46351b8dbee925d774b7db98216324fd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2021-Sep-29 09:39:21

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • github.com
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
Functions which can be used for anti-debugging purposes:
  • SwitchToThread
  • NtQueryInformationProcess
Possibly launches other programs:
  • ShellExecuteW
  • NtCreateProcessEx
Uses Windows's Native API:
  • NtCreateProcessEx
  • NtClose
  • NtCreateSection
  • NtQueryInformationProcess
  • NtReadVirtualMemory
Manipulates other processes:
  • WriteProcessMemory
Malicious VirusTotal score: 23/70 (Scanned on 2021-11-23 14:51:49) Lionic: Trojan.Win32.Generic.4!c
MicroWorld-eScan: Trojan.GenericKDZ.79338
FireEye: Trojan.GenericKDZ.79338
McAfee: GenericRXAA-AA!46351B8DBEE9
Zillya: Backdoor.PMax.Win32.4846
Sangfor: Trojan.Win32.GenericKDZ.79338
Alibaba: Trojan:Win64/BackdoorX.ecde8b79
Symantec: Trojan.Gen.MBT
TrendMicro-HouseCall: TROJ_GEN.R002H09JV21
BitDefender: Trojan.GenericKDZ.79338
Ad-Aware: Trojan.GenericKDZ.79338
Sophos: Generic PUA EC (PUA)
Emsisoft: Trojan.GenericKDZ.79338 (B)
GData: Trojan.GenericKDZ.79338
MAX: malware (ai score=89)
Antiy-AVL: Trojan/Generic.ASMalwS.34BD23A
Gridinsoft: Trojan.Win64.Sabsik.oa!s1
Microsoft: Trojan:Win32/Wacatac.B!ml
ALYac: Trojan.GenericKDZ.79338
Avast: Win64:BackdoorX-gen [Trj]
Fortinet: W32/PossibleThreat
AVG: Win64:BackdoorX-gen [Trj]
Qihoo-360: Win64/Backdoor.Generic.HgEASfkA

Hashes

MD5 46351b8dbee925d774b7db98216324fd
SHA1 421a759769a80988c6eedfe94e0bdcb42cfd9260
SHA256 ae44fb148c9e7daee8486600169fcb88eccb50feca1c23783981a651110cf12e
SHA3 91f913554d2958bdd7b5965db4869a989fb359b3fa8ef4e1921a7f67fc7fab5c
SSDeep 6144:y3LaobQIdmWK8JQAfYRgExon6bohsGGJHi:GLbQId48JpfYj+go
Imports Hash d2a363867098347c88f751775b2d1562

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2021-Sep-29 09:39:21
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2e600
SizeOfInitializedData 0x61a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000DBAC (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x94000
SizeOfHeaders 0x400
Checksum 0x98fad
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 96cf98d4117c229916c914b609488607
SHA1 37d22fa8e4c3330c11f13d0c2d648422d624bdce
SHA256 1398cdcddfe93ec4fa8af81648a199434ff9fe83129fdb1dd8dbe92764a9e98e
SHA3 867d207ba0aac9610e25daa5ac1eaead1e979a5791a96a4c209c1feef68041f9
VirtualSize 0x2e5dc
VirtualAddress 0x1000
SizeOfRawData 0x2e600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47838

.rdata

MD5 7bf075b7f33e188642d978893f09235d
SHA1 7365ae6b4b171aac5e3a579d75c9217f78c7ccb5
SHA256 b932b98712f8e4f5b035a85a166b17890d116f6f4be1c939de86beab0891e473
SHA3 a91fbca4d5ff186898cca4b7a0f798861fef7fabfceabe15f90cc0f31ba643ce
VirtualSize 0x16d18
VirtualAddress 0x30000
SizeOfRawData 0x16e00
PointerToRawData 0x2ea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.01091

.data

MD5 701db1e65c23f0516be72fe4cd26600a
SHA1 62d0af1d95356d6ac8f430b05b11fb02ceb8ae3b
SHA256 b92802084308092bd9872c69268f3e85fc4a788560221fffa64ca75b1fbad488
SHA3 bf1cd9a1df71240fdf28209179ea30c07c318d813d2f85fa3643640f9affb7a7
VirtualSize 0x3080
VirtualAddress 0x47000
SizeOfRawData 0x1400
PointerToRawData 0x45800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.26916

.pdata

MD5 df880b8985b72fd7ddaa4d483f9a07f5
SHA1 9c2c2bd4ce2291a276df19dc9eacf667f44285f7
SHA256 aa0e2aaa5cc3f875234939d13a29134a965d6d62ce6bf77aaabba216703bb5eb
SHA3 2e2b9a1e141b69248755e218f41f1ce288cb0a6a6350cf4b0f8b01dae84dfcc2
VirtualSize 0x2838
VirtualAddress 0x4b000
SizeOfRawData 0x2a00
PointerToRawData 0x46c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.25441

.reloc

MD5 2efa76f2c2a7c3bb1eaef190ce38af61
SHA1 39154b188b434bc878830442c17f2e0f9b987f3a
SHA256 401bc4d6d62eb031e24f32b72aaac9d4df0cf9a11b802b6f5710f2b1a18507f4
SHA3 f405bb4ccc5546c971b70c6657c9a9209530f329175a95e7c4fb892a3018e52a
VirtualSize 0xde0
VirtualAddress 0x4e000
SizeOfRawData 0xe00
PointerToRawData 0x49600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43798

.rsrc

MD5 ee8b97c6e3426c71e9e7bc592996dd72
SHA1 d8586b0f76092553445c389b31acb2aff839ab1c
SHA256 3356cd955e53af8d4928ae3c6038924da52594d7faaa3cda7cf4d74bcd4957df
SHA3 100858d85ac138431a58141ff7ae88f370e6a0f8c10023f095561b9ee41900a0
VirtualSize 0x440f0
VirtualAddress 0x4f000
SizeOfRawData 0x44200
PointerToRawData 0x4a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.6122

Imports

KERNEL32.dll CreateNamedPipeW
CreateFileW
GetLastError
SetFileInformationByHandle
LoadLibraryA
HeapReAlloc
CloseHandle
HeapAlloc
GetCurrentDirectoryW
GetProcAddress
ExpandEnvironmentStringsW
ExitProcess
GetProcessHeap
GetModuleHandleW
lstrcmpiW
GetTickCount
ConnectNamedPipe
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
WriteFile
GetCurrentProcess
GetFullPathNameW
HeapFree
WriteProcessMemory
VirtualAllocEx
ReadFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
FlushFileBuffers
GetConsoleCP
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
SHELL32.dll ShellExecuteW
ntdll.dll NtCreateProcessEx
strcspn
NtClose
NtCreateSection
NtQueryInformationProcess
RtlInitUnicodeString
NtReadVirtualMemory
_local_unwind
strrchr
wcschr
SHLWAPI.dll StrStrW
StrCpyW
StrRChrW
USERENV.dll CreateEnvironmentBlock

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x44028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.6103
MD5 606cb15aa1e49653daa5123c91bc5b5a
SHA1 3869041f57baf009b7a5d5eab153d89d86018ab9
SHA256 9d18fc391b9b2e7148c0c12688c0b4bbc19c2c4a1a1800580f5e5710e2c9398f
SHA3 6d5f81c0f412b64e9822c134b8068b35559c9129169ebaa78e892820b058561e

GHOST-2-2

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.93321
Detected Filetype Icon file
MD5 4bc30cc542632430995c0befb963c8df
SHA1 7e7ac4a798f573cd6561d95430a1cb17a9dc1ed7
SHA256 d003f4ab310c889cced3400b88c5265d87d7ffde98fc471167e2b68f6b8c786e
SHA3 84b6719cd88942cc8316ca7cc10085a17e6e57e3821fc07cb3f3690d30dc4e85

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Sep-29 09:39:21
Version 0.0
SizeofData 776
AddressOfRawData 0x42a1c
PointerToRawData 0x4141c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2021-Sep-29 09:39:21
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140047088

RICH Header

XOR Key 0x27925333
Unmarked objects 0
C objects (26715) 17
ASM objects (26715) 10
C++ objects (26715) 174
199 (41118) 1
ASM objects (VS 2015/2017 runtime 26706) 9
C++ objects (VS 2015/2017 runtime 26706) 64
C objects (VS 2015/2017 runtime 26706) 28
Imports (VS2008 SP1 build 30729) 2
Imports (40310) 2
Imports (26715) 13
Total imports 139
265 (27045) 1
Linker (27045) 1

Errors

<-- -->