468c2932861528d8a08594380f7884d30868d2b29346154e3a3c31a0e768b015
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2004-Nov-19 12:19:18 |
| Detected languages |
English - United States
|
Plugin Output
| Info | Matching compiler(s): |
Borland C++ DLL
Borland C++ for Win32 1999 |
| Suspicious | PEiD Signature: |
UPX -> www.upx.sourceforge.net
UPX Protector v1.0x (2) |
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Suspicious | The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable. Unusual section name found: UPX1 Section UPX1 is both writable and executable. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. |
Resource TFORM1 is possibly compressed or encrypted.
Resource TFORM3 is possibly compressed or encrypted. The binary may have been compiled on a machine in the UTC+2 timezone. |
| Suspicious | The file contains overlay data. | 44 bytes of data starting at offset 0x55a00. |
| Malicious | VirusTotal score: 56/67 (Scanned on 2026-10-26 06:51:51) |
ALYac:
Dropped:Backdoor.Prorat.19.I
APEX: Malicious AVG: Win32:GenMalicious-BME [Trj] AhnLab-V3: Trojan/Win32.Prorat.R1757 Antiy-AVL: Trojan[Backdoor]/Win32.Prorat Arcabit: Backdoor.Prorat.19.I Avast: Win32:GenMalicious-BME [Trj] Avira: BDS/ProRat.Gen BitDefender: Dropped:Backdoor.Prorat.19.I Bkav: W32.Malware.F4E6E8B0 CAT-QuickHeal: Backdoor.Prorat.T8 ClamAV: Win.Trojan.Prorat-37 CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DrWeb: Trojan.DownLoad1.39115 ESET-NOD32: Win32/Prorat.19 trojan Elastic: malicious (moderate confidence) Emsisoft: Dropped:Backdoor.Prorat.19.I (B) F-Secure: Backdoor.BDS/ProRat.Gen Fortinet: W32/Prorat.I!tr.bdr GData: Win32.Trojan.PSE1.4OP2OD Ikarus: Backdoor.Win32.Prorat Jiangmin: Backdoor/Prorat.ci K7AntiVirus: Backdoor ( 0020e8c31 ) K7GW: Backdoor ( 0020e8c31 ) Malwarebytes: Crypt.Trojan.Malicious.DDS MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!6D68A240D4F8 MicroWorld-eScan: Dropped:Backdoor.Prorat.19.I Microsoft: Backdoor:Win32/Prorat.L NANO-Antivirus: Trojan.Win32.Prorat-19.dqfdkn Panda: Trj/Genetic.gen Rising: Backdoor.ProRat.crf (CLASSIC) SUPERAntiSpyware: Trojan.Agent/Gen-Prorat Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Dropper.fc Sophos: Troj/Prorat-19 Symantec: W32.IRCBot.Gen Tencent: Trojan.Win32.Prorat.ad TrellixENS: BackDoor-AVW TrendMicro: BKDR_PRORAT.SMM TrendMicro-HouseCall: BKDR_PRORAT.SMM VBA32: Backdoor.Prorat VIPRE: Dropped:Backdoor.Prorat.19.I Varist: W32/ProratP.A ViRobot: Backdoor.Win32.Prorat.350764.B VirIT: Backdoor.Prorat.B Webroot: W32.Prorat.Gen Xcitium: Backdoor.Win32.Agent.AVW85@11x5ri Yandex: Trojan.GenAsa!Br8d4Xxe2vk ZoneAlarm: Troj/Prorat-19 Zoner: Trojan.Win32.32410 alibabacloud: Backdoor:Win/Prorat.cdc3be1b huorong: HVM:Trojan/MalBehav.gen!C |
Hashes
| MD5 | 6d68a240d4f8c3b61768d1251a225271 🔍 |
|---|---|
| SHA1 | 66d886485757a81821951284be19b39839577b10 🔍 |
| SHA256 | 468c2932861528d8a08594380f7884d30868d2b29346154e3a3c31a0e768b015 🔍 |
| SHA3 | 0bba2273523517addbd1de18a2ec0e2b05a7d9283c23f501ef0ec78158ce0d7b 🔍 |
| SSDeep | 6144:qRqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yzWg8r:iqmpplpGoGL3etQoMiXM8gxf/Sj4yIr 🔍 |
| Imports Hash | 7b03ba640e1d147a081b8a1703fd9cba 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x200 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2004-Nov-19 12:19:18 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 5.0 |
| SizeOfCode | 0x55000 |
| SizeOfInitializedData | 0x1000 |
| SizeOfUninitializedData | 0x1a5000 |
| AddressOfEntryPoint | 0x001FA4B0 (Section: UPX1) |
| BaseOfCode | 0x1a6000 |
| BaseOfData | 0x1fb000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1fc000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
UPX0
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1a5000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
UPX1
| MD5 | b038f0841315f0c5af9746241d9efaad 🔍 |
|---|---|
| SHA1 | f2dd120cba3a72fd7723eca6fae8f5d67c14f0e7 🔍 |
| SHA256 | 6019517a2caf35ab1e2845c0c9eca03495f6529027c2550b7c9af6476e99e56e 🔍 |
| SHA3 | c4d915737f3405982403acce808503268bfd213e8775a572486856dbaf25cf70 🔍 |
| VirtualSize | 0x55000 |
| VirtualAddress | 0x1a6000 |
| SizeOfRawData | 0x54800 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.91211 |
.rsrc
| MD5 | 9b5fd556ebf72525e7ae9989d684f16d 🔍 |
|---|---|
| SHA1 | e71007c8c2de2d5e0f6e8df1cd402c274132f1e7 🔍 |
| SHA256 | 72633d79f84ba2923d183e5ad63fc094112408c7cd94e4a58a9b255838754572 🔍 |
| SHA3 | f221eeeb5970cdf922b68d5c4251b731bed34fca3bf2c72cb9a42b3d4661483c 🔍 |
| VirtualSize | 0x1000 |
| VirtualAddress | 0x1fb000 |
| SizeOfRawData | 0xe00 |
| PointerToRawData | 0x54c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.45024 |
Imports
| KERNEL32.DLL |
LoadLibraryA
GetProcAddress ExitProcess |
|---|---|
| ADVAPI32.DLL |
RegCloseKey
|
| AVICAP32.DLL |
capCreateCaptureWindowA
|
| COMCTL32.DLL |
ImageList_Add
|
| GDI32.DLL |
BitBlt
|
| OLE32.DLL |
IsEqualGUID
|
| OLEAUT32.DLL |
SysStringLen
|
| SHELL32.DLL |
ShellExecuteA
|
| URLMON.DLL |
URLDownloadToFileA
|
| USER32.DLL |
GetDC
|
| WINMM.DLL |
timeGetTime
|
| WINSPOOL.DRV |
ClosePrinter
|
| WS2_32.DLL |
WSACloseEvent
|
| WSOCK32.DLL |
bind
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x8a8 |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 3.87196 |
| MD5 | e287de8aaf1b8e8551b940553f2ec2e5 🔍 |
| SHA1 | e4ac421f7c44ca5a645d01ddddfaf48e49578308 🔍 |
| SHA256 | 22ce4054fae91307ac3fdd3010a91d6c8b517a0d648958d397b664dba2028035 🔍 |
| SHA3 | a4536a63bf6ea48b9effdc46612f06669db6bd2d5216882f2102c7983068563b 🔍 |
4083
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x60 |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 6.18913 |
| MD5 | 00b13fadceb681216dd1cb9c495f9793 🔍 |
| SHA1 | 3e4b9cc85eda051a455eb0412dba769c3f3301ec 🔍 |
| SHA256 | 8a08ff4fdc7f4273a0dc64370a3263208b978619f04397c132ab65516d3df801 🔍 |
| SHA3 | 169c89c2f3ba21ef29ab905dcd09bd426d99dbbce829f2ac43ddda15a187aed8 🔍 |
DVCLAL
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x10 |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 3.75 |
| MD5 | efe30f205ac0ce6b1383fab0f9c03923 🔍 |
| SHA1 | 9239cedc8235adbf9f0e65360fa68b3f82dc2897 🔍 |
| SHA256 | c1986b49e1f33be85dad095b9d3e11094d16233d1310521836371f666a8aafd7 🔍 |
| SHA3 | 4b320409c41b840914257e0a35117fd1aee274557b65499b56352c4c86fe77c4 🔍 |
TFORM1
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x9a6 |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 7.77537 |
| MD5 | ed219db4386a761082e1b7bfd492e576 🔍 |
| SHA1 | 393ffc884008dacc379ac3d7595985ef71cc3f85 🔍 |
| SHA256 | d51c05a84c80fe767bba86acd14b1cfd95242a771e9cbe5b9fd12cbd364b61c7 🔍 |
| SHA3 | 9aa82b7ac42dcc95642876b9b1a820db9d4bcf8da2669caca1ed0a10dd7c9f5a 🔍 |
TFORM2
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x4bd |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 6.64371 |
| MD5 | 9707264aeac96dce8ab949a658857e60 🔍 |
| SHA1 | c1bbef34e173b24bb2530a2834bc0517edf10036 🔍 |
| SHA256 | 7c737f0f2c706d031b2484c0968f99488a4526aada99868641309625ba061e3f 🔍 |
| SHA3 | 85bf9f13cdce81be8962ade30c0a5a93e05ff8bfeda3da5c72c4dff2f9cb722f 🔍 |
TFORM3
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x3d0 |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 7.24454 |
| MD5 | f65920b17876c6401e56e787648d1b43 🔍 |
| SHA1 | 216e18bb2bfbcaa1040c8b30ed31fddaaabbc1a9 🔍 |
| SHA256 | 61d1658910d5026cd69883a96e5ab9fd06990766c63ca15cba78601918556376 🔍 |
| SHA3 | 396ec10976e2df4cabdf5aab75b5aedc4983b6ca9089748219d4d19b6f07ecff 🔍 |
MAINICON
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 2004-Nov-19 14:19:18 |
| Entropy | 1.81924 |
| Detected Filetype | Icon file |
| MD5 | cbee427fa121aba9b9b265ff05de5383 🔍 |
| SHA1 | 24fcae33001c8e0f5ec795c6edf076a69d59589f 🔍 |
| SHA256 | 494e4fd717fa1ee0c5c7bb3b4e28fdab4b7f6e95b4f9865f5ab86f03f62ae62c 🔍 |
| SHA3 | a3fa35d56632275ba55716a4964f02031270f61f06a903fc460ac2dd6bebde85 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: IMAGE_EXPORT_DIRECTORY field Characteristics is reserved and should be 0!
[!] Error: Could not read the exported DLL name.
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section UPX0 has a size of 0!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
Leave a comment
No comments yet.