751b6b68106dd134ec72066359e9ff28cbdf8d7b43468c684541b5f21a44fbbc

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Apr-15 16:58:12
Comments %Des%
CompanyName %Company%
FileDescription %Title%
FileVersion 2.2.0.0
InternalName 1l02hrmr.exe
LegalCopyright %Copyright%
LegalTrademarks %Trademark%
OriginalFilename 1l02hrmr.exe
ProductName %Product%
ProductVersion 2.2.0.0
Assembly Version 2.2.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • schtask
 Looks for VMWare presence:
  • vmware
 Looks for Sandboxie presence:
  • SbieDll.dll
 May have dropper capabilities:
  • CurrentVersion\Run
 Accesses the WMI:
  • root\Security
 Miscellaneous malware strings:
  • CMD.EXE
  • cmd.exe
 Contains domain names:
  • githubusercontent.com
  • http://ip-api.com
  • https://raw.githubusercontent.com
  • https://raw.githubusercontent.com/76bh/img/main/Imagenep.png
  • ip-api.com
  • raw.githubusercontent.com
Malicious VirusTotal score: 42/71 (Scanned on 2025-05-24 06:04:40) ALYac: IL:Trojan.MSILZilla.30401
APEX: Malicious
AVG: Win32:MalwareX-gen [Drp]
AhnLab-V3: Trojan/Win.AntiVm.C5216535
Arcabit: IL:Trojan.MSILZilla.D76C1
Avast: Win32:MalwareX-gen [Drp]
Avira: TR/Dropper.Gen
BitDefender: IL:Trojan.MSILZilla.30401
Bkav: W32.AIDetectMalware.CS
CTX: exe.trojan.msilzilla
ClamAV: Win.Packed.Msilzilla-10026194-0
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
DrWeb: BackDoor.SpyBotNET.67
ESET-NOD32: a variant of MSIL/Agent.DWN
Elastic: malicious (high confidence)
Emsisoft: IL:Trojan.MSILZilla.30401 (B)
F-Secure: Trojan.TR/Dropper.Gen
Fortinet: MSIL/Agent.ECL!tr
GData: MSIL.Backdoor.SiRAT.A
Google: Detected
Ikarus: Trojan-Dropper.MSIL.Agent
K7GW: Trojan ( aaa0070a1 )
Malwarebytes: Backdoor.XWorm.Generic
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!4830C0961026
MicroWorld-eScan: IL:Trojan.MSILZilla.30401
Microsoft: Trojan:MSIL/AsyncRAT.R!MTB
Rising: Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Sophos: ML/PE-A
Symantec: ML.Attribute.HighConfidence
Tencent: Trojan.Msil.Agent.16001768
Trapmine: suspicious.low.ml.score
TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9Z
VBA32: Malware-Cryptor.MSIL.AgentTesla.Heur
VIPRE: IL:Trojan.MSILZilla.30401
VirIT: Trojan.Win32.MSIL_Heur.A
huorong: HEUR:Trojan/Agent.ai
tehtris: Generic.Malware

Hashes

MD5 4830c0961026e3c8c9f8795df408edbd 🔍
SHA1 28e21f567eb57a27211ddf1aa48d50422943d58a 🔍
SHA256 751b6b68106dd134ec72066359e9ff28cbdf8d7b43468c684541b5f21a44fbbc 🔍
SHA3 d1977e07592af2294acf5e7d6c1419c433f0505f8086aebaf1176af13f6da579 🔍
SSDeep 768:qm30t0OfgufvB5P3LUIg/sfthlJxtIWcbulfZyP5hJOPKs82e6jOb9:quSPfgKTPLUgtIWcbulSbOKuOb9 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2025-Apr-15 16:58:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0xd400
SizeOfInitializedData 0x800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000F33E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x10000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x14000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 41faeb6eeebad120cdc86c8a00bc8e90 🔍
SHA1 1dbb35649bc3ff6aaccb31f4706ab778abc58c2d 🔍
SHA256 814390f5a801c716698f9ecd67ccce12f2c6213eebc4bcc5ea0971de647d92e8 🔍
SHA3 ef8caeac3f1fd0554f0e875d60a1faff50f37c157c859a4848977635dc26678e 🔍
VirtualSize 0xd344
VirtualAddress 0x2000
SizeOfRawData 0xd400
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.70239

.rsrc

MD5 5952bd5b9684bf5032a02134551b8134 🔍
SHA1 47bd84d699c74cc5c29d4cd0aa521d77f3215ae1 🔍
SHA256 ca6ef957190f8115638a5b970a29d0868707efcddab566dd74a2c932ec8edb72 🔍
SHA3 3f32a927c11e5b01fd197c442e5572c64c9e475a912c04aff64d5643161dbde8 🔍
VirtualSize 0x5c2
VirtualAddress 0x10000
SizeOfRawData 0x600
PointerToRawData 0xd600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.13779

.reloc

MD5 f45cfbc4f2e1794c403b0a2d01db5ac8 🔍
SHA1 8da4a61553c0726ce4d1a9a737e8ff05544a742f 🔍
SHA256 220f63f546c1ef632a0a4f298c058e3307e3e3beb58fa4cfb5c116555dfaacbb 🔍
SHA3 9263e717242349996a63f8a866785909830cd9262fe2b202327772c9d1af9397 🔍
VirtualSize 0xc
VirtualAddress 0x12000
SizeOfRawData 0x200
PointerToRawData 0xdc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x338
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31914
MD5 e6ea0584e5601a6bee0bd4505dd82444 🔍
SHA1 b653d8fbe5c0e5edb1320a14b22985e0d9c5b0ab 🔍
SHA256 e1ba7616b64bfac96a8cc8dccc56c481b670e1199184bdb3d41796675dc46218 🔍
SHA3 704f8dfb8c55f94314a8a92eac8bf5b2f535547449cb6b92943283e3cd5149c0 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1 🔍
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650 🔍
SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f 🔍
SHA3 93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.2.0.0
ProductVersion 2.2.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments %Des%
CompanyName %Company%
FileDescription %Title%
FileVersion (#2) 2.2.0.0
InternalName 1l02hrmr.exe
LegalCopyright %Copyright%
LegalTrademarks %Trademark%
OriginalFilename 1l02hrmr.exe
ProductName %Product%
ProductVersion (#2) 2.2.0.0
Assembly Version 2.2.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.