| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-08 15:34:45 |
| Detected languages |
English - United States
|
| Suspicious | The PE is possibly packed. |
Section .text is both writable and executable.
Unusual section name found: .ddata |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Functions which can be used for anti-debugging purposes:
|
| Malicious | VirusTotal score: 40/70 (Scanned on 2026-05-30 11:00:27) |
AVG:
Win64:MalwareX-gen [Misc]
Alibaba: Trojan:Win64/Themida.741a32a1 Antiy-AVL: Trojan[Packed]/Win64.Themida Arcabit: QD:Application.GenericQ.CAF50FB4E0 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: QD:Application.GenericKDQ.CAF50FB4E0 Bkav: W32.Malware.16AF16A3 CTX: exe.trojan.themida CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win64/Packed.Themida.Q suspicious application Elastic: malicious (high confidence) Emsisoft: QD:Application.GenericKDQ.CAF50FB4E0 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: Riskware/Application GData: Win64.Trojan.Agent.E0LK9X Google: Detected Gridinsoft: Trojan.Heur!.03212023 K7AntiVirus: Unwanted-Program ( 005ce0bd1 ) K7GW: Unwanted-Program ( 005ce0bd1 ) Lionic: Trojan.Win32.Themida.4!c Malwarebytes: Trojan.MalPack MaxSecure: Trojan.Malware.328690006.susgen McAfeeD: ti!477E1A96AD30 MicroWorld-eScan: QD:Application.GenericKDQ.CAF50FB4E0 Microsoft: Trojan:Win32/Kepavll!rfn Paloalto: generic.ml Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: Artemis Sophos: Mal/Generic-S TrellixENS: Artemis!F7D9DD4747ED TrendMicro: Trojan.Win32.ZYX.USBLEO26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLEO26 VIPRE: QD:Application.GenericKDQ.CAF50FB4E0 Varist: W64/ABApplication.BLOT-4762 alibabacloud: VirTool:Win/Wacatac.B9nj |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 12 |
| TimeDateStamp | 2026-May-08 15:34:45 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x41ae00 |
| SizeOfInitializedData | 0x84b400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000023B5058 (Section: .ddata) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x32d8000 |
| SizeOfHeaders | 0x600 |
| Checksum | 0x183181a |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetModuleHandleA
|
|---|---|
| urlmon.dll |
URLDownloadToFileA
|
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
| D3DCOMPILER_43.dll |
D3DCompile
|
| dxgi.dll |
CreateDXGIFactory1
|
| USER32.dll |
GetForegroundWindow
|
| GDI32.dll |
GetStockObject
|
| ADVAPI32.dll |
OpenSCManagerW
|
| SHELL32.dll |
ShellExecuteW
|
| ole32.dll |
CreateStreamOnHGlobal
|
| OLEAUT32.dll |
SysFreeString
|
| MSVCP140.dll |
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
|
| d3dx11_43.dll |
D3DX11CreateShaderResourceViewFromMemory
|
| WS2_32.dll |
WSASetLastError
|
| SHLWAPI.dll |
PathFindFileNameW
|
| ntdll.dll |
NtQuerySystemInformation
|
| IPHLPAPI.DLL |
GetAdaptersAddresses
|
| gdiplus.dll |
GdipDisposeImage
|
| IMM32.dll |
ImmGetContext
|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
_CxxThrowException
|
| api-ms-win-crt-heap-l1-1-0.dll |
_aligned_free
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_wassert
|
| api-ms-win-crt-utility-l1-1-0.dll |
qsort
|
| api-ms-win-crt-math-l1-1-0.dll |
_dsign
|
| api-ms-win-crt-time-l1-1-0.dll |
_gmtime64_s
|
| api-ms-win-crt-string-l1-1-0.dll |
strspn
|
| api-ms-win-crt-convert-l1-1-0.dll |
strtoll
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vfprintf
|
| api-ms-win-crt-filesystem-l1-1-0.dll |
_unlock_file
|
| api-ms-win-crt-environment-l1-1-0.dll |
getenv
|
| CRYPT32.dll |
CertDuplicateCertificateContext
|
| StartAddressOfRawData | 0x140c76000 |
|---|---|
| EndAddressOfRawData | 0x140c76018 |
| AddressOfIndex | 0x140c76018 |
| AddressOfCallbacks | 0x140c76020 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks | (EMPTY) |
| XOR Key | 0xb25a0564 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 22 |
| 253 (35207) | 1 |
| ASM objects (35207) | 4 |
| C objects (35207) | 10 |
| C++ objects (35207) | 45 |
| Imports (35207) | 6 |
| C objects (VS2022 Update 1 (17.1.6) compiler 31107) | 26 |
| C objects (33145) | 2 |
| Imports (21202) | 8 |
| C objects (35211) | 817 |
| Unmarked objects (#2) | 39 |
| Imports (2207) | 2 |
| Imports (33145) | 35 |
| Total imports | 681 |
| C++ objects (LTCG) (35211) | 38 |
| Resource objects (35211) | 1 |
| Linker (35211) | 1 |
No comments yet.