54b3a02098d4af1df2220171c0496981d90d82dc51e4cb074351f3a42e9d58a7
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| CompanyName | |
| FileDescription | Tor Browser Portable Installer |
| FileVersion | 0.0.0.0 |
| LegalCopyright | © 2026 The Tor Project |
| OriginalFilename | |
| ProductName | Tor Browser |
| ProductVersion | 0.0.0.0 |
Plugin Output
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 |
| Suspicious | The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable. Unusual section name found: UPX1 Section UPX1 is both writable and executable. The PE only has 7 import(s). |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 37/69 (Scanned on 2026-08-28 04:04:50) |
APEX:
Malicious
AVG: Win64:Malware-gen AhnLab-V3: Packed/Win.Obfuscated.R788587 Alibaba: Trojan:Win64/Obfuscated.f6a15d95 Avast: Win64:Malware-gen Avira: TR/W64.Malware Bkav: W32.Malware.E3E71352 CTX: exe.trojan.obfuscated CrowdStrike: win/malicious_confidence_60% (W) Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: WinGo/Packed.Obfuscated.D suspicious application Elastic: malicious (high confidence) F-Secure: Trojan.TR/W64.Malware Fortinet: Riskware/Application GData: Win64.Trojan.Agent.V2QR9L Google: Detected Gridinsoft: Trojan.Win64.Packed.sa K7AntiVirus: Riskware ( 005cddc81 ) K7GW: Riskware ( 005cddc81 ) Kaspersky: HEUR:Trojan-Spy.Win32.KeyLogger.gen Kingsoft: Win32.Trojan-Spy.KeyLogger.gen Lionic: Trojan.Win32.KeyLogger.1J!c McAfeeD: ti!54B3A02098D4 Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Rising: Trojan.OverlordRat!8.1E02E (TFE:5:7FK3HH6q2pJ) Sangfor: Trojan.Win32.Obfuscated.V3q2 Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Win64.Trojan.Generic.Uwhl Trapmine: suspicious.low.ml.score TrellixENS: Artemis!3DC52C6537F9 TrendMicro: Trojan.Win32.KEYLOGGER.USBLHR26 TrendMicro-HouseCall: Trojan.Win32.KEYLOGGER.USBLHR26 Varist: W64/ABApplication.GMIC-4409 alibabacloud: Trojan:Multi/Wacatac.B9nj |
Hashes
| MD5 | 3dc52c6537f9325b29d0a7bb7165a9d0 🔍 |
|---|---|
| SHA1 | fca6d975d12ddb3d11c36f93bde24b6040dbaf43 🔍 |
| SHA256 | 54b3a02098d4af1df2220171c0496981d90d82dc51e4cb074351f3a42e9d58a7 🔍 |
| SHA3 | 66ed6d423b7bf319723e4b8b5e57ffceebb12d4e670e08efebba3529dbe62801 🔍 |
| SSDeep | 196608:6j2J/Ml+tf8vkbJdER4WwQTaKvL1lfIDW5p2nwGpz7uO9Slo1E:PJ/zucbJ6xW0RlfIEYwGpRSK1E 🔍 |
| Imports Hash | 815498dd6caabe57f34cbb6bcf9662c7 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x8fd000 |
| SizeOfInitializedData | 0x10000 |
| SizeOfUninitializedData | 0x3239000 |
| AddressOfEntryPoint | 0x0000000003B36680 (Section: UPX1) |
| BaseOfCode | 0x323a000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3b47000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
UPX0
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x3239000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
UPX1
| MD5 | cbcb2b138b7048d7aaaf60971b4ff9ca 🔍 |
|---|---|
| SHA1 | 1306cb20c04a80cfd3d56fa196aeabc41ba36310 🔍 |
| SHA256 | cbbda5ea40089d01eccdd4c692fcfcf012b553bf45046c83415ca171762da782 🔍 |
| SHA3 | c2851e682736a1f0fe6c88ff60eb337d57dc9ad367eaa38b617ae4ef665a9dfb 🔍 |
| VirtualSize | 0x8fd000 |
| VirtualAddress | 0x323a000 |
| SizeOfRawData | 0x8fca00 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.92583 |
.rsrc
| MD5 | da4176f3ca3e3039aa2d6f340c54f6d9 🔍 |
|---|---|
| SHA1 | 4e83909af6a9a3f85da3bf36103ac4d8fb797faf 🔍 |
| SHA256 | 83e81a123a591d8a0d9c9a562ea4801630e35ceeb9805d060de00dd4949ded2b 🔍 |
| SHA3 | 70970e27e16223abc6f5e8c09fa4f7a896cbad7fd2b9c357ad9dccd44ff137cd 🔍 |
| VirtualSize | 0x10000 |
| VirtualAddress | 0x3b37000 |
| SizeOfRawData | 0xf200 |
| PointerToRawData | 0x8fcc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.62685 |
Imports
| d3d11.dll |
D3D11CreateDevice
|
|---|---|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess GetProcAddress VirtualProtect |
| msvcrt.dll |
exit
|
| ole32.dll |
CoTaskMemFree
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xabb2 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.98778 |
| Detected Filetype | PNG graphic file |
| MD5 | d2e91764eb48dd419290923c3acf126a 🔍 |
| SHA1 | a976a4839ec86ba618913912ebace46f2afd02ab 🔍 |
| SHA256 | c979c8d48a76f34a766d0fe55bcaf1ea95875f54bfd9ddefa8eb214e2aaf80cc 🔍 |
| SHA3 | 3b45c072e9448b195b4ae0973ecccc51b72fde6d0589c7f4f08d792be372f6ed 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.77232 |
| MD5 | 85f6cd3eebdec779b245881041d8b971 🔍 |
| SHA1 | dbfdd89df760534f1da6cb898108bd40ab0423cb 🔍 |
| SHA256 | d9cf0482d9360a9fd22f004cd4a81557e1a5bcb2082ce736bde4858cccda112e 🔍 |
| SHA3 | 205e7fa033cce82f70124e855556aa228e12cd3b1c66cb2e86596f76022bbc4a 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.87411 |
| MD5 | d104235612bf2219af29a5f72c3d1159 🔍 |
| SHA1 | 39c3a0f70210ecee68a1d8af2dbc6cb89ab2412c 🔍 |
| SHA256 | b5e0e6b524c39d403f9b9ad42cfcaf17d48d0c05bc6f25b217867442332800af 🔍 |
| SHA3 | 93f1cfc6b896e4fca390e0ac2fe13e18155201d244a00f75dd2eec44790ab808 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x568 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.85544 |
| MD5 | 0312bdf004962b28188fb370eacbf474 🔍 |
| SHA1 | 9a71252e8439a0e33cebe3a9edf2f9c24594ad6e 🔍 |
| SHA256 | 24f81ece8832fb8301e3136c18af9196571224ed3428c9f4ade8166ba3d1bdc9 🔍 |
| SHA3 | cd060adc372e7e91e99c57a65100e723d178ec53a75f8558e874ac4861a4bcd1 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x3e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.49052 |
| Detected Filetype | Icon file |
| MD5 | ad2d2e5ded5fea5916e1e2612fa95ae1 🔍 |
| SHA1 | e70319152001aa4d707b75062b7951a60cd578e1 🔍 |
| SHA256 | e04b5ac7c38cc464864cd49a389397c2c61b12a03e9549f14c5a4c628a20a795 🔍 |
| SHA3 | 722ca7a72551221b247e6a5bc68b5febff4933111e74c0b548f55234124820d4 🔍 |
1 (#3)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x284 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.25341 |
| MD5 | 820097110c057c0d7aa3353e24a7d8d8 🔍 |
| SHA1 | b070008379ea4ca9af5e91db6ab5b2ec79fe172c 🔍 |
| SHA256 | 310635a225351f764aafe7931a56c37b290cff69161e1ed0f330708187e2cb41 🔍 |
| SHA3 | 4a20e492613a72c520849bbcbd20da8d8206a9ae3ae1cea6ac824b4339c06ce8 🔍 |
1 (#4)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x480 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.23942 |
| MD5 | 292931e5438fed33a4699934190d032c 🔍 |
| SHA1 | e0764129a264fbcf49fc2746c3c38d723128f3c5 🔍 |
| SHA256 | 4892b08b7267ebbb9e0b1b2c8bd26eeb759159395b2908f6d576b737b57af67a 🔍 |
| SHA3 | 44837b6d22c887cf9ecdf186753e8f7732853ed04d912ce2998685da553010f4 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | |
| FileDescription | Tor Browser Portable Installer |
| FileVersion (#2) | 0.0.0.0 |
| LegalCopyright | © 2026 The Tor Project |
| OriginalFilename | |
| ProductName | Tor Browser |
| ProductVersion (#2) | 0.0.0.0 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x143b36920 |
|---|---|
| EndAddressOfRawData | 0x143b36928 |
| AddressOfIndex | 0x143ac9eec |
| AddressOfCallbacks | 0x143b36928 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000143B368D0
|
Load Configuration
RICH Header
Errors
[*] Warning: IMAGE_EXPORT_DIRECTORY field Characteristics is reserved and should be 0!
[!] Error: Could not read the exported DLL name.
[*] Warning: Section UPX0 has a size of 0!
Leave a comment
No comments yet.