5b196966775a457baad75f48ba68bf09
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Jul-28 09:26:23 |
| Detected languages |
English - United States
Process Default Language |
| Debug artifacts |
D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb
|
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Accesses the WMI:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA1
Uses constants related to SHA256 Uses constants related to AES |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
9361189 bytes of data starting at offset 0xd0400.
The overlay data has an entropy of 7.99918 and is possibly compressed or encrypted. Overlay data amounts for 91.6489% of the executable. |
| Malicious | VirusTotal score: 22/72 (Scanned on 2026-02-01 08:36:13) |
ALYac:
Trojan.GenericKD.78622738
APEX: Malicious Arcabit: Trojan.Generic.D4AFB012 BitDefender: Trojan.GenericKD.78622738 Bkav: W64.AIDetectMalware CAT-QuickHeal: Trojan.Agent CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_90% (D) DeepInstinct: MALICIOUS Elastic: malicious (moderate confidence) Emsisoft: Trojan.GenericKD.78622738 (B) Fortinet: W32/PossibleThreat GData: Trojan.GenericKD.78622738 Google: Detected Ikarus: Trojan.MSIL.HackTool Lionic: Trojan.Win64.Agent.tsUh Malwarebytes: MachineLearning/Anomalous.96% MicroWorld-eScan: Trojan.GenericKD.78622738 TrellixENS: Artemis!5B196966775A TrendMicro-HouseCall: TROJ_GEN.R002H09AR26 VIPRE: Trojan.GenericKD.78622738 alibabacloud: Suspicious |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2025-Jul-28 09:26:23 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x4cc00 |
| SizeOfInitializedData | 0x83400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000033DB0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xe2000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.didat
.fptable
.rsrc
.reloc
Imports
| KERNEL32.dll |
CreateFileW
ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetOverlappedResult WaitForSingleObject CreateEventW SetLastError LocalFree FormatMessageW DeleteFileW RemoveDirectoryW SetFileTime DeviceIoControl CreateHardLinkW GetLongPathNameW GetShortPathNameW MoveFileW GetStdHandle FlushFileBuffers GetFileType SetEndOfFile SetFilePointer CreateDirectoryW GetFileAttributesW SetFileAttributesW GetCurrentProcessId FindClose FindFirstFileW FindNextFileW GetVersionExW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW GetModuleFileNameW FoldStringW GetModuleHandleW FindResourceW FreeLibrary GetProcAddress ExpandEnvironmentStringsW Sleep GetCurrentProcess ExitProcess GetSystemDirectoryW LoadLibraryW SetThreadExecutionState CompareStringW AllocConsole FreeConsole AttachConsole WriteConsoleW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore CreateSemaphoreW CreateThread SetThreadPriority GetProcessAffinityMask GetSystemTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte GlobalAlloc GlobalMemoryStatusEx LoadResource LockResource SizeofResource GlobalUnlock GlobalLock GlobalFree GetDateFormatW GetTimeFormatW GetCommandLineW SetEnvironmentVariableW GetTempPathW GetExitCodeProcess GetLocalTime GetTickCount MoveFileExW GetLocaleInfoW GetNumberFormatW GetConsoleMode GetConsoleOutputCP HeapSize SetFilePointerEx GetStringTypeW SetStdHandle GetProcessHeap LCMapStringW InitializeCriticalSectionEx RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetModuleHandleExW HeapFree HeapAlloc HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree |
|---|---|
| OLEAUT32.dll |
SysAllocString
SysFreeString VariantClear |
| gdiplus.dll |
GdipCloneImage
GdipFree GdipDisposeImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipAlloc |
| USER32.dll (delay-loaded) |
DialogBoxParamW
EndDialog GetDlgItemTextW SendDlgItemMessageW WaitForInputIdle SetForegroundWindow GetSysColor LoadBitmapW LoadIconW DestroyIcon IsDialogMessageW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW SetUserObjectInformationW CopyImage FindWindowExW MessageBoxW ReleaseDC GetDC LoadCursorW SetWindowLongPtrW CopyRect MapWindowPoints UpdateWindow MoveWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW DefWindowProcW CharUpperW LoadStringW GetWindow SetProcessDefaultLayout GetWindowLongPtrW SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetSystemMetrics SetWindowPos GetClassNameW GetParent GetWindowTextLengthW GetWindowTextW SetWindowTextW EnableWindow SetDlgItemTextW GetDlgItem ShowWindow IsWindowVisible SetFocus SendMessageW |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | USER32.dll |
| ModuleHandle | 0x716b8 |
| DelayImportAddressTable | 0x77168 |
| DelayImportNameTable | 0x614a8 |
| BoundDelayImportTable | 0x61db8 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
101
1
2
3
4
5
6
7
8
9
10
11
12
ASKNEXTVOL
GETPASSWORD1
LICENSEDLG
RENAMEDLG
REPLACEFILEDLG
STARTDLG
7 (#2)
8 (#2)
9 (#2)
10 (#2)
11 (#2)
12 (#2)
13
14
15
16
17
100
1 (#2)
String Table contents
| Select the destination folder |
| Extracting %s |
| Skipping %s |
| Unexpected end of archive |
| The file "%s" header is corrupt |
| Corrupt header is found |
| Main archive header is corrupt |
| The archive comment header is corrupt |
| The archive comment is corrupt |
| Not enough memory |
| Unknown method in %s |
| Cannot open %s |
| Cannot create %s |
| Cannot create folder %s |
| Checksum error in the encrypted file %s. Corrupt file or wrong password. |
| Checksum error in %s |
| Packed data checksum error in %s |
| Write error in the file %s |
| Read error in the file %s |
| File close error |
| The required volume is absent |
| The archive is either in unknown format or damaged |
| Extracting from %s |
| Next volume |
| The archive header is corrupt |
| Close |
| Error |
| Errors encountered while performing the operation |
| Look at the information window for more details |
| bytes |
| modified on |
| folder is not accessible |
| Some files could not be created. |
| You can try to repeat the installation after closing other applications and restarting Windows. |
| Some installation files are corrupt. |
| Please download a fresh copy and retry the installation |
| All files |
| <ul><li>Press <b>Install</b> button to start extraction.</li><br><br> |
| <ul><li>Press <b>Extract</b> button to start extraction.</li><br><br> |
| <li>Use <b>Browse</b> button to select the destination |
| folder from the folders tree. It can be also entered |
| manually.</li><br><br> |
| <li>If the destination folder does not exist, it will be |
| created automatically before extraction.</li></ul> |
| The archive is corrupt |
| Extracting files to %s folder |
| Extracting files to temporary folder |
| Extract |
| Extraction progress |
| Total path and file name length must not exceed %d characters |
| Unknown encryption method in %s |
| The specified password is incorrect. |
| Incorrect password for %s |
| Cannot copy %s to %s. |
| Cannot create symbolic link %s |
| Cannot create hard link %s |
| You need to unpack the link target first |
| You may need to run this self-extracting archive as administrator |
| Pause |
| Continue |
| Security warning |
| Please remove %s from folder %s. It is unsecure to run %s until it is done. |
| Not enough memory to unpack the archive with %u GB compression dictionary. |
| 64-bit self-extracting module is necessary. |
| Warning |
| This archive requires more than %u GB memory to unpack, which exceeds the amount of installed memory and can result in extremely slow extraction or even unresponsive system. |
| It is recommended to cancel extraction. Do you wish to try extracting it anyway? |
| Extraction cancelled |
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Jul-28 09:26:23 |
| Version | 0.0 |
| SizeofData | 81 |
| AddressOfRawData | 0x5c0d0 |
| PointerToRawData | 0x5b0d0 |
| Referenced File | D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Jul-28 09:26:23 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x5c124 |
| PointerToRawData | 0x5b124 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Jul-28 09:26:23 |
| Version | 0.0 |
| SizeofData | 1164 |
| AddressOfRawData | 0x5c138 |
| PointerToRawData | 0x5b138 |
TLS Callbacks
| StartAddressOfRawData | 0x14005c610 |
|---|---|
| EndAddressOfRawData | 0x14005c618 |
| AddressOfIndex | 0x140071cf8 |
| AddressOfCallbacks | 0x14004e658 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140064e80 |
| GuardCFCheckFunctionPointer | 5369029936 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
RICH Header
| XOR Key | 0x7065e790 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33140) | 157 |
| 253 (35207) | 2 |
| ASM objects (35207) | 8 |
| C objects (35207) | 17 |
| C++ objects (35207) | 61 |
| ASM objects (33140) | 11 |
| C objects (33140) | 24 |
| C objects (CVTCIL) (33140) | 1 |
| Imports (33140) | 7 |
| Total imports | 299 |
| C++ objects (35213) | 51 |
| Exports (35213) | 1 |
| Resource objects (35213) | 1 |
| Linker (35213) | 1 |