| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-May-09 04:45:59 |
| Detected languages |
English - United States
Russian - Russia |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .itext
Unusual section name found: .10 Unusual section name found: .11 |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | The binary may have been compiled on a machine in the UTC+3 timezone. |
| Malicious | VirusTotal score: 49/72 (Scanned on 2024-04-01 07:46:09) |
ALYac:
Gen:Variant.Fragtor.11325
APEX: Malicious Antiy-AVL: Trojan/Win32.Wacatac Arcabit: Trojan.Fragtor.D2C3D BitDefender: Gen:Variant.Fragtor.11325 BitDefenderTheta: Gen:NN.ZexaF.36802.ZRW@aeixG1jc Bkav: W32.AIDetectMalware CAT-QuickHeal: PUA.IgenericIH.S27829811 CrowdStrike: win/malicious_confidence_70% (W) Cybereason: malicious.3953f4 Cylance: unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: a variant of Win32/RiskWare.GameHack.CJ.gen Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Fragtor.11325 (B) FireEye: Generic.mg.3e5bcae3953f4313 Fortinet: Riskware/GameHack GData: Gen:Variant.Fragtor.11325 Google: Detected Gridinsoft: Trojan.Heur!.02296421 K7AntiVirus: Riskware ( 00552d9b1 ) K7GW: Riskware ( 00552d9b1 ) Kingsoft: win32.heurc.kvmh017.a Lionic: Trojan.Win32.GameHack.4!c MAX: malware (ai score=88) Malwarebytes: Generic.Malware.AI.DDS MaxSecure: Trojan.Malware.300983.susgen McAfee: GenericRXLB-HF!3E5BCAE3953F MicroWorld-eScan: Gen:Variant.Fragtor.11325 Microsoft: PUA:Win32/GameHack Rising: Trojan.Generic@AI.100 (RDML:1JCU24DbqekXys3q1H6PTg) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Generic.wc Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.10bde5b9 Trapmine: suspicious.low.ml.score TrendMicro: TROJ_GEN.R002C0PK723 TrendMicro-HouseCall: TROJ_GEN.R002C0PK723 VBA32: TScope.Malware-Cryptor.SB VIPRE: Gen:Variant.Fragtor.11325 Varist: W32/ABApplication.ALKI-5962 ViRobot: Adware.GameHack.3996160 Xcitium: Malware@#zq4oh74w2cz9 Yandex: RiskWare.GameHack!m2EWtd4GsBM Zillya: Tool.Gamehack.Win32.29 alibabacloud: RiskWare:Win/Gamehack.93563590 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 10 |
| TimeDateStamp | 2020-May-09 04:45:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x3ea00 |
| SizeOfInitializedData | 0xcc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x003A5751 (Section: .11) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x41000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x651000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| oleaut32.dll |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
|---|---|
| advapi32.dll |
RegQueryValueExW
RegOpenKeyExW RegCloseKey |
| user32.dll |
LoadStringW
MessageBoxA CharNextW |
| kernel32.dll |
lstrcmpiA
LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle |
| kernel32.dll (#2) |
lstrcmpiA
LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle |
| user32.dll (#2) |
LoadStringW
MessageBoxA CharNextW |
| kernel32.dll (#3) |
lstrcmpiA
LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle |
| advapi32.dll (#2) |
RegQueryValueExW
RegOpenKeyExW RegCloseKey |
| kernel32.dll (#4) |
lstrcmpiA
LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle |
| oleaut32.dll (#2) |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
| WTSAPI32.dll |
WTSSendMessageW
|
| kernel32.dll (#5) |
lstrcmpiA
LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle |
| user32.dll (#3) |
LoadStringW
MessageBoxA CharNextW |
| kernel32.dll (#6) |
lstrcmpiA
LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle |
| user32.dll (#4) |
LoadStringW
MessageBoxA CharNextW |