| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Dec-27 09:03:48 |
| Detected languages |
English - United States
|
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Suspicious | The PE is packed or was manually edited. | The number of imports reported in the RICH header is inconsistent. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 51/67 (Scanned on 2018-08-08 00:29:45) |
MicroWorld-eScan:
Trojan.GenericKD.30937489
CAT-QuickHeal: Trojan.Multi McAfee: Generic Trojan.i Cylance: Unsafe VIPRE: Trojan.Win32.Generic!BT K7GW: Riskware ( 0040eff71 ) K7AntiVirus: Riskware ( 0040eff71 ) Arcabit: Trojan.Generic.D1D81191 TrendMicro: TROJ_DESBACK.A NANO-Antivirus: Trojan.Win32.Deshacop.exyljh Symantec: Trojan.Olydestroy TrendMicro-HouseCall: TROJ_DESBACK.A Avast: Win32:Malware-gen Kaspersky: Trojan.Win32.Deshacop.gig BitDefender: Trojan.GenericKD.30937489 Paloalto: generic.ml ViRobot: Trojan.Win32.S.Agent.36864.DLR Tencent: Win32.Trojan.Raas.Auto Ad-Aware: Trojan.GenericKD.30937489 Emsisoft: Trojan.GenericKD.30937489 (B) F-Secure: Trojan.GenericKD.30937489 DrWeb: Trojan.KillFiles.62445 Zillya: Trojan.Deshacop.Win32.916 McAfee-GW-Edition: Generic Trojan.i Sophos: Troj/Olydest-B SentinelOne: static engine - malicious Cyren: W32/Trojan.ADHH-4673 Jiangmin: Trojan.Generic.bzhho Webroot: W32.Trojan.Gen Avira: TR/AD.RansomHeur.udtuk Fortinet: W32/OlympicDestroyer.A!tr Antiy-AVL: Trojan/Win32.Deshacop Endgame: malicious (high confidence) Microsoft: Trojan:Win32/Samcrex.A!dha AegisLab: Uds.Dangerousobject.Multi!c ZoneAlarm: Trojan.Win32.Deshacop.gig AhnLab-V3: Backdoor/Win32.PyAgent.C2401827 ALYac: Backdoor.IRCBot.gen AVware: Trojan.Win32.Generic!BT MAX: malware (ai score=100) VBA32: Trojan.Deshacop Malwarebytes: Trojan.OlympicDestroyer.Generic ESET-NOD32: Win32/OlympicDestroyer.A Rising: Trojan.Win32.Destructor!1.B060 (CLOUD) Yandex: Trojan.Deshacop! Ikarus: Trojan-PSW.OlympicDestroyer GData: Trojan.GenericKD.30937489 AVG: Win32:Malware-gen Panda: Generic Malware CrowdStrike: malicious_confidence_100% (W) Qihoo-360: Win32/Trojan.5a2 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2017-Dec-27 09:03:48 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x4c00 |
| SizeOfInitializedData | 0x4000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000198F (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x6000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xd000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x14268 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GlobalAlloc
GetSystemDirectoryW Sleep Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection CreateFileW SetThreadPriority FlushFileBuffers GetFileSizeEx WriteFile GlobalFree FindClose FindNextFileW CloseHandle CreateThread HeapReAlloc GetStringTypeW GetProcessHeap GetCurrentThread WaitForSingleObject HeapFree GetCurrentProcess HeapAlloc CreateProcessW SetFilePointer FindFirstFileW GetLastError ExitProcess MultiByteToWideChar LCMapStringW HeapSize RtlUnwind IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryW GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleW DecodePointer GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent |
|---|---|
| USER32.dll |
wsprintfW
|
| ADVAPI32.dll |
InitiateSystemShutdownExW
AdjustTokenPrivileges EnumServicesStatusW ChangeServiceConfigW LookupPrivilegeValueW OpenServiceW OpenSCManagerW OpenProcessToken CloseServiceHandle QueryServiceConfigW |
| SHLWAPI.dll |
#156
PathAppendW PathRemoveArgsW |
| MPR.dll |
WNetEnumResourceW
WNetAddConnection2W WNetCancelConnection2W WNetOpenEnumW WNetCloseEnum |
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x409004 |
| SEHandlerTable | 0x407b80 |
| SEHandlerCount | 3 |
| XOR Key | 0x2a497f97 |
|---|---|
| Unmarked objects | 0 |
| 12 (7291) | 1 |
| C objects (8047) | 11 |
| 14 (7299) | 5 |
| Linker (8047) | 4 |
| Imports (VS2003 (.NET) build 4035) | 7 |
| Total imports | 77 |
| C++ objects (VS98 SP6 build 8804) | 3 |