44c132dfc3552071244cdb2216da1dcccd73562f6dfb973f0199df2be427696e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-07 19:27:05
Detected languages English - United States

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qeMU
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .YP9
Unusual section name found: .)6.
Unusual section name found: .J^j
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • ShellExecuteA
 Uses Microsoft's cryptographic API:
  • CryptEncrypt
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 34/71 (Scanned on 2026-10-16 15:34:15) APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Trojan.GenericKD.81822664
Bkav: W32.Malware.DCEADAFF
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/Packed.VMProtect.ACT trojan
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.81822664 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: W32/PossibleThreat
GData: Trojan.GenericKD.81822664
Google: Detected
Gridinsoft: Trojan.Heur!.02212023
Malwarebytes: Malware.Heuristic.2108
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!8232A4F47B2F
MicroWorld-eScan: Trojan.GenericKD.81822664
Microsoft: Trojan:Win32/Ravartar!rfn
Paloalto: generic.ml
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.moderate.ml.score
TrellixENS: Artemis!8232A4F47B2F
Varist: W64/ABTrojan.YXQA-7744
alibabacloud: VirTool:Win/Packed.VMProtect.AWB
tehtris: Generic.Malware

Hashes

MD5 8232a4f47b2fc88b2d47d8be757be62e 🔍
SHA1 5986c22eeac369f9d4b49228874a77704f2edf80 🔍
SHA256 44c132dfc3552071244cdb2216da1dcccd73562f6dfb973f0199df2be427696e 🔍
SHA3 6c6d9a9cbe1cae84954aab170b0dd9ee7dbcbf9cec71abf76d518ea9abdbfddf 🔍
SSDeep 196608:A7Tte56GnmNSoHT/t6T/BVSxcHiqhs+L2YMUh2BTxBzsn64i:GReRnmsMTEQxWFLQBTvzsnZi 🔍
Imports Hash c8ca5d08ec3e295f294ed03625411f6e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2026-Oct-07 19:27:05
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xe2000
SizeOfInitializedData 0xd5e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000097E0FC (Section: .J^j)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1169000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xe1f31
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2f7b6
VirtualAddress 0xe3000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x9bed0
VirtualAddress 0x113000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x9930
VirtualAddress 0x1af000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.YP9

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x651cfe
VirtualAddress 0x1b9000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.)6.

MD5 f8afcf9e7186616f58086365b8abc8ba 🔍
SHA1 c069b207201209f43c1fbf355f094dad2b9cb0cc 🔍
SHA256 4124c260cf3469090a9d091a4c817fec799974efef01db94a2d8bd95b542766b 🔍
SHA3 8c52f3bbf3f50232c3c99857ac2cedd48c4d0bf4b46598d6c30678721cee88d1 🔍
VirtualSize 0x1488
VirtualAddress 0x80b000
SizeOfRawData 0x1600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.25851

.J^j

MD5 6ce120e40b8deae66f36f19e4b26bcb0 🔍
SHA1 bcf7ea079ea5dca36bc5fb2af7372a4d2565b3c8 🔍
SHA256 cc55647edda216427fb1f241dabcebb8d3220c126c344629eaa4e802c0db7b13 🔍
SHA3 07f272467a73a06c468a3da5cff5089047e52b67ad1a371cba35d02268074202 🔍
VirtualSize 0x959354
VirtualAddress 0x80d000
SizeOfRawData 0x959400
PointerToRawData 0x1a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.96236

.reloc

MD5 04c96f593a754b463ee05fa24c516f8f 🔍
SHA1 415d45808a8dd0263f3d7ba1e8c4b7bf6e075f73 🔍
SHA256 299478b520d4a773325824bf4c22ddbf88e547accd0326c54189d3cfe40b3e9b 🔍
SHA3 4c0e423535bc00181e4e390a82319289ca486950bf69587c45ac455d76bd64d8 🔍
VirtualSize 0xf8
VirtualAddress 0x1167000
SizeOfRawData 0x200
PointerToRawData 0x95ae00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.39652

.rsrc

MD5 9575f1f9bb25f347314d823c10442217 🔍
SHA1 fe94c271d126da964cc273d4eb8424f3b575378f 🔍
SHA256 aacfa7fee5981c7b4b6d55fe2065ae9368f529edca8c0cd85215efda71beb025 🔍
SHA3 58b4fe7bf7e8960a3e06443b67580eefe1cc7cdbc2ae90cdee7649f8737296eb 🔍
VirtualSize 0x1e0
VirtualAddress 0x1168000
SizeOfRawData 0x200
PointerToRawData 0x95b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7749

Imports

WS2_32.dll gethostname
CRYPT32.dll CertEnumCertificatesInStore
WLDAP32.dll #217
Normaliz.dll IdnToAscii
KERNEL32.dll AreFileApisANSI
USER32.dll SetWindowsHookExA
ADVAPI32.dll CryptEncrypt
SHELL32.dll ShellExecuteA
ole32.dll CoCreateInstance
OLEAUT32.dll VariantClear
MSVCP140.dll ?uncaught_exceptions@std@@YAHXZ
d3d9.dll Direct3DCreate9
IMM32.dll ImmSetCompositionWindow
dwmapi.dll DwmSetWindowAttribute
ntdll.dll NtRaiseHardError
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __current_exception
api-ms-win-crt-heap-l1-1-0.dll _callnewh
api-ms-win-crt-stdio-l1-1-0.dll fopen
api-ms-win-crt-math-l1-1-0.dll fmodf
api-ms-win-crt-locale-l1-1-0.dll localeconv
api-ms-win-crt-convert-l1-1-0.dll strtol
api-ms-win-crt-filesystem-l1-1-0.dll _stat64
api-ms-win-crt-runtime-l1-1-0.dll _configure_narrow_argv
api-ms-win-crt-utility-l1-1-0.dll srand
api-ms-win-crt-string-l1-1-0.dll strlen
api-ms-win-crt-time-l1-1-0.dll _gmtime64
api-ms-win-crt-environment-l1-1-0.dll _dupenv_s
KERNEL32.dll (#2) AreFileApisANSI
USER32.dll (#2) SetWindowsHookExA
KERNEL32.dll (#3) AreFileApisANSI

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140113080

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .YP9 has a size of 0!
Leave a comment

No comments yet.