| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2020-Mar-11 00:58:39 |
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 16/71 (Scanned on 2025-04-03 11:36:03) |
APEX:
Malicious
Antiy-AVL: GrayWare/Win32.Wacapew CAT-QuickHeal: Trojan.Ghanarava.1743174020948393 CTX: exe.trojan.zpevdo CrowdStrike: win/malicious_confidence_60% (W) Cylance: Unsafe DeepInstinct: MALICIOUS FireEye: Generic.mg.4bb302094b87e7e8 Kingsoft: malware.kb.a.735 Lionic: Trojan.Win32.Zpevdo.4!c McAfee: Artemis!4BB302094B87 Microsoft: Trojan:Win32/Zpevdo.B Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Trojan.Zpevdo!8.F912 (CLOUD) SentinelOne: Static AI - Suspicious PE |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2020-Mar-11 00:58:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1bc00 |
| SizeOfInitializedData | 0x9e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00007E84 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x1d000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x29000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| WINHTTP.dll |
WinHttpCloseHandle
WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpOpen |
|---|---|
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| ADVAPI32.dll |
RegEnumKeyExA
RegGetValueA RegCreateKeyExA StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA ReportEventA RegisterEventSourceA DeregisterEventSource RegSetValueExA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey |
| KERNEL32.dll |
SetStdHandle
GetStringTypeW FlushFileBuffers CreateFileW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW RtlUnwind Sleep FindClose FindFirstFileA FindNextFileA GetLastError CreateProcessA GetModuleFileNameA SetEvent WaitForSingleObject CreateMutexA CreateEventA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType CloseHandle GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetFileSizeEx FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Mar-11 00:58:39 |
| Version | 0.0 |
| SizeofData | 712 |
| AddressOfRawData | 0x22eec |
| PointerToRawData | 0x21eec |
| Size | 0xa4 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x425010 |
| SEHandlerTable | 0x422ee0 |
| SEHandlerCount | 3 |
| XOR Key | 0x8678bb24 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS2017 v14.15 compiler 26715) | 11 |
| C++ objects (VS2017 v14.15 compiler 26715) | 149 |
| C objects (VS2017 v14.15 compiler 26715) | 18 |
| C objects (26504) | 17 |
| ASM objects (26504) | 19 |
| Imports (VS2017 v14.15 compiler 26715) | 9 |
| Total imports | 113 |
| C++ objects (26504) | 42 |
| C++ objects (VS2019 Update 2 (16.2) compiler 27905) | 4 |
| Linker (VS2019 Update 2 (16.2) compiler 27905) | 1 |