Manalyze report for 36345b5ab9d83622c1b957d5c48661a2

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2021-Nov-02 18:36:49
Comments
CompanyName
FileDescription	PUT Revamp
FileVersion	`1.0.0.0`
InternalName	PUT.exe
LegalCopyright	Copyright © 2021
LegalTrademarks
OriginalFilename	PUT.exe
ProductName	PUT Revamp
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: %temp% CurrentControlSet\Services` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` `Contains domain names: Battle.net https://keyauth.business https://www.w3schools.com https://www.w3schools.com/charsets/ref_utf_symbols.asp https://www.youtube.com https://www.youtube.com/watch?v w3schools.com www.w3schools.com www.youtube.com youtube.com`
Suspicious	This PE is packed with VMProtect	`Unusual section name found: .vmp0` `Unusual section name found: .vmp1` `The PE only has 0 import(s).`
Malicious	VirusTotal score: 24/68 (Scanned on 2021-11-07 19:02:08)	`Lionic: Hacktool.Win64.KernelDrUtil.3!c` `Elastic: malicious (high confidence)` `FireEye: Generic.mg.36345b5ab9d83622` `McAfee: Artemis!36345B5AB9D8` `Cylance: Unsafe` `K7AntiVirus: Trojan ( 00574e2d1 )` `Alibaba: Packed:MSIL/VMProtect.ee6b58c8` `K7GW: Trojan ( 00574e2d1 )` `Cybereason: malicious.089e76` `Symantec: Trojan.Gen.MBT` `ESET-NOD32: a variant of MSIL/Packed.VMProtect.C suspicious` `APEX: Malicious` `Paloalto: generic.ml` `Kaspersky: UDS:HackTool.Win64.KernelDrUtil.gen` `Avast: Win64:Malware-gen` `McAfee-GW-Edition: BehavesLike.Win64.TrojanDridex.vc` `Sophos: Mal/VMProtBad-A` `SentinelOne: Static AI - Malicious PE` `Microsoft: Trojan:Win32/Sabsik.FL.B!ml` `TrendMicro-HouseCall: TROJ_GEN.R002H07K521` `Ikarus: Trojan.MSIL.Vmprotect` `MaxSecure: Trojan.Malware.300983.susgen` `AVG: Win64:Malware-gen` `CrowdStrike: win/malicious_confidence_60% (W)`

Hashes

MD5	`36345b5ab9d83622c1b957d5c48661a2`
SHA1	`fd8b524089e76f875a7f7a6cce6d59fa3daa18b7`
SHA256	`3f70cbebc4eb4a409597217200d6bee7bc9c9ec791bdf9de51272d45fbc006a6`
SHA3	`c6ffcce2691047b10eb356286e55cb9f5bdeaa4fc0d125e83a9101ad4f868db5`
SSDeep	`393216:GQ5fm9FPeyqw3r5ibnrgbnrAbnrnk/8LHW5sbnrubnr:P0f39ynonong2HI4nyn`
Imports Hash	`d41d8cd98f00b204e9800998ecf8427e`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`4`
TimeDateStamp	2021-Nov-02 18:36:49
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`48.0`
SizeOfCode	`0x910600`
SizeOfInitializedData	`0x3e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000000000 (Section: ?)`
BaseOfCode	`0x2000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x177a000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x400000`
SizeofStackCommit	`0x4000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x2000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x910434`
VirtualAddress	`0x2000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.vmp0

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x574`
VirtualAddress	`0x914000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.vmp1

MD5	`8b62229b76ab06979fa452e7c09ad5cc`
SHA1	`87983d7347011969e048a0dc3933a4c06497ca70`
SHA256	`427b9fed79a38a174abfbaeb32f8f43482e454d175ba5564d72886c0547a85a5`
SHA3	`501d45660bfa1b1ee3b18fd6db7687f4e7d0b2d677e9e03107bb5cb597439b1a`
VirtualSize	`0xe5ead8`
VirtualAddress	`0x916000`
SizeOfRawData	`0xe5ec00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.90189`

.rsrc

MD5	`a3b0f6a67e9e3cca23ee0c33cf271ddb`
SHA1	`2f2dcddbb3ea77add40d0f25151d022412be1045`
SHA256	`b54879d48e00c2c6e6545ee2f377102ac8665219f48b90e662e5e43a6d6476c5`
SHA3	`1f471835766c13935da525427b66bde7f350cf7889f5f97d78adf5d7c1206c53`
VirtualSize	`0x3d44`
VirtualAddress	`0x1776000`
SizeOfRawData	`0x3e00`
PointerToRawData	`0xe5f000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.51672`

Imports

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2ba5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.92622`
Detected Filetype	PNG graphic file
MD5	`2ada43679f7ec890285d00b5b2dfd3b1`
SHA1	`70d70a09d826682f52a064ad4f41415812c75301`
SHA256	`10d183f6e02c393d08364e639d5387f9105d898babdac1724f95e6e0ab739d5b`
SHA3	`98411cfed3279d10ef4c16d9439457488c41e4d2b0ed1643f5617d75b03354b3`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.51664`
Detected Filetype	Icon file
MD5	`ce7ba223db53b4b69ad8f80602a0ca10`
SHA1	`5dc931ed6aecce30a8e27d711f93c5a17cb92f14`
SHA256	`3bfe5959c2766afda380483fb91bdc33eb5b538a5235354852ae5ccdc3c726bd`
SHA3	`b2a63841da539d43008a34e8c7177460fc0f73aaf4216433fb857d3d277f2f38`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x30c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.2759`
MD5	`88a123d46530b40b7e59eea5363e389e`
SHA1	`80787aa3cd5aa60295ecc508553ac7f0fcccf35f`
SHA256	`0f589b45af28bf6e75250cae2249107277a670468ffa4722b7731570691853a3`
SHA3	`68e739bfebe732112383602750932e0cba06657f6341b99c402980faa9dd2cbc`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xd48`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.02461`
MD5	`c39c3c6d5ef5d4cabdf0d7e4f6d826ba`
SHA1	`40cdc3a9b8b92f04691e3ec651c96710e9414382`
SHA256	`3a6bb60fe825f5cdb853954a29fd924d6af34689feaece17e455c8fc5a86b639`
SHA3	`2db34c5d223b1308eacc4268b2656c2ee67b330bf8fa0969ea6d3fa3b5e63525`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	PUT Revamp
FileVersion (#2)	1.0.0.0
InternalName	PUT.exe
LegalCopyright	Copyright © 2021
LegalTrademarks
OriginalFilename	PUT.exe
ProductName	PUT Revamp
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .text has a size of 0!
[*] Warning: Section .vmp0 has a size of 0!