5a66bc3037f6722e6d4b71d175112ba1258b96912283e82058163cc3d1cf8aff

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00

Plugin Output

Suspicious PEiD Signature: HQR data file
Info Interesting strings found in the binary: Contains domain names:
  • .eq.github.com
  • .eq.golang.org
  • .hash.golang.org
  • .hash.net
  • GoneseekopensyncStat.com
  • eq.github.com
  • eq.golang.org
  • github.com
  • golang.org
  • hash.golang.org
  • https://app.asarArmenianBalineseBopomofoBugineseCherokeeCyrillicDuployanEthiopicGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiPhags_PaTagbanwaTai_ThamTai_VietTifinaghUgariticVithkuqi48828125infinitystrconv.parsing
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Malicious VirusTotal score: 5/71 (Scanned on 2026-10-03 19:05:22) Bkav: W32.Malware.83794CC0
CrowdStrike: win/grayware_confidence_60% (D)
Malwarebytes: Malware.AI.591926515
MaxSecure: Trojan.Malware.300983.susgen
Sangfor: Trojan.Win32.Save.a

Hashes

MD5 b6711e349fdf5302e024e10a2642e9d5 🔍
SHA1 b7732a605b926a7a283e15c131f35cff48a8cb98 🔍
SHA256 5a66bc3037f6722e6d4b71d175112ba1258b96912283e82058163cc3d1cf8aff 🔍
SHA3 5079aa03824f80bb79b9b9b2d199ba733a706e45adff5d9a2bc340afd87ce521 🔍
SSDeep 49152:xYMG26w7WAoViJkTKz2AcrC8kKXvZ2xSuGaJ5sZmkVCvxbDnJFm2PYCi5EtY/A1:lfk5+LxGaJ5EIxnJQEHQanaoyD 🔍
Imports Hash d42595b695fc008ef2c56aabd8efd68e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x731600
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x364400
SizeOfInitializedData 0x57200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000746C0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x78e000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 808053346008c9a65025f65d6b1c2349 🔍
SHA1 daa9ae1a0ddbc1309882bac9ee385295d43544d2 🔍
SHA256 86ebacaf3e1763fab0dd7ce35436c8b46a5ea7bc43f189712ce2ae951d95e8f1 🔍
SHA3 d6442d7f444a13e35b0491a288b9fff49fb812b7936ffee18abdf323ea7fb624 🔍
VirtualSize 0x364251
VirtualAddress 0x1000
SizeOfRawData 0x364400
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.18586

.rdata

MD5 6d401b8dd29077b5f1be49301b41be5c 🔍
SHA1 f547e57b6ef468a63ac0e68bbde78590c25ef750 🔍
SHA256 d9a728cb564152b3b9a24153e103624a14f70f0b7c8d6b4e85efb1bf47111a2d 🔍
SHA3 1315283fe623c8f74ff00321c573edf4235a5ffb90933ab17e324f3d42acccba 🔍
VirtualSize 0x3514e0
VirtualAddress 0x366000
SizeOfRawData 0x351600
PointerToRawData 0x364a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.67104

.data

MD5 9ac9949f321ff9060c47fb52ec6e019f 🔍
SHA1 d062fdb5f591b34f6528380c9a22a8633871c9eb 🔍
SHA256 836a2e6306bf71e5d64b529576730fb0b6df413693d2e319c96500a338cdc950 🔍
SHA3 3c9ade36c38be9947443a4261085bf44953c69f6098b32b2ab9c74af31f2b829 🔍
VirtualSize 0xad450
VirtualAddress 0x6b8000
SizeOfRawData 0x57200
PointerToRawData 0x6b6000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.80135

.pdata

MD5 42f40476bdf354ffb20124009da0e497 🔍
SHA1 f92a4259b24dc64dd8a443f8f08a3cde574d5f8c 🔍
SHA256 e69345590927bc9ad88d9f2820800214de5ed2198b900ec3f8b7ea276b5bddee 🔍
SHA3 fea285e4765158d61f55894dbf338315ad40eaad8f62e479f0d4504e325fc9da 🔍
VirtualSize 0x13800
VirtualAddress 0x766000
SizeOfRawData 0x13800
PointerToRawData 0x70d200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.53499

.xdata

MD5 9db16a5c947587d4ec73b0fa3674fd5b 🔍
SHA1 b6625fd75e3165bee50e4e9601a747c67c0c64b0 🔍
SHA256 9b8d8892652fd138a5241b28c0890c20e99100341e97f20f4d1a2a6de4266f1b 🔍
SHA3 80d4323eb01c83563e345adfeea86791b4711f7e443f1e0937c63d99dd36863b 🔍
VirtualSize 0xb4
VirtualAddress 0x77a000
SizeOfRawData 0x200
PointerToRawData 0x720a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78321

.idata

MD5 ba3c1a4dfa08e2237f428f35ecb24bf1 🔍
SHA1 5b69999523899ae6ac50adf338dc93551eda0c64 🔍
SHA256 c82fc25e24db208149392d360aff2679b02a34a1f5fd771fcdc66a867389196c 🔍
SHA3 95db1914b4952790f6386ba2fe69e8ab56f69fc4b8177ec8d492f282391b48ac 🔍
VirtualSize 0x53e
VirtualAddress 0x77b000
SizeOfRawData 0x600
PointerToRawData 0x720c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.00719

.reloc

MD5 1385492ac110d547f10e9209ab671679 🔍
SHA1 e97415df2bf918e90d8a6ac9bb21ba74ad7c87a7 🔍
SHA256 4e1b7fd1d48f933fb3f73232b9b8806c7cce85a136c44e6676f3fdb80a737263 🔍
SHA3 646ff408ba0c0a00854fd4cd85f3632e1f468d1b71b41cbd461cbf6da02e7d07 🔍
VirtualSize 0x10310
VirtualAddress 0x77c000
SizeOfRawData 0x10400
PointerToRawData 0x721200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.437

.symtab

MD5 07b5472d347d42780469fb2654b7fc54 🔍
SHA1 943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍
SHA256 3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍
SHA3 a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍
VirtualSize 0x4
VirtualAddress 0x78d000
SizeOfRawData 0x200
PointerToRawData 0x731600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0203931

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.