.dll (#42)	`PeekNamedPipe`
kernel32.dll (#43)	`PeekNamedPipe`
kernel32.dll (#44)	`PeekNamedPipe`
kernel32.dll (#45)	`PeekNamedPipe`
kernel32.dll (#46)	`PeekNamedPipe`
kernel32.dll (#47)	`PeekNamedPipe`
kernel32.dll (#48)	`PeekNamedPipe`
kernel32.dll (#49)	`PeekNamedPipe`
kernel32.dll (#50)	`PeekNamedPipe`
kernel32.dll (#51)	`PeekNamedPipe`
kernel32.dll (#52)	`PeekNamedPipe`
kernel32.dll (#53)	`PeekNamedPipe`
kernel32.dll (#54)	`PeekNamedPipe`
kernel32.dll (#55)	`PeekNamedPipe`
kernel32.dll (#56)	`PeekNamedPipe`
kernel32.dll (#57)	`PeekNamedPipe`
kernel32.dll (#58)	`PeekNamedPipe`
kernel32.dll (#59)	`PeekNamedPipe`
kernel32.dll (#60)	`PeekNamedPipe`
kernel32.dll (#61)	`PeekNamedPipe`
kernel32.dll (#62)	`PeekNamedPipe`
kernel32.dll (#63)	`PeekNamedPipe`
kernel32.dll (#64)	`PeekNamedPipe`
kernel32.dll (#65)	`PeekNamedPipe`
kernel32.dll (#66)	`PeekNamedPipe`
kernel32.dll (#67)	`PeekNamedPipe`
kernel32.dll (#68)	`PeekNamedPipe`
kernel32.dll (#69)	`PeekNamedPipe`
kernel32.dll (#70)	`PeekNamedPipe`
kernel32.dll (#71)	`PeekNamedPipe`
kernel32.dll (#72)	`PeekNamedPipe`
kernel32.dll (#73)	`PeekNamedPipe`
kernel32.dll (#74)	`PeekNamedPipe`
kernel32.dll (#75)	`PeekNamedPipe`
kernel32.dll (#76)	`PeekNamedPipe`
kernel32.dll (#77)	`PeekNamedPipe`
kernel32.dll (#78)	`PeekNamedPipe`
kernel32.dll (#79)	`PeekNamedPipe`
kernel32.dll (#80)	`PeekNamedPipe`
kernel32.dll (#81)	`PeekNamedPipe`
kernel32.dll (#82)	`PeekNamedPipe`
kernel32.dll (#83)	`PeekNamedPipe`
kernel32.dll (#84)	`PeekNamedPipe`
kernel32.dll (#85)	`PeekNamedPipe`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x15a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.79597`
MD5	`24d3b502e1846356b0263f945ddd5529 🔍`
SHA1	`bac45b86a9c48fc3756a46809c101570d349737d 🔍`
SHA256	`49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e 🔍`
SHA3	`1244ed60820da52dc4b53880ec48e3b587dbdbd9545f01fa2b1c0fcfea1d5e9e 🔍`

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.