4663bba7172a24a9a46a1e2b8d1ed0df

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2005-Feb-10 16:58:29
Detected languages Russian - Russia

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Info The PE's resources present abnormal characteristics. Resource 127 is possibly compressed or encrypted.
Suspicious The file contains overlay data. 6 bytes of data starting at offset 0x64c00.
Malicious VirusTotal score: 9/67 (Scanned on 2021-07-28 18:08:54) FireEye: Generic.mg.4663bba7172a24a9
ESET-NOD32: a variant of Win64/TrojanDownloader.Agent.LG
Paloalto: generic.ml
Kaspersky: UDS:Backdoor.Win32.Bazdor
Jiangmin: Trojan.Shelma.izt
Kingsoft: Win32.Troj.Undef.(kcloud)
Microsoft: Trojan:Win32/Wacatac.B!ml
Cynet: Malicious (score: 100)
MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 4663bba7172a24a9a46a1e2b8d1ed0df
SHA1 a8d683cca49ac28a89a30418b94818be0184a887
SHA256 a314401b8e12130bea249a3734022a8ebd46b8e65b18535db60944a00e84e6f6
SHA3 1d6b660750142952ee95ff7641f36a61b6909e2a572b90cadace341914dfdc46
SSDeep 12288:ZinPGC8lXe1gwijX52yN7stYqaHVbBBRY:gnPAlOWwIX5ZNpFY
Imports Hash 83a661f70c4411105c2ffd1b9d57feba

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2005-Feb-10 16:58:29
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 219.0
SizeOfCode 0x21200
SizeOfInitializedData 0x44a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000001845C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x6a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3b80172eca0e6322a4f4b8425bcdf5dd
SHA1 a7b981b8543cf24eff54402f7eccf466ade1dcc8
SHA256 f43515456e8a300e6cff566cf0d0f35f2cef90f52b5f6a9cc24b9b0758601850
SHA3 f969e46b6d5cfd91c4e6331bbfa04067f1639acad749914d56f08344d7c714f5
VirtualSize 0x21100
VirtualAddress 0x1000
SizeOfRawData 0x21200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.25539

.rdata

MD5 cce0511a3d1131d741d5de9ed56b4e42
SHA1 f39cef7572c5191b6dddc4eb98b3f495ab4434c9
SHA256 84af01a51c3268e2da6d28612074a31f575ba51b79f019bf66d7012b8139af51
SHA3 25235511219efba78be8f8ab3c425ebe9ba23a5b3829617c3fd521269485866a
VirtualSize 0xc27c
VirtualAddress 0x23000
SizeOfRawData 0xc400
PointerToRawData 0x21600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.45198

.data

MD5 a256f5ad929441f345d812a309fcb792
SHA1 12e35e0ad3b19f40a845ea3378044a7a66738d7f
SHA256 c7cc3202efc3d3e89f90e753b3030af06a45608e156fbe4fdb0dc165f9524615
SHA3 43098e47fb5ea3a2e77ce3ab6d0ebf4dd87a3bb4eaf271ce46256715f1d77918
VirtualSize 0x24b0
VirtualAddress 0x30000
SizeOfRawData 0x1200
PointerToRawData 0x2da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.4584

.pdata

MD5 66e8b9885b41c61d18a957d318b47e01
SHA1 736014d06254eb7e76c48845b54d6cab83742776
SHA256 9f51848228b2fa546248ccb6b59f94adea4eff79ada6174e58c9d791ecda082d
SHA3 f9bb9432b9a07dfe0078c21f4f67a2d8743a8f970c2c74323eeb791eb93734c8
VirtualSize 0xfa8
VirtualAddress 0x33000
SizeOfRawData 0x1000
PointerToRawData 0x2ec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.19762

.rsrc

MD5 bb51345aed2320ba4cc907529deba9f5
SHA1 3b2b7f8669ac9ad7f0401eeb8bc1fa8b3c808c1d
SHA256 8194ed644b0f222ef66d62b89084f65bf479990b700b403bfd99c29ad7bacf51
SHA3 16bba16b4da36b1bc36093f61222a2a6e1efe4c1729194223e66736bc94d76ac
VirtualSize 0x346c8
VirtualAddress 0x34000
SizeOfRawData 0x34800
PointerToRawData 0x2fc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.72347

.reloc

MD5 11357a44077b78c2ff4a7dae40526c3d
SHA1 5f1477faa4ffdaa494fc6e0a8b371c3500f02eda
SHA256 3d5dc9b65d54c5fd3b628a0cb91ed7a1d125a0d64b75996cdc88fbebcc290368
SHA3 01b455175bf3d2909c2daabb13405081679883e9411522732f3022b38f6dbab8
VirtualSize 0x644
VirtualAddress 0x69000
SizeOfRawData 0x800
PointerToRawData 0x64400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.83894

Imports

KERNEL32.dll FindFirstFileA
FindNextFileA
CreateFileA
CreatePipe
GetProcessHeap
GetProcAddress
ExitProcess
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CloseHandle

Delayed Imports

StartW

Ordinal 1
Address 0x9570

ajhqkcldxvhpmnbs

Ordinal 2
Address 0xa9a0

dbyvvql

Ordinal 3
Address 0xb350

degrteurwtvqfdpm

Ordinal 4
Address 0xab90

dgpsjrjtpclpituj

Ordinal 5
Address 0xb2d0

dingkpynhjpjybpl

Ordinal 6
Address 0xb010

dnbmxrtjygfwyuu

Ordinal 7
Address 0xb450

dqxxyynlks

Ordinal 8
Address 0xb2e0

ezkkuqdggcvnbl

Ordinal 9
Address 0xa9c0

fceuizrtxyqy

Ordinal 10
Address 0xa9b0

gpltroqelxb

Ordinal 11
Address 0xad70

gvldutwhyi

Ordinal 12
Address 0xb8b0

hbtrgnfzqcddh

Ordinal 13
Address 0xaaa0

icllypwwsm

Ordinal 14
Address 0xb540

ipvljvexiggspmvpp

Ordinal 15
Address 0xb6e0

jedmpzkrwfxg

Ordinal 16
Address 0xb100

jeswtoquvjmhczrez

Ordinal 17
Address 0xb6f0

jqphpzshykkphl

Ordinal 18
Address 0xb020

juvybcptqimkwzt

Ordinal 19
Address 0xb2f0

kcgpyesjmkfi

Ordinal 20
Address 0xac80

kzrdmotwjdsxa

Ordinal 21
Address 0xb430

lgjctck

Ordinal 22
Address 0xb110

nsrgxriqvsmpwch

Ordinal 23
Address 0xb610

nwoncweloozaiz

Ordinal 24
Address 0xb330

oucjqal

Ordinal 25
Address 0xb2c0

oxzbrsgqpgwif

Ordinal 26
Address 0xae60

oyagefuhqjx

Ordinal 27
Address 0xb890

phwgikfmfaosh

Ordinal 28
Address 0xb030

pxeofsrgxkklo

Ordinal 29
Address 0xad80

ralixgfywasek

Ordinal 30
Address 0xb460

rrhohtqlnkzuw

Ordinal 31
Address 0xb1e0

rtvorir

Ordinal 32
Address 0xaab0

sgexgqpcuqtonmm

Ordinal 33
Address 0xb310

torbziekvewyhrx

Ordinal 34
Address 0xb470

trpyzmpqytjjzlz

Ordinal 35
Address 0xac70

ttkllaup

Ordinal 36
Address 0xaf40

ufmwoljsw

Ordinal 37
Address 0xb7c0

ujctkjrfcmpn

Ordinal 38
Address 0xb300

vcctiohcb

Ordinal 39
Address 0xaa90

vemuycsheyzvjmd

Ordinal 40
Address 0xac90

vsalaplyzhpdr

Ordinal 41
Address 0xb320

wwkyozshqalgcgdz

Ordinal 42
Address 0xb8a0

yhwnhwcmbc

Ordinal 43
Address 0xb440

ylgspdrukxmmbqfiq

Ordinal 44
Address 0xb340

127

Type RT_BITMAP
Language Russian - Russia
Codepage UNKNOWN
Size 0x34667
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.72319
MD5 aebd798c0913cc1a7db6c61e715a998d
SHA1 ea5f306b24303dffcc31a5b43f5a9fa5ea602ca9
SHA256 6c623b08d4384684346d14653aff252ad44cda63ca1a51724edb5a861c953f81
SHA3 e4b370835206fdd43fd8f327d38df455b94cc2181a41449feb802ac9de058fe5
Preview

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Jul-28 08:53:59
Version 0.0
SizeofData 708
AddressOfRawData 0x2d674
PointerToRawData 0x2bc74

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2021-Jul-28 08:53:59
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180030790

RICH Header

XOR Key 0xcdfb2b18
Unmarked objects 0
C objects (23917) 13
ASM objects (23917) 5
C++ objects (23917) 120
C++ objects (VS 2015/2017 runtime 26706) 32
C objects (VS 2015/2017 runtime 26706) 14
ASM objects (VS 2015/2017 runtime 26706) 8
Imports (23917) 3
Total imports 90
Unmarked objects (#2) 9
Exports (27045) 1
Resource objects (27045) 1
Linker (27045) 1

Errors

<-- -->