48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-04 20:34:37
Detected languages English - United States
CompanyName Madium
FileDescription Madium Installer
FileVersion 1.0.7
InternalName Madium Installer
OriginalFilename Installer-1.0.7.exe
ProductName Madium Installer
ProductVersion 1.0.7

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qeMu
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Malicious The PE is possibly a dropper. Resource PAYLOAD_CAB detected as a CAB Installer file.
Resources amount for 98.3359% of the executable.
Malicious VirusTotal score: 6/69 (Scanned on 2026-08-05 18:02:52) APEX: Malicious
Gridinsoft: Trojan.Win64.Wacatac.bot
Microsoft: Trojan:Win32/Wacatac.B!ml
Rising: Trojan.Kryptik!8.8 (CLOUD)
Trapmine: malicious.high.ml.score
TrellixENS: Artemis!32E6C794181E

Hashes

MD5 32e6c794181e84ec3ddb154ed5e65391
SHA1 9a6f359a8ba80338cc83200e8b6b0b06a9d4e290
SHA256 48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce
SHA3 edf9fcf5b8f9355bab626c58d3b943f93326d2de0c98b510d44b54b279e51a5d
SSDeep 196608:/CIlL/mwLN9H3eeYbuN3VdC61kyGxyzriAZOLqJt6dl:awL/mINZePbtyviOt6d
Imports Hash ba05043eefc1997d10bc26b9e9bbe77d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-04 20:34:37
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x17000
SizeOfInitializedData 0x9b0a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008C90 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x9cc000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 659bbaf4c812881c46353e6b24006ad8
SHA1 e11f9fe67b596a7dcfee895b5791d0a5782b2275
SHA256 4d0a37d31496bc287edba98706ec9bff6e130576160dd1436d11aab99add752c
SHA3 902491cbbd9c9a2d7a23cd072d0c92f56b05885a53755efe1c2154829f13d04f
VirtualSize 0x16e30
VirtualAddress 0x1000
SizeOfRawData 0x17000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.37504

.rdata

MD5 bc8b2be086150417462d3f44bf607d16
SHA1 3dbf05a19e606b0ed02ce923752841e3b9d09176
SHA256 c6d2749c77fd2cb2daf231108768be42409c33f2d9cfc163909f8557f02c10b7
SHA3 826f324a65f3cf81be972f4a322f57244065ea8415cbd95e13c9fb8b5c134123
VirtualSize 0xf1c8
VirtualAddress 0x18000
SizeOfRawData 0xf200
PointerToRawData 0x17400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.99303

.data

MD5 428669d59d9fa4957096403c9230adfa
SHA1 099466b163ddafa3c45b159a74c7d03ae427a217
SHA256 f524c441bd2c59429c4c8a74e3504e76892d584e89c29d89ee3cab74d61ff9d3
SHA3 8475a70d3f3f96ceca5221674d1fde7309a9d5cd58805581fa3701f7a5c61601
VirtualSize 0x18e8
VirtualAddress 0x28000
SizeOfRawData 0xe00
PointerToRawData 0x26600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.47481

.pdata

MD5 0b4beb15002f89ee2f2f32a0eb940535
SHA1 decd7ff93629e267c32ea9394a3536135a279ab4
SHA256 bd3bfc0e99f260406b312f3b46ed39bb3f6019c6cac7ff025be13abbde3b050a
SHA3 8e4c96b23a24b67a27d512dd7e21798c7cd9a90b13914933ae462ee9ab82d885
VirtualSize 0x17dc
VirtualAddress 0x2a000
SizeOfRawData 0x1800
PointerToRawData 0x27400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.19051

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x2c000
SizeOfRawData 0x200
PointerToRawData 0x28c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 e7b3b54a76b2480f0154c868e8d9fa78
SHA1 f874402c534869fcef8865ea755c0fc323a8fd6b
SHA256 3df709e798ceb0ffaf156262cbbac3d54796f20fb563be3198637b256ae02598
SHA3 d812c75a4b580859403942e690778069ec25345a85548d1a6b7d77647be85d18
VirtualSize 0x99da58
VirtualAddress 0x2d000
SizeOfRawData 0x99dc00
PointerToRawData 0x28e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99989

.reloc

MD5 3d5f82b8dfcb2f46ee8d0537a721269e
SHA1 6fd2ed0534b9199ebab01d458630dbea0f3b7e92
SHA256 4dce1b11f26d5b6b9bef87cd1355e84f367a05c0146e3bdaaf8a372aad3d1e8f
SHA3 c5123068a68cbd64d32439c664db4454542e0ba314cdb1246859edcb4d321201
VirtualSize 0x76c
VirtualAddress 0x9cb000
SizeOfRawData 0x800
PointerToRawData 0x9c6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.27227

Imports

ole32.dll CoTaskMemFree
CoCreateGuid
StringFromGUID2
SETUPAPI.dll SetupIterateCabinetW
SHELL32.dll SHGetKnownFolderPath
KERNEL32.dll RaiseException
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
CreateFileW
WriteFile
GetTempPathW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
FormatMessageW
FlushFileBuffers
HeapReAlloc
HeapSize
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
CreateFile2
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCPInfo
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
USER32.dll MessageBoxW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.35891
Detected Filetype PNG graphic file
MD5 5e81a9ace64009356dc6a77d38f15b8d
SHA1 27412b972349f357059bd6de6205aae6b74ff32c
SHA256 f85e26b3ad984f7875e0be6aa1117afc2f4d3d443d60106b092b677caff47765
SHA3 f3b28e9e288878794a84eba132e87200e3c8b15b4c80696f9c14d1004d72fbc4

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x354
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.59485
Detected Filetype PNG graphic file
MD5 28981e7375c29afac679019925c74e44
SHA1 911090164cde5f094c60621cda639c2d0e99364f
SHA256 7f182b2de61e1c1aee9ad6cb7f11759a20d51531d281b7b95c412085b66b9b6c
SHA3 003fc5d3b798ae21f313082ca1a9ffb1425bb4ce6d04288943155f153357f05c

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4de
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.71597
Detected Filetype PNG graphic file
MD5 650b67b0c820222c8521f989f335c7b5
SHA1 4eb7846cc085744f4bb8aac93e69a93b8c6710db
SHA256 11a70476f237d7067e33c2adb2356f07e9dd8c4ca9c9b74b2dd46a17e12dbb9e
SHA3 aa2fd0fb653f66878dc42141e9cd02ff206ff3c593bb325529fd27fa00af490c

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8c2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83025
Detected Filetype PNG graphic file
MD5 1fefa531027737a235dfb2380ba595c7
SHA1 a8a38136c6dcfc60ae6f80cebf3c44253d0ebf0d
SHA256 32bdfb7526ed13b9a57cd51c741eee3afb3e1e4f5d99fc997a08948f4484583b
SHA3 af7ef8168c99fb40fae7e8a8881e3d84abdaa28b590b9ee1e7f6196494ed9f84

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xd8a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89639
Detected Filetype PNG graphic file
MD5 224d99a1a75afd8495cc4c64761ae52d
SHA1 6b4e3e27a2dfed96328797daded31dc9f08ff384
SHA256 463b30e4c6fff3f5cb7e2ca3e50fbee8b88bd8e50e9be4ea8db8f5022e7bf2bf
SHA3 041ca44186128bd2ad0ad25166b11a8e3a71927575477ffd25bc9a4adfd9452a

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2960
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96573
Detected Filetype PNG graphic file
MD5 f41396166cc3887c6d65aaaadcdbee7e
SHA1 35ae644d5dd9deb13e89c1189137f56a0d696da9
SHA256 2fe6519dc4788ba0bdf899ae09f35f44b61f13beb726460523099db8ce2d00f3
SHA3 6b9d511b172248f9bc2a2ff9b570c100feb9e2c5531382cf34a55989b971496e

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x89f1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98333
Detected Filetype PNG graphic file
MD5 a5bdd087ec2652239b6f4652d435cbb3
SHA1 d4b81d3fbab116afc6c5113659c7274116ded175
SHA256 3afaa7c52c41b492a4789d7e8b2eb2ac996fb360db6a7801a40d5295cd91a667
SHA3 4350c2b5e0610b019f4f0ffad9f195be68116520b03661aa3587a0691f380320

PAYLOAD_CAB

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x98ff48
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99991
Detected Filetype CAB Installer file
MD5 49de82f364eb0221878ee9c3cffde6da
SHA1 61a4d4203e123989dbe5126d41474c0f1c802362
SHA256 39fadbc716594029da8fcc4f780955f26f1023a2e1b9987f2fe5ad162645a056
SHA3 fd16ceeea04a7d1240b472cf32ea5567b5172dc748d700c0b8e823fdc98407aa

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.85168
Detected Filetype Icon file
MD5 d9a266e6675bd99f642dab08e77169f1
SHA1 c25af2445b30e90c11103393018aeedb04c60afe
SHA256 826e26f3784b385845452d976343221b39858abda9359366f332cb90961b12a2
SHA3 c7cad0bc352c570467f9be06f17e6e75408a39de4d3ccaa8a214ff26cb1bcff7

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x28c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26238
MD5 a679ae510e2086b8167431ed47ed824f
SHA1 48173f7d6f2492b8f6ee99b85d3919dcb25ffa29
SHA256 2cf5f9f5cf2f49023fcce2f3260e0c33243da6941c0a2792ded260098e566912
SHA3 a262986bcacdace9d78ff887e25c883f2e6ffee7f7191f8019cf7cd8f2968b31

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.7.0
ProductVersion 1.0.7.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Madium
FileDescription Madium Installer
FileVersion (#2) 1.0.7
InternalName Madium Installer
OriginalFilename Installer-1.0.7.exe
ProductName Madium Installer
ProductVersion (#2) 1.0.7
Resource LangID English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-04 20:34:37
Version 0.0
SizeofData 840
AddressOfRawData 0x24410
PointerToRawData 0x23810

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140028040

RICH Header

XOR Key 0x2757c31e
Unmarked objects 0
C++ objects (33145) 142
C objects (33145) 12
ASM objects (33145) 7
ASM objects (35721) 10
C objects (35721) 16
C++ objects (35721) 47
C objects (CVTCIL) (33145) 1
Imports (33145) 11
Total imports 126
C++ objects (36252) 1
Resource objects (36252) 1
151 1
Linker (36252) 1

Errors

Leave a comment

No comments yet.