4ed0e81cd1146af999360689cbf171a02e4a946c226ae1a7a1e9037fc4d4ddc1
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Feb-09 08:57:36 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | The PE is possibly packed. |
Unusual section name found: \x00
Section \x00 is both writable and executable. Unusual section name found: .idata Unusual section name found: Section is both writable and executable. Unusual section name found: thjekpwo Section thjekpwo is both writable and executable. Unusual section name found: eyckmfdz Section eyckmfdz is both writable and executable. The PE only has 1 import(s). |
| Malicious | VirusTotal score: 55/72 (Scanned on 2025-05-23 05:11:47) |
ALYac:
Trojan.GenericKD.71672778
APEX: Malicious AVG: Win32:Evo-gen [Trj] AhnLab-V3: Malware/Win.Generic.C5588837 Alibaba: Trojan:Win32/PowerShell.2339cc35 Antiy-AVL: Trojan[Packed]/Win32.Themida Arcabit: Trojan.Generic.D445A3CA Avast: Win32:Evo-gen [Trj] Avira: TR/PShell.ufzkr BitDefender: Trojan.GenericKD.71672778 Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.17093427591bcf15 CTX: exe.trojan.themida CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS ESET-NOD32: a variant of Win32/Packed.Themida.HFL Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.71672778 (B) F-Secure: Trojan.TR/PShell.ufzkr Fortinet: W32/PossibleThreat GData: Trojan.GenericKD.71672778 Google: Detected Gridinsoft: Trojan.Heur!.038100A1 Ikarus: Trojan.Win32.Themida K7AntiVirus: Trojan ( 0040f4ef1 ) K7GW: Trojan ( 0040f4ef1 ) Kaspersky: Trojan.Win32.PowerShell.hfe Kingsoft: Win32.HeurC.KVMH008.a Lionic: Trojan.Win32.PowerShell.4!c Malwarebytes: Trojan.MalPack.Themida.Generic McAfee: Artemis!197B5C43CED7 McAfeeD: Real Protect-LS!197B5C43CED7 MicroWorld-eScan: Trojan.GenericKD.71672778 Microsoft: Trojan:Win32/Leonem NANO-Antivirus: Trojan.Win32.PowerShell.kjgstf Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Trojan.PowerShell!8.6469 (CLOUD) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Generic.tc Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.1402be1a Trapmine: malicious.high.ml.score VBA32: TScope.Malware-Cryptor.SB VIPRE: Trojan.GenericKD.71672778 Varist: W32/ABTrojan.IVCO-0433 Yandex: Trojan.PowerShell!ZuHHSUoOSsU Zillya: Trojan.Themida.Win32.100444 Zoner: Probably Heur.ExeHeaderL alibabacloud: Trojan:Win/Leonem.Gen tehtris: Generic.Malware |
Hashes
| MD5 | 197b5c43ced783cde519cec6801bcf15 🔍 |
|---|---|
| SHA1 | 01671df9e181e53a364413951ac60cfd91e002f3 🔍 |
| SHA256 | 4ed0e81cd1146af999360689cbf171a02e4a946c226ae1a7a1e9037fc4d4ddc1 🔍 |
| SHA3 | 7396c2b6c570c218537e35d2ecfa01190b2c5ee5b76a555c9bb97bce0ff93c95 🔍 |
| SSDeep | 49152:OQoeqSb4F6WriT81r1yxvGIAb5L7xC/MDqM:Oef4iToIwIAlPDD 🔍 |
| Imports Hash | 2eabe9054cad5152567f0699947a2c5b 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2024-Feb-09 08:57:36 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x26c00 |
| SizeOfInitializedData | 0x2c000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x004A2000 (Section: eyckmfdz) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x28000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x4a3000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1d7b10 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
\x00
| MD5 | 1c3ce88a09ca2740644ea5ca070ce09c 🔍 |
|---|---|
| SHA1 | c6f1e73aa561f9b7010718886e22c930d84723cd 🔍 |
| SHA256 | 8f4bcab0132b5a4d10d8f0968db3d88a4dc54d227957890eb21bbf496e01d7e9 🔍 |
| SHA3 | 31bc3c8f9e91fdd19ed29770a326139541578eaea0aa7013d673199290303ee5 🔍 |
| VirtualSize | 0x48000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x18600 |
| PointerToRawData | 0x1000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.9817 |
.rsrc
| MD5 | b889a209792b87e522744463fc16f0c3 🔍 |
|---|---|
| SHA1 | da130019a27dfc125472683f44cb2afe578e8548 🔍 |
| SHA256 | f8681d94f02559f9ee36e7bee3a49d66007c5fe4e49f77f351c746377594215c 🔍 |
| SHA3 | f8d777fa47d4586e885a099735115dd3c2b8bbb28ad9c5e1f721c561c01452ef 🔍 |
| VirtualSize | 0xb6c8 |
| VirtualAddress | 0x49000 |
| SizeOfRawData | 0x6600 |
| PointerToRawData | 0x19600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.94626 |
.idata
| MD5 | ce7bb5d09b02b3590a4d24d67fffcdbc 🔍 |
|---|---|
| SHA1 | 938e2c83fb13413e84423eaed38705bd9f95ba51 🔍 |
| SHA256 | 8b0c8cb1a5b6700bcc9665c3e6945ae8c9d962b4fa27a7078753e8722eb3e34c 🔍 |
| SHA3 | be497d77b10eb0642eddc67cd5315028b8d323b1eee2361e3023e7e19b841dc6 🔍 |
| VirtualSize | 0x1000 |
| VirtualAddress | 0x55000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1fc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.10975 |
| MD5 | 86b6501dd920d23e79fbd9fbf9f9d3f3 🔍 |
|---|---|
| SHA1 | 55187506025447689b1c9b2100501253705d2319 🔍 |
| SHA256 | 16aa011b8be09625142bfe644c29aa3790cf6cdd4ca9834dcb0dc8ccf00cf354 🔍 |
| SHA3 | 41531d0f2eac13bbd888c6975bd4e57ee1333ee3aef6024236d3eb079ad11114 🔍 |
| VirtualSize | 0x2a1000 |
| VirtualAddress | 0x56000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1fe00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.236539 |
thjekpwo
| MD5 | 1fa00908deee6bfb1ac5862b6617a9e1 🔍 |
|---|---|
| SHA1 | ae1204d513b2916bf28e49cd09d151b48dd9db22 🔍 |
| SHA256 | f2bc85cfaa2984b6a18e7932e241e36831bc59fe7937a46807d603ef4f93f11d 🔍 |
| SHA3 | de0e563b75fd9dd6b008ed43b9bc373947139b7026949d673fde74260ee1dd84 🔍 |
| VirtualSize | 0x1ab000 |
| VirtualAddress | 0x2f7000 |
| SizeOfRawData | 0x1aaa00 |
| PointerToRawData | 0x20000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.94003 |
eyckmfdz
| MD5 | 3819b49ddde9dbdc9319c2bc39ecd379 🔍 |
|---|---|
| SHA1 | 472fbab28a7f88972bd8873682324fc569a3e36a 🔍 |
| SHA256 | ad268ce74417d2c8a0d012b6a5c4100a3952f8172bb089b31734078dd5028e85 🔍 |
| SHA3 | e02075b1725bcea2fe8fe2616d61cba0876e7545cf5049b5ec39ae4dc1e53637 🔍 |
| VirtualSize | 0x1000 |
| VirtualAddress | 0x4a2000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x1caa00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 6.18807 |
Imports
| kernel32.dll |
lstrcpy
|
|---|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xea8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.03616 |
| MD5 | 68d4ccb2e2e5b5a0bcd1eec02bcbd1f6 🔍 |
| SHA1 | d49dc15e5fa6604266504c63ee1506140a88b2b8 🔍 |
| SHA256 | 53a9274b19ec47518acee84e68c85602de91e875f7990e02d45299992b3b2b0c 🔍 |
| SHA3 | fdd7f00759095c4be84da293e129f73420282a06222f2b3a85983be5156c35d1 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x8a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.32794 |
| MD5 | 78810171a52f6c1dc0ecc11f857a01d9 🔍 |
| SHA1 | 5237c3194b8056c116b34a3b858ab32a3386879f 🔍 |
| SHA256 | fa5ae7fddc752427dd8822bb819a91b1737ec45a98612db131d74da97439ffa8 🔍 |
| SHA3 | eecd6d95b172cd6b6791cc2103653e3e552e7fbf88bea66f789aebdabd9974f6 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x6c8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.46563 |
| MD5 | 891e549dc4e3e69955343c0381119887 🔍 |
| SHA1 | e11aa320c0981937ffaae2e4a1a119aa23ea4a55 🔍 |
| SHA256 | 0669bc2849347eaa423479a3f6752e4a63159acb08b72a9d523da188df87cd4b 🔍 |
| SHA3 | 2cc83878fbc451effaf5d1f724dc48423f1add933ddb1d0afe3f6cd84868b881 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x568 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.63078 |
| MD5 | 5a179c4495d41ba1c4d732ddcf708ed2 🔍 |
| SHA1 | d8c90b07978436161b98927fd94fbd7332726f93 🔍 |
| SHA256 | 69b9ffb6e5c3e1183d1ecb4c8727e5ce46feed12ad092d3a593cefe2488c2477 🔍 |
| SHA3 | 839ed8d9d8fd2c251c3a3af4ce0d36ef8b497285aa475867d4c683f1e8e07890 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4a88 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.93914 |
| Detected Filetype | PNG graphic file |
| MD5 | 7e1089f3192e5e6458e49b1adf00831f 🔍 |
| SHA1 | 332accd20841dc7a9f7467fcf2ca9319cf267152 🔍 |
| SHA256 | 2f2095bdf6f632b944062250f983a247a01814576a1746b076bf16bcef8a4fa0 🔍 |
| SHA3 | 0ed847f4929a0b71f1287845e494aa285192dee707f16f58ddd78f6d68fa7752 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.60098 |
| MD5 | 3ceb81d4ef810aa85c8462926c977f6f 🔍 |
| SHA1 | efdd87368433e9b86f18c17a312c7b3697255c31 🔍 |
| SHA256 | c5544e8d6f58b2e95aea77717ecdbfb7049efdbb311bc52e753ec18773caece6 🔍 |
| SHA3 | 406580905ff49d18cefb1c155f11b0f1a23b6b8ac51155c382dde196ade4fc07 🔍 |
7
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.80743 |
| MD5 | 20873d83f482d0749ca09f15218067c5 🔍 |
| SHA1 | 6844d02367170a941c18a51a3c0cadd5165fd76a 🔍 |
| SHA256 | c700b4835ee549fb9cef96bd5afd6701df8e9cf0bec488979747651b611e3853 🔍 |
| SHA3 | 473213924a83474d8d7345f221ca516fbee39a78b43daa1a989825b760e80d19 🔍 |
8
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.00757 |
| MD5 | 02fb286f31c215e63fde597d8d59c174 🔍 |
| SHA1 | 21f171aea44098bb41fd634af14868f503ac6742 🔍 |
| SHA256 | b06c1367f8f1447a17eacc05253325fea787f2b1993997b6b0c47ca8fbdf6381 🔍 |
| SHA3 | 0bf8ce2de7e8ee6a9e5f94b751e4dca56c2eb8d2eaa918c3babe31e55a89d338 🔍 |
9
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.16172 |
| MD5 | 3b12148b172eb8b0ec0e7ff356209875 🔍 |
| SHA1 | ca3d8f771db2b1f6b8b773f597f97dabab382dbe 🔍 |
| SHA256 | dcdbbd128df3c2cbb2a6d700196f60a2cf74d753343fc00d01876be2cc0fbc7f 🔍 |
| SHA3 | f05c5192c750e09631e47792bdca3c3697a1cac6776c2cf2a75d8d940a53e6f5 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x84 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.84784 |
| Detected Filetype | Icon file |
| MD5 | 91ae43283421add942059ac6ecde4b20 🔍 |
| SHA1 | 69250acb9dacd1cb0dbdfcc83266b1e52e1d3ab0 🔍 |
| SHA256 | c1aa9d09d7bf783cd94379adb5b81122437f203d1838fda86d2ad65681216854 🔍 |
| SHA3 | e1263290c2dc8f762fa98ff084337df307d1316c4e76b77330b1ef45b8c43c28 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x188 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.89623 |
| MD5 | b8e76ddb52d0eb41e972599ff3ca431b 🔍 |
| SHA1 | fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍 |
| SHA256 | 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍 |
| SHA3 | 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍 |
Version Info
TLS Callbacks
| StartAddressOfRawData | 0x447000 |
|---|---|
| EndAddressOfRawData | 0x447008 |
| AddressOfIndex | 0x896374 |
| AddressOfCallbacks | 0x89637c |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
| XOR Key | 0xb570225c |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 22 |
| Imports (23013) | 4 |
| ASM objects (23013) | 11 |
| C++ objects (23013) | 28 |
| C objects (23013) | 13 |
| Imports (65501) | 19 |
| Total imports | 268 |
| C++ objects (LTCG) (VS2015 build 23026) | 4 |
| Resource objects (VS2015 build 23026) | 1 |
| 151 | 1 |
| Linker (VS2015 build 23026) | 1 |
Errors
Leave a comment
🏧 New Message from Coinbase. READ ⭐➤ graph.org/YOU-HAVE-A-NEW-BI
5 hours ago
🏧 New Message from Coinbase. READ ⭐➤ graph.org/YOU-HAVE-A-NEW-BITCOIN-TRANSFER-FROM-COINBASE-08-27?hs=59975a0b87b2adf76d7ecfd7eac0e7d3& #UY9425 🏧