| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-26 11:03:24 |
| Detected languages |
English - United States
|
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 46/68 (Scanned on 2026-07-04 19:47:46) |
ALYac:
Trojan.GenericKD.80196314
APEX: Malicious AVG: Win64:MalwareX-gen [Misc] AhnLab-V3: Trojan/Win.Generic.C5899047 Alibaba: Trojan:Win64/MalwareX.d8270838 Antiy-AVL: Trojan/Win32.Agent Arcabit: Trojan.Generic.D4C7B2DA Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Trojan.GenericKD.80196314 Bkav: W32.Malware.25AE4682 CAT-QuickHeal: Trojan.Kepavll CTX: exe.trojan.kepavll CrowdStrike: win/malicious_confidence_90% (W) Cylance: Unsafe Cynet: Malicious (score: 100) ESET-NOD32: Win64/Agent_AGen.ODS trojan Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.80196314 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: W64/Agent_AGen.ODS!tr GData: Trojan.GenericKD.80196314 Ikarus: Trojan.Win64.Agent K7AntiVirus: Trojan ( 006e13e21 ) K7GW: Trojan ( 006e13e21 ) Kingsoft: Win32.Troj.kepavll.v Lionic: Trojan.Win32.Kepavll.4!c Malwarebytes: Malware.AI.4052887913 MaxSecure: Trojan.Malware.687117722.susgen McAfeeD: ti!4507816E4942 MicroWorld-eScan: Trojan.GenericKD.80196314 Microsoft: Trojan:Win32/Kepavll!rfn Paloalto: generic.ml Rising: Malware.Undefined!8.C (TFE:5:tcrLTbId3UR) Sangfor: Trojan.Win64.Agent.Vtg3 Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.11e5bc4b TrellixENS: Artemis!D101C0EEB89C TrendMicro: Trojan.Win32.ZYX.USBLEU26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLEU26 VBA32: Trojan.Kepavll VIPRE: Trojan.GenericKD.80196314 Varist: W64/ABApplication.TXZP-1951 ViRobot: Trojan.Win.Z.Agent.767488.BB alibabacloud: Trojan:Win/Agent_AGen.OFK |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-May-26 11:03:24 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x8da00 |
| SizeOfInitializedData | 0x2ee00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000065F00 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xc0000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| WS2_32.dll |
recvfrom
send WSACloseEvent gethostname ioctlsocket sendto getsockopt freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent |
|---|---|
| WLDAP32.dll |
#217
#35 #46 #301 #200 #30 #79 #143 #33 #32 #27 #26 #22 #41 #50 #45 #60 #211 |
| CRYPT32.dll |
CertFreeCertificateChain
CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore |
| Normaliz.dll |
IdnToUnicode
IdnToAscii |
| KERNEL32.dll |
LCMapStringW
CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode WriteFile GetModuleFileNameW SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle ExitProcess VirtualProtect VirtualFree GetCurrentProcess VirtualAlloc RtlAddFunctionTable LoadLibraryA GetProcAddress FlushInstructionCache ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter GetTickCount CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA MultiByteToWideChar QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA FreeLibrary GetModuleHandleA SleepEx Sleep WideCharToMultiByte GetLastError SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA RtlUnwind GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx GetDriveTypeW CreateFileW LoadLibraryExW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW DeleteFileW GetTimeZoneInformation HeapSize WriteConsoleW GetStdHandle TlsFree TlsSetValue RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue |
| USER32.dll |
MessageBoxW
|
| ADVAPI32.dll |
CryptHashData
CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash OpenThreadToken CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA |
| bcrypt.dll |
BCryptGenRandom
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-26 11:03:24 |
| Version | 0.0 |
| SizeofData | 900 |
| AddressOfRawData | 0xa9c1c |
| PointerToRawData | 0xa8a1c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-26 11:03:24 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400b3840 |
| XOR Key | 0x7cd55b4f |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 185 |
| C objects (33145) | 14 |
| ASM objects (33145) | 9 |
| 253 (35207) | 7 |
| ASM objects (35207) | 10 |
| C objects (35207) | 18 |
| C++ objects (35207) | 44 |
| Total imports | 214 |
| Imports (33145) | 17 |
| C objects (33523) | 126 |
| C++ objects (LTCG) (35227) | 3 |
| Resource objects (35227) | 1 |
| Linker (35227) | 1 |
No comments yet.