| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Mar-25 06:45:04 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains a base64-encoded executable:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. | 8037666 bytes of data starting at offset 0x2efc00. |
| Malicious | VirusTotal score: 58/72 (Scanned on 2024-02-15 19:05:00) |
ALYac:
Gen:Trojan.ProcessHijack.@xZ@aCm7D8oi
APEX: Malicious AVG: Win32:DropperX-gen [Drp] AhnLab-V3: Trojan/Win.Redcap.C4412879 Alibaba: Worm:Win32/Antavmu.0f633d85 Antiy-AVL: Trojan/Win32.Antavmu Arcabit: Trojan.ProcessHijack.EE667E Avast: Win32:DropperX-gen [Drp] Avira: HEUR/AGEN.1353317 BitDefender: Gen:Trojan.ProcessHijack.@xZ@aCm7D8oi Bkav: W32.AIDetectMalware CrowdStrike: win/malicious_confidence_100% (W) Cybereason: malicious.d280f8 Cylance: unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.Inject4.10445 ESET-NOD32: Win32/Agent.OIM Elastic: malicious (high confidence) Emsisoft: Gen:Trojan.ProcessHijack.@xZ@aCm7D8oi (B) F-Secure: Heuristic.HEUR/AGEN.1353317 FireEye: Generic.mg.375c8b2de50390fa Fortinet: W32/Agent.OIM!worm GData: Gen:Trojan.ProcessHijack.@xZ@aCm7D8oi Google: Detected Gridinsoft: Ransom.Win32.Wacatac.oa!s1 Ikarus: Worm.Win32.Agent Jiangmin: Trojan.AntiAV.ehc K7AntiVirus: Riskware ( 0040eff71 ) K7GW: Riskware ( 0040eff71 ) Kaspersky: HEUR:Trojan.Win32.Antavmu.gen Kingsoft: win32.heurc.kvmh017.a Lionic: Trojan.Win32.Antavmu.4!c MAX: malware (ai score=83) Malwarebytes: Generic.Malware/Suspicious MaxSecure: Trojan.Malware.12187866.susgen McAfee: GenericRXOL-EJ!375C8B2DE503 MicroWorld-eScan: Gen:Trojan.ProcessHijack.@xZ@aCm7D8oi Microsoft: Trojan:Win32/Convagent!pz NANO-Antivirus: Trojan.Win32.Antavmu.itxusr Panda: Trj/CI.A Rising: Trojan.Antavmu!8.2A5 (TFE:5:TpEP9eTr5yF) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Generic.vm Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.10bf4502 Trapmine: malicious.moderate.ml.score TrendMicro: TROJ_GEN.R002C0PEO21 TrendMicro-HouseCall: TROJ_GEN.R002C0PEO21 VBA32: BScope.Trojan.Wacatac VIPRE: Gen:Trojan.ProcessHijack.@xZ@aCm7D8oi Varist: W32/Agent.DKX.gen!Eldorado VirIT: Trojan.Win32.Inject4.PLT Yandex: Trojan.Antavmu!VyNOVK6GO5s Zillya: Trojan.Antavmu.Win32.13924 ZoneAlarm: HEUR:Trojan.Win32.Antavmu.gen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2021-Mar-25 06:45:04 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 10.0 |
| SizeOfCode | 0x60600 |
| SizeOfInitializedData | 0x28f200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0005BDDE (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x62000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2f4000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2f179b |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetThreadContext
FindFirstFileW SetThreadContext CreateProcessW WaitForSingleObject GetSystemDirectoryW Sleep ReadProcessMemory TerminateProcess GetLastError GetProcAddress VirtualProtectEx VirtualAllocEx GetLocalTime GetModuleHandleA FindNextFileW CloseHandle WriteProcessMemory ResumeThread EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree IsProcessorFeaturePresent HeapSize GetModuleHandleW ExitProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc LeaveCriticalSection EnterCriticalSection LoadLibraryW RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW |
|---|
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x6e107c |
| SEHandlerTable | 0x6df8f0 |
| SEHandlerCount | 16 |
| XOR Key | 0x1e7a1a2c |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS2010 build 30319) | 16 |
| C objects (VS2010 build 30319) | 70 |
| C++ objects (VS2010 build 30319) | 29 |
| Imports (VS2008 SP1 build 30729) | 5 |
| Total imports | 82 |
| 175 (VS2010 build 30319) | 1 |
| Linker (VS2010 build 30319) | 1 |