Manalyze report for 57f743d652b9da2e4c90157729c34b2126223872dbfca028708f6e8ea5cce9ab

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	1970-Jan-01 00:00:00
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	PEiD Signature:	`HQR data file`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: procexp.exe procmon.exe regedit.exe taskmgr.exe wireshark.exe` `Contains references to debugging or reversing tools: ida.exe idaq64.exe ollydbg.exe windbg.exe x64dbg.exe` `Looks for VMWare presence: vmware` `Looks for VirtualBox presence: vboxservice` `May have dropper capabilities: CurrentVersion\Run` `Miscellaneous malware strings: cmd.exe` `Contains domain names: .eq.golang.org .hash.net eq.golang.org golang.org https://backup.example.comreflect.Value.CanInterfaceinvalid https://c2.example.comSao https://go.dev pipeunixopensynclinkStat.com`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW LoadLibraryW` `Functions which can be used for anti-debugging purposes: SwitchToThread` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect`
Malicious	VirusTotal score: 14/44 (Scanned on 2026-08-21 02:01:24)	`APEX: Malicious` `Antiy-AVL: Trojan/Win64.GenKryptik` `CTX: exe.trojan.tedy` `CrowdStrike: win/malicious_confidence_70% (D)` `Emsisoft: Gen:Variant.Application.Tedy.47537 (B)` `GData: Gen:Variant.Application.Tedy.47537` `MaxSecure: Trojan.Malware.578651905.susgen` `McAfeeD: ti!57F743D652B9` `MicroWorld-eScan: Gen:Variant.Application.Tedy.47537` `Paloalto: generic.ml` `SentinelOne: Static AI - Malicious PE` `Symantec: ML.Attribute.HighConfidence` `TrendMicro-HouseCall: Trojan.Win64.TEDY.TL0101HK26ZC` `Varist: W64/ABApplication.NIDW-4973`

Hashes

MD5	`d997a891581b3f02e7f146020c86dd6d` 🔍
SHA1	`eea747526784f1f37eb4a412421a221d74d9796f` 🔍
SHA256	`57f743d652b9da2e4c90157729c34b2126223872dbfca028708f6e8ea5cce9ab` 🔍
SHA3	`045ac2b28200d439a8b33197048985f4e7bb8bd15d4be11baa428aa0911d3515` 🔍
SSDeep	`49152:CnQmC03NGYOm4mZ0IprGVibTh4/xuvrGM2lHPVibU1y3YmO5ErAbnVmWtKwKeK9:CncknWg6/8rZ2lve5YhEkeD` 🔍
Imports Hash	`021da885c433bd2cd088583921fd92f6` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x298c00`
SizeOfInitializedData	`0x5bd800`
SizeOfUninitializedData	`0x56600`
AddressOfEntryPoint	`0x00000000000014D0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.1`
ImageVersion	`0.0`
SubsystemVersion	`6.1`
Win32VersionValue	`0`
SizeOfImage	`0x61a000`
SizeOfHeaders	`0x400`
Checksum	`0x5c3838`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`6cd2c6b6ffd01b2eed0db6f254c82579 🔍`
SHA1	`18f3dab752635ea31a7a898ea9238776bae63628 🔍`
SHA256	`5db0cea508ec46c7c02f4f67db786410ffa67cd8c5a91502485d48ce27803e71 🔍`
SHA3	`a2f2773178aa22830602cd77c697a3d31dc5ad53db6931b6e1df5c4c1f4b6424 🔍`
VirtualSize	`0x298ae0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x298c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.21996`

.data

MD5	`6f32737e2ce522c45efd386553c8d3a6 🔍`
SHA1	`60b37f597ef600bcf2e4fadd33d83de4cfdc3405 🔍`
SHA256	`3015a9abdb30c7121e63be2c70c92431b30412d0c2a87dac31456e4d575282f8 🔍`
SHA3	`b2b1bd0a0823dff704b9d3b56d566bed02722212f0fc902ee378f62eb3600c17 🔍`
VirtualSize	`0x52d20`
VirtualAddress	`0x29a000`
SizeOfRawData	`0x52e00`
PointerToRawData	`0x299000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.90944`

.rdata

MD5	`40fe6275069f2f9a9e7bac1d1026179c 🔍`
SHA1	`80bd9005c200972ae5db59ac7e65c3edd3909505 🔍`
SHA256	`25a39eb1fcb2bd287b6aad35b1844721e7b9cf44474cac8ca76726e2d06026f2 🔍`
SHA3	`e82e886d0a2a54e74dd48b527b2ffac404a6d46f8e32bc938d800686e4e01cac 🔍`
VirtualSize	`0x2b3c00`
VirtualAddress	`0x2ed000`
SizeOfRawData	`0x2b3c00`
PointerToRawData	`0x2ebe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.60593`

.pdata

MD5	`704b28e62b3cdc3b811f77675a11a8ae 🔍`
SHA1	`79ba54971621d9991cfcbd76dcd26af891cbe362 🔍`
SHA256	`a28119991a5d26c3536dd9bbf30f3d4a9833a1212493a6f79f6b04043716e9b5 🔍`
SHA3	`7334512b560e4cef32c3fdba2b037a0280fe124af53f440b32c840f9ddec393f 🔍`
VirtualSize	`0xf6a8`
VirtualAddress	`0x5a1000`
SizeOfRawData	`0xf800`
PointerToRawData	`0x59fa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.5882`

.xdata

MD5	`46386b288d79e599ac6ff0ec8fdebdcc 🔍`
SHA1	`649f6fd28d7ba7bc6337f7d1f4826268c37041c3 🔍`
SHA256	`01e0c09afa8231f2d5e375c64612b536f46d899e106f12ecb468a2310aa44adb 🔍`
SHA3	`da5e3e5ce87d7b336b093635b8275c7ec253e508f9948306177449486c60f80e 🔍`
VirtualSize	`0x5b8`
VirtualAddress	`0x5b1000`
SizeOfRawData	`0x600`
PointerToRawData	`0x5af200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.24973`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x56530`
VirtualAddress	`0x5b2000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`beadf111248d71e1832f9df0aad9878c 🔍`
SHA1	`fe382b45a7f6bc4f9fa0c75a5da1a284f2394a99 🔍`
SHA256	`8ae95b68d02959b10f403f907e0edfcbe0c7011c45e51edc2b1bfbf33ce584fc 🔍`
SHA3	`295fa54b2dd202fdc4dddba62bb479b80685e300d8a43ffaae71ebacd436017b 🔍`
VirtualSize	`0x4e`
VirtualAddress	`0x609000`
SizeOfRawData	`0x200`
PointerToRawData	`0x5af800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.834874`

.idata

MD5	`f92668f8fded90b2e6b8fac6b1043764 🔍`
SHA1	`ceda9f80fca96f76c83ab4604509623c7cab16bc 🔍`
SHA256	`5ad532a175c0f24c35734838d3e48c2b51bb1f36a8925b8e3a99bddeec61040d 🔍`
SHA3	`285496556cd95a2fc6739aacb239c75dd08c31cf0fe603ff041503ef3c63d3c0 🔍`
VirtualSize	`0xe40`
VirtualAddress	`0x60a000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x5afa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.18854`

.CRT

MD5	`8accb28e352088bf455f0a71216f9ef8 🔍`
SHA1	`3b656f9651d27d520b27b0919f01b22177ad217a 🔍`
SHA256	`7ecb561627c2eaecc95125daf053a42a39525fa098c9c072540ecaeb769cd4ca 🔍`
SHA3	`f57b14b0029e1b0c1bae673ad9275d3b9d7e9379e9631033bd06f8132b1bc24a 🔍`
VirtualSize	`0x68`
VirtualAddress	`0x60b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x5b0a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.384091`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x60c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x5b0c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`81ca1d05b8285b629d1e08a02f3ae406 🔍`
SHA1	`43eed40d2c7e26f21025682266d89007c748acd9 🔍`
SHA256	`bb15d33ec514901a162fe859427019b6124eeafeb39fa35e5be3a971bc6cb127 🔍`
SHA3	`b06eca037602ae126b47d6b433073ef469da7d5d1aea4d49c8628c0f3fd270d9 🔍`
VirtualSize	`0xcd60`
VirtualAddress	`0x60d000`
SizeOfRawData	`0xce00`
PointerToRawData	`0x5b0e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.42813`

Imports

KERNEL32.dll	`AddVectoredContinueHandler` `AddVectoredExceptionHandler` `CloseHandle` `CreateEventA` `CreateIoCompletionPort` `CreateThread` `CreateWaitableTimerExW` `DeleteCriticalSection` `DuplicateHandle` `EnterCriticalSection` `ExitProcess` `FreeEnvironmentStringsW` `GetConsoleMode` `GetCurrentThreadId` `GetEnvironmentStringsW` `GetErrorMode` `GetLastError` `GetProcAddress` `GetProcessAffinityMask` `GetQueuedCompletionStatusEx` `GetStartupInfoA` `GetStdHandle` `GetSystemDirectoryA` `GetSystemInfo` `GetThreadContext` `InitializeCriticalSection` `IsDBCSLeadByteEx` `LeaveCriticalSection` `LoadLibraryExW` `LoadLibraryW` `MultiByteToWideChar` `PostQueuedCompletionStatus` `RaiseFailFastException` `ResumeThread` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `SetConsoleCtrlHandler` `SetErrorMode` `SetEvent` `SetProcessPriorityBoost` `SetThreadContext` `SetUnhandledExceptionFilter` `SetWaitableTimer` `Sleep` `SuspendThread` `SwitchToThread` `TlsAlloc` `TlsGetValue` `VirtualAlloc` `VirtualFree` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WaitForSingleObject` `WerGetFlags` `WerSetFlags` `WideCharToMultiByte` `WriteConsoleW` `WriteFile` `__C_specific_handler`
msvcrt.dll	`___lc_codepage_func` `___mb_cur_max_func` `__getmainargs` `__initenv` `__iob_func` `__lconv_init` `__set_app_type` `__setusermatherr` `_acmdln` `_amsg_exit` `_beginthread` `_cexit` `_commode` `_errno` `_fmode` `_initterm` `_lock` `_onexit` `_unlock` `abort` `calloc` `exit` `fprintf` `fputc` `free` `fwrite` `localeconv` `malloc` `memcpy` `signal` `strerror` `strlen` `strncmp` `vfprintf` `wcslen`

Delayed Imports

_cgo_dummy_export

Ordinal	`1`
Address	`0x607930`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x14060c000`
EndAddressOfRawData	`0x14060c008`
AddressOfIndex	`0x1406083ec`
AddressOfCallbacks	`0x14060b040`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000140298170` `0x0000000140298140`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.