431414f39121f70e75aec13926710d46

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2018-Sep-04 14:38:49

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • #14
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 4881422 bytes of data starting at offset 0x4ec00.
The overlay data has an entropy of 7.9981 and is possibly compressed or encrypted.
Overlay data amounts for 93.8017% of the executable.
Suspicious VirusTotal score: 1/70 (Scanned on 2020-10-17 07:57:10) APEX: Malicious

Hashes

MD5 431414f39121f70e75aec13926710d46
SHA1 7bd9071834d62864ca4e9e2247eae2cdfebb241b
SHA256 14636675763f7395cce81f1ed350b38956813202fc79086d641ced9c4a1c61c1
SHA3 4d259f3b54f5a8232748cb934586f55ebcf586fa98026a982c399fa6bf8f3621
SSDeep 98304:NleTHZvdIWXe+q2WWmQanh+oFAZTAxidupkxk/cSJGbtrDD3ywt9:Nl6Zd9e+q2WWmQqh+ZZREEkp4tr3nt9
Imports Hash 76624002d6ae7190ccd07ceecb1695a4

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2018-Sep-04 14:38:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21400
SizeOfInitializedData 0x2d400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000088C4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x62000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 419af5a9591017da90193d944a5a6ce6
SHA1 65ed9ec99532211386455a8b3828abd73f0dabab
SHA256 f0f9506a677658b3274080172e87ca15d62c0c50866474da8d82066962bca460
SHA3 ef8f89b371b8c3ed354e6bf4b6a3010e68ec84765aa77697305551196f3c24fe
VirtualSize 0x21290
VirtualAddress 0x1000
SizeOfRawData 0x21400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45423

.rdata

MD5 c990e9c31199dbc56ba4aff0d48de63c
SHA1 7cbe91a35e7f3e71854ecac019b9833d62048352
SHA256 fc26b8cd66d42dc558bd3bda6ff38ab0753f79ce7c8e01aed80d51c33c2957db
SHA3 9523dfe0554bd726821a1f7b8e3b091f7fed973752df0b65510d0de86210250f
VirtualSize 0xf3c8
VirtualAddress 0x23000
SizeOfRawData 0xf400
PointerToRawData 0x21800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.85572

.data

MD5 c229bcbda01da0475768ccb43a6d6ddc
SHA1 32eb208e5b8e467c0c25069f75d8db61340100ad
SHA256 26bf1ce7ad18845c908dcf49ef396c989a6f94a6bb67f7898878fd045933cff6
SHA3 601c43a883b10f3c4c457560251f2c82bf330412fcae5a2c1b596730823b01c6
VirtualSize 0xf108
VirtualAddress 0x33000
SizeOfRawData 0xc00
PointerToRawData 0x30c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.84446

.pdata

MD5 e6c0c78f4d38e1def1c885085e6f59e8
SHA1 19c33c9411a2eb6c8e02ce71a40494bd51002ae4
SHA256 56fdd84ab3b765004b7a319f3dc285c8dc18aa683d0bfb1ac8074e39d853a0ae
SHA3 c362318598c4b7de3ccc306c7877304c948ba719d3f50026c90f055afdc99043
VirtualSize 0x1d04
VirtualAddress 0x43000
SizeOfRawData 0x1e00
PointerToRawData 0x31800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.21764

.gfids

MD5 da10071e4a0a1c855add844fee84e2b0
SHA1 43e9a778efcf8b8d239786c0827a99c058eca543
SHA256 94833d6dc96207f779fa8db0e17cc569622190c1be8c945cf37aad7000621b32
SHA3 fde1a5e4420da6afa739d61ca2f1923cf720ebb610cd466e503b761ab912f2c9
VirtualSize 0xac
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x33600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.68983

.rsrc

MD5 67bd45a6e044944bf3c07d2a1764998b
SHA1 21a33052538649a5c1f007d789145b409c9dd699
SHA256 edec0ef2fc04f77814785e7ff7ef9f49878c1f33bcbd1f941a71268b827a7b55
SHA3 8f10ad2270101167518b1ff385e689fe0e45a26f6af66f2f7133e0dc6d478896
VirtualSize 0x1aa58
VirtualAddress 0x46000
SizeOfRawData 0x1ac00
PointerToRawData 0x33800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.89217

.reloc

MD5 a863830437d17bfa07f80f1311f3452b
SHA1 3bc934f3c394ff2fb27c5d360d2331c3ecf1dc63
SHA256 a83862f8f2c8af3f1b0491be6b8f8b3a45b7b65e8386a648f48fa9f6cf48e845
SHA3 6f6b69bba6ae5aa4792311989953ff4a1872ea83b93548db3fb07214b6c7d3ed
VirtualSize 0x698
VirtualAddress 0x61000
SizeOfRawData 0x800
PointerToRawData 0x4e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.99579

Imports

KERNEL32.dll GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
WS2_32.dll #14

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1e31
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9182
Detected Filetype PNG graphic file
MD5 50c7da4df9a7b3ba0fa9743a80af68af
SHA1 d485002afec6b9436b1bb6ed6564f84525b93a81
SHA256 39a49b7c8b742db05ab81aa195034b31e815e0d043f2dc814cb2fa4160bfcaec
SHA3 e4f83fa86a71f168a7d90fa2d289d8bc9cd0112021bd05312bb7db4b296632ac

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.09484
MD5 71e699b05cef983d71891e563d2c6d4d
SHA1 ea273afd3b85a69d312e78cc91547399288f89cf
SHA256 b322db54e5825f1d18a97902684bd38e62651d6cbe5efcc1458d789a24bb5e75
SHA3 3a40a3e3135bec075da3840fb259c2af0a4e9439f9f994e2b742e2b18aa4f1df

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29637
MD5 3f3622977eb1e696de65e95f24964587
SHA1 b5d01ce4924c92df86342770f10a4ac2ae23c0df
SHA256 bc8ba3cd198b61127dce381f6ee018b090c9649d8a34f72877e26c1b6de58395
SHA3 33f7e919c63c271ac24418f812009d0bd43a312f2bdd401da7225310f4b92053

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44874
MD5 27bf2fa45ade6ff1dc0e14874ea02501
SHA1 18194fa710cd1879777c70a0e35b6fb4bc6f9e4e
SHA256 99fe2c4f7f89eb8d12fd13ff5d6a648c405d66f8e3de0541a2b338009a978700
SHA3 0029b97bf920e819733f92a23b7134e525b16aca9c0b4dbcaecb9f3154dd36a5

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.61553
MD5 a460936f21f652161558d5edef74075e
SHA1 db5c1dc86dd43c8ad2297d62a182f99f0dc42327
SHA256 829bd5e526dc3eeb1683bf55f3059affc1e068dc44c8e44832bbe709d5c34570
SHA3 3f1f46199529b3220fae017cd0125797f7c669d3dd98a6513b97d0fb7ea586e1

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94895
MD5 d18416cca2d7d46354708239be37f660
SHA1 f383a50328c174056b6cca75f8238a3905c6a229
SHA256 2b881a98d252e1ecc7e1ab786e57942699ee9f6ea348f1a65949a985251e7e01
SHA3 666deaf6577261a9b26231124b305f5b3b230cb5b67d64bc83555d523a3eae48

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 595aeb93ed3d4918e501b9aa4701c633
SHA1 2435bb648cbf85fba8089529387fe5330993468c
SHA256 b05e3394fef8722d635bcd9a7c3bfefe7728b1a514152b4b837082c51e2ba7e5
SHA3 8c37802d01363a33bc566b38a45eb3d265a62036030d65fe9d59d009aef5ec81

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2018-Sep-04 14:38:49
Version 0.0
SizeofData 720
AddressOfRawData 0x2fa78
PointerToRawData 0x2e278

TLS Callbacks

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140033010

RICH Header

XOR Key 0x2165d1bb
Unmarked objects 0
241 (40116) 7
243 (40116) 170
242 (40116) 13
ASM objects (VS2015 UPD3 build 24123) 7
C++ objects (VS2015 UPD3 build 24123) 28
C objects (VS2015 UPD3 build 24123) 19
Imports (65501) 5
Total imports 114
C objects (VS2015 UPD3 build 24210) 17
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors

<-- -->