| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-20 21:40:30 |
| Detected languages |
English - United States
|
| Debug artifacts |
c:\Users\vexx\Documents\Sources\Secureloader\Genesis\bypass\x64\Release_tmp_biowrap\bypass.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses known Mersenne Twister constants Microsoft's Cryptography API |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 42/71 (Scanned on 2026-05-26 10:47:50) |
ALYac:
Trojan.GenericKD.80167996
APEX: Malicious AVG: MalwareX-gen [Misc] Alibaba: Trojan:Win64/GenKryptik.77c8f09d Antiy-AVL: Trojan/Win64.Agent Arcabit: Trojan.Generic.D4C7443C Avast: MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Trojan.GenericKD.80167996 Bkav: W32.Malware.A7C83CB5 CTX: exe.trojan.agen CrowdStrike: win/malicious_confidence_70% (W) Cylance: Unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS ESET-NOD32: Win64/GenKryptik_AGen.DSY trojan Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.80167996 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: W64/GenKryptik_AGen.DSY!tr GData: Trojan.GenericKD.80167996 Google: Detected Ikarus: Trojan.Win32.Generic K7AntiVirus: Trojan ( 006e046c1 ) K7GW: Trojan ( 006e046c1 ) Kaspersky: UDS:Trojan.Win64.DBadur.gen Lionic: Trojan.Win32.DBadur.4!c Malwarebytes: Malware.AI.4059825605 MicroWorld-eScan: Trojan.GenericKD.80167996 Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Rising: Trojan.Kryptik!8.8 (LESS:bWQ1Ok8e4beQgOyMOQwvLKqfopo) SentinelOne: Static AI - Suspicious PE Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Win32.Trojan.W64.Anhl TrellixENS: Artemis!3F339297CB6C TrendMicro-HouseCall: TROJ_GEN.R002H09EM26 VBA32: Trojan.Win64.Agent VIPRE: Trojan.GenericKD.80167996 Varist: W64/ABTrojan.EHKD-2569 alibabacloud: Trojan:Win/GenKryptik_AGen.DBT |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-May-20 21:40:30 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x118a00 |
| SizeOfInitializedData | 0x13b600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000114494 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x257000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
|---|---|
| D3DCOMPILER_47.dll |
D3DCompile
|
| WININET.dll |
InternetOpenA
InternetOpenUrlA InternetReadFile InternetCloseHandle |
| KERNEL32.dll |
LockResource
LoadResource WriteFile GetTempPathW CreateFileW GetCurrentThreadId GetTickCount64 GetLastError DeleteFileW CloseHandle GetCurrentProcessId CreateProcessW FlushFileBuffers CreateDirectoryW ReadFile GetVolumeInformationW GetComputerNameW HeapFree HeapAlloc GetProcessHeap GetEnvironmentVariableW GetTickCount MoveFileExW SizeofResource LocalFree CreateFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA Sleep RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GlobalUnlock WideCharToMultiByte GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead InitOnceComplete InitOnceBeginInitialize FindResourceA GetModuleFileNameA SetUnhandledExceptionFilter GetModuleHandleW GetFileSizeEx GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW GetTempPathA WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileAttributesW |
| USER32.dll |
IsWindowUnicode
DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow MessageBoxW SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW SetCursorPos MoveWindow TranslateMessage LoadIconA PeekMessageA PostQuitMessage UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetClientRect SetCursor SetCapture ReleaseCapture GetCursorPos ShowWindow GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient |
| GDI32.dll |
CreateRoundRectRgn
|
| ADVAPI32.dll |
CryptHashData
RegCloseKey CryptAcquireContextW CredWriteW CredReadW CredFree CryptReleaseContext RegQueryValueExW CryptGetHashParam RegOpenKeyExW CryptDestroyHash CryptGenRandom CryptCreateHash CredDeleteW |
| SHELL32.dll |
ShellExecuteW
SHGetFolderPathW ShellExecuteA |
| ole32.dll |
CoCreateInstance
|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
|
| MSVCP140.dll |
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Thrd_id _Thrd_join _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Mtx_unlock ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Random_device@std@@YAIXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?good@ios_base@std@@QEBA_NXZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ |
| IMM32.dll |
ImmSetCompositionWindow
ImmReleaseContext ImmGetContext ImmSetCandidateWindow |
| WINHTTP.dll |
WinHttpSendRequest
WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect |
| bcrypt.dll |
BCryptOpenAlgorithmProvider
BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGetProperty |
| RPCRT4.dll |
UuidToStringA
UuidCreate RpcStringFreeA |
| CRYPT32.dll |
CryptProtectData
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
_CxxThrowException
__intrinsic_setjmp __current_exception_context __current_exception memcmp memchr __C_specific_handler memset memmove memcpy longjmp strrchr __std_terminate __std_exception_destroy __std_exception_copy strstr strchr |
| api-ms-win-crt-stdio-l1-1-0.dll |
fgetpos
__stdio_common_vsprintf_s fwrite __stdio_common_vfprintf fseek fclose fgetc setvbuf ungetc fflush fsetpos _set_fmode _fseeki64 __acrt_iob_func __stdio_common_vswprintf_s fputc __p__commode __stdio_common_vsprintf ftell _wfopen fread _get_stream_buffer_pointers __stdio_common_vsscanf |
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
_callnewh realloc free _set_new_mode |
| api-ms-win-crt-runtime-l1-1-0.dll |
exit
abort set_terminate _beginthreadex terminate _register_thread_local_exe_atexit_callback _c_exit _exit _invoke_watson _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _Exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table |
| api-ms-win-crt-utility-l1-1-0.dll |
qsort
|
| api-ms-win-crt-string-l1-1-0.dll |
strncmp
strcpy_s wcscpy_s tolower strcmp strncpy_s strncpy isxdigit isdigit |
| api-ms-win-crt-convert-l1-1-0.dll |
strtol
atoi |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_lock_file
_unlock_file |
| api-ms-win-crt-time-l1-1-0.dll |
_time64
_localtime64_s |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
sinf powf fmodf cosf ceilf acosf sqrtf |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-20 21:40:30 |
| Version | 0.0 |
| SizeofData | 119 |
| AddressOfRawData | 0x1928dc |
| PointerToRawData | 0x1916dc |
| Referenced File | c:\Users\vexx\Documents\Sources\Secureloader\Genesis\bypass\x64\Release_tmp_biowrap\bypass.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-20 21:40:30 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x192954 |
| PointerToRawData | 0x191754 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-20 21:40:30 |
| Version | 0.0 |
| SizeofData | 912 |
| AddressOfRawData | 0x192968 |
| PointerToRawData | 0x191768 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-20 21:40:30 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x140192d18 |
|---|---|
| EndAddressOfRawData | 0x140192d20 |
| AddressOfIndex | 0x1401a8428 |
| AddressOfCallbacks | 0x14011aca8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1401a7040 |
| XOR Key | 0xe24b97e7 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 22 |
| Imports (35207) | 6 |
| 253 (35207) | 1 |
| ASM objects (35207) | 6 |
| C objects (35207) | 10 |
| C++ objects (35207) | 35 |
| C objects (VS2022 Update 1 (17.1.6) compiler 31107) | 26 |
| C++ objects (33145) | 1 |
| Imports (33145) | 31 |
| Total imports | 386 |
| C++ objects (LTCG) (35225) | 50 |
| Resource objects (35225) | 1 |
| 151 | 1 |
| Linker (35225) | 1 |
No comments yet.