4a0448f0bcb66a754accc928e6615a48

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2020-Aug-08 12:30:37

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info Interesting strings found in the binary: Contains domain names:
  • formats.info
  • io.formats.info
  • pandas.io.formats.info
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Leverages the raw socket API to access the Internet:
  • #14
Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 8991771 bytes of data starting at offset 0x7ca00.
The overlay data has an entropy of 7.99946 and is possibly compressed or encrypted.
Overlay data amounts for 94.628% of the executable.
Malicious VirusTotal score: 9/70 (Scanned on 2020-10-16 18:11:38) Elastic: malicious (high confidence)
APEX: Malicious
Avast: Win32:Trojan-gen
Zillya: Trojan.Badur.Win32.33894
McAfee-GW-Edition: BehavesLike.Win32.Trojan.tc
Jiangmin: TrojanSpy.Python.g
Antiy-AVL: Trojan[PSW]/Python.Agent
Microsoft: Trojan:Win32/Wacatac.C!ml
AVG: Win32:Trojan-gen

Hashes

MD5 4a0448f0bcb66a754accc928e6615a48
SHA1 6d1aaa0a0afa2e2c791d18f63c6fecd0787dbbdf
SHA256 e8152fd17813d3ccb22de8bbda943769ec34bd653f36e3cbb2a93c88535097dd
SHA3 643db87d9c8aa68016a16a5f0da267f337469c5e41c5117d4646861798078fbc
SSDeep 196608:TeUgxB/4zk6OIZwnKRDdbIR3HAslzpSCPZLd4WXu2RnbKF:T6Bwk6OIZwaDSpHAwzp9PZtXuOnb0
Imports Hash c184fcbbc27b7e1e70cee1414f8805d7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2020-Aug-08 12:30:37
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x1ec00
SizeOfInitializedData 0x5da00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00007913 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x20000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x8b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 8346d7b597b79a5b9388d8e0beb3ba2a
SHA1 823f172c7c4b90cacb3f7407e44c6dd2c39305fb
SHA256 a14b7424149187b033b07b673455d988bbfea92192d6a37b5f4559622adf3e1a
SHA3 1692355f6b94cb9664594cffded3b0b0b5425d431cf0925daa097ef96ee924a5
VirtualSize 0x1ea44
VirtualAddress 0x1000
SizeOfRawData 0x1ec00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.63246

.rdata

MD5 0b113fc9d0cc95d6127fa90c2420b919
SHA1 74048b3dfa7efc0a680a75aa64c82e1271000959
SHA256 f9bc1457f5f4f4b8c609c89ee99c959aef5a0f733a479b1b990025abfe9741b9
SHA3 94b263d423833d2e8afe2fa1ac0c40e36ff8740aa32044fac2dc9cdf77aad3e7
VirtualSize 0xb25e
VirtualAddress 0x20000
SizeOfRawData 0xb400
PointerToRawData 0x1f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.07927

.data

MD5 8d93bf8a4b47d996f38d4ef81b67be4c
SHA1 f1e4514c29ab716315873b45c0da19de3e9d3c7f
SHA256 268c684afffeb4fc356e61a6c3b58a088ab5e8b65d34c94aa394cd3e7e6e7038
SHA3 2895c387aeeef27b193e63cca6c2ab87e93d8fb3c695b4487c33ff7ab7f25bdb
VirtualSize 0xa670
VirtualAddress 0x2c000
SizeOfRawData 0xa00
PointerToRawData 0x2a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.91662

.gfids

MD5 d8de10cac2fdd51357403d755d0db68d
SHA1 fde6bdafea938da78fc0d1eaa49edd8e47a4ba20
SHA256 508e3ae6a756992c3c23294fd8796cf68bb9849f4d46ed6bf633f8ad5ba0f688
SHA3 e95a489c22ffa2dd147b9d1f8b4058e6fa373b0b79396e7efd8697ea4ce94d68
VirtualSize 0xb8
VirtualAddress 0x37000
SizeOfRawData 0x200
PointerToRawData 0x2ae00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.85015

.rsrc

MD5 1d66322c152dfea7c919ee1aee76bbe1
SHA1 892b20d847236ae81cdbcd720d539bb7a0f6a44c
SHA256 1f53ddff08ef5db07854af2c1f19410cf375b76681526e0efb7eb5763f09b95d
SHA3 58428173157aca1f6366231e7bd9b9e1842377a71417e69e131342d668c2c5af
VirtualSize 0x50088
VirtualAddress 0x38000
SizeOfRawData 0x50200
PointerToRawData 0x2b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.44724

.reloc

MD5 52f51996cfccbdd39996f1f28048415c
SHA1 94227d7e639154f5e00e42e71f2bd11c836c962b
SHA256 0e4e39d3d5ae7eb8bd6eca16e8b76dbb4d177c1a5ba9d29b02e2eea3f8ba031a
SHA3 0286aff619fcc3041060338a738652d008b97fed399bfc95a9064a3854bc5b9c
VirtualSize 0x17bc
VirtualAddress 0x89000
SizeOfRawData 0x1800
PointerToRawData 0x7b200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.63734

Imports

USER32.dll MessageBoxW
MessageBoxA
KERNEL32.dll GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
DecodePointer
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
CloseHandle
SetEndOfFile
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
RaiseException
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
ADVAPI32.dll ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll #14

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.36769
MD5 baa26ece6015914bfa414b3a32fd6341
SHA1 0cdc0183ca1209cbc255eb6afd94937bccafa92d
SHA256 05d4c3f5f398c2d2798afd42ada6755792a4803ee300a2e03fcb6358ffb94ea2
SHA3 7638817fe040bfcf5e5b91b494d1c9731cc5c6bfa53627a7899bb39f1686ab7d

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.44895
MD5 1c06420cfb94514d35c088699a04774d
SHA1 2c23d7df4bc8ce3fb15f33e78c042b12814aea3b
SHA256 d73c1848a067a0fd094423213dc1e855b5b29b0b441f0bcb315feb90d662972e
SHA3 a630c0bd054ccf853d3673897d2a553e10797d288b3f09898503304ecec7d7f3

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.77742
MD5 db1208cf5d76055be1c3a34567af9f5a
SHA1 c5adcd7407c8b18459e4b4ce96fb70ecf5701a97
SHA256 5a008270f7254f5ca861e9936f4b5b7a23c04d63165895234fd1782bc03ec0e5
SHA3 549076010917e74ff3fe656848779d90468b96740184b07016dbf2833e9abf99

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x952c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95095
Detected Filetype PNG graphic file
MD5 f6fbada22d6a6c07ef8fdaa504f117d5
SHA1 591a723501eff1a4920462f8efcaf3715e829450
SHA256 3919b11194f130d310dfe08bdce2891c5b64f2703107f53a5a1cbc016fdb609f
SHA3 ceca597fff3f436773eb9e48be245ce9d24439b9527a0d3aedaa1469e49d3f5c

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.0521
MD5 86ce219c337119fe35646823cb56d091
SHA1 74d3090f01f3128bda93a3a7525f139c495bffbd
SHA256 7ef5a24efde1748c0eb12c5817b14cfe1397ae968489a7824a269d02c8223cee
SHA3 8daaa7aab035df895cb478d3b92385d12aebd96c8bbde3a05a615ff56d41aebf

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15081
MD5 58b7700e8f20d0a3c77021eb7e7019dc
SHA1 87f7668b96ab48bd6ba5c8b9968dbb024a028407
SHA256 c5536b396be6dcfc96f4e4f77cc7007b2a56730ee57598a6979cc1c1c71c920a
SHA3 13bb36cea0c569109ddca6560016003d3ce662f8e0bc189e9750019ccdc7bc72

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.39466
MD5 9de69c1c4b3a06597da9c275b38bffb6
SHA1 a4ed3bd1bb4edc0eaa187b68929f596906e9ee87
SHA256 ac2e25dc4a4f7bd96a0bcf3ea63cd1bcf26a6f6a05835e32f96ef99cb4323f30
SHA3 6ff197b54509b5c0fa643d6bdbc756cccec2b5bc8495c770883c021e833f7509

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.67095
Detected Filetype Icon file
MD5 464cb94db3a2622922a9562865009ae8
SHA1 dbe17c767d942f219df59f9eae77b213c15eab70
SHA256 8affd1fa69a6c5a5b54e504d72d4e9a0eba9b7d702a445ea1399a5978794719a
SHA3 3e0e32110c6c0f3323eeeb5e4a6cbb7a8db52ab14e0f065384fb4eedac4fbcda

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 cd3a631eace19041876b4c4c6ec8461a
SHA1 d4b3f99c4d648e3446dc05e7fb6e444e42dfed01
SHA256 f5b94a42f1c77c9eef858a0dfd656419fea900b00318c2c0bf49c2fce345d838
SHA3 b6dcbb1b4c262eb5aee12773a52c29ff20fef809a4e61822700d005457944b9f

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2020-Aug-08 12:30:37
Version 0.0
SizeofData 696
AddressOfRawData 0x29fec
PointerToRawData 0x28fec

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x42c008
SEHandlerTable 0x429fe0
SEHandlerCount 3

RICH Header

XOR Key 0x3f8ef00d
Unmarked objects 0
241 (40116) 12
243 (40116) 171
242 (40116) 24
ASM objects (VS2015 UPD3 build 24123) 18
C++ objects (VS2015 UPD3 build 24123) 29
C objects (VS2015 UPD3 build 24123) 18
Imports (65501) 9
Total imports 115
C objects (VS2015 UPD3 build 24210) 16
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors