5c5d29ea7c0a284dffedad76f29548b4d559b00a579a7f6ea9af87299ef6f872

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: HQR data file
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Info The PE is digitally signed. Signer: Onyx Grid Collective
Issuer: Onyx Grid Collective
Malicious VirusTotal score: 18/67 (Scanned on 2026-08-24 05:41:04) AVG: Win64:Evo-gen [Trj]
Avast: Win64:Evo-gen [Trj]
Avira: TR/W64.Evo
Bkav: W32.Malware.5BE68FDC
CrowdStrike: win/malicious_confidence_70% (W)
Cynet: Malicious (score: 99)
ESET-NOD32: Generik.CLZKUSW trojan
Elastic: malicious (high confidence)
F-Secure: Trojan.TR/W64.Evo
Fortinet: W64/Kryptik.XF!tr
Kaspersky: Trojan-Downloader.Win32.Remus.mm
Kingsoft: Win32.Trojan-Downloader.Remus.mm
Malwarebytes: Generic.Malware/Suspicious
Microsoft: Trojan:Win32/Wacatac.B!ml
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!7727AB3EF95E
huorong: Trojan/Loader.xw

Hashes

MD5 7727ab3ef95ef0aaeee5f94802b97234 🔍
SHA1 de1e8dc7547f181708e2ce689ed5205a41446d58 🔍
SHA256 5c5d29ea7c0a284dffedad76f29548b4d559b00a579a7f6ea9af87299ef6f872 🔍
SHA3 f1074b6bb384ba326c01c344d74852b108b863c7a630863c010166c0d486de5c 🔍
SSDeep 49152:d3QBecbQRoTO7EwGkmTk2HG+Ws8nQwDTBqg+W+PofI8Lf1HU6YsMpV96qhtrGkdP:p2QRoT2d2HG+Ws8nQwDTBqg+W8ofI8LQ 🔍
Imports Hash 4f2f006e2ecf7172ad368f8289dc96c1 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x253e00
NumberOfSymbols 2096
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x13f800
SizeOfInitializedData 0xc400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000005E7A0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x2c6000
SizeOfHeaders 0x600
Checksum 0x27a328
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ace4b8c14cdaf30464ff9bf47942d0e1 🔍
SHA1 6fd6c7d986104c735f7b7cec560a25b2e31fdf07 🔍
SHA256 58b409bd70adfe2dc9efc4dd86e3eb92e283e6a775fef8bc762a0405d088f7c8 🔍
SHA3 4f6d11a09368bc3516101a79b432c4b2462f1c15b3c14c6e56dc06e9b7293d8a 🔍
VirtualSize 0x13f67b
VirtualAddress 0x1000
SizeOfRawData 0x13f800
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.26787

.rdata

MD5 124291819d41abd6c3d869282b8729c3 🔍
SHA1 e3b3f15947274d2c62dcf81fcf45a588877f82c2 🔍
SHA256 478daf00e80a2e50d526f35b8ed33c9a7ab6a53c557ea993cef12929c1a2d13b 🔍
SHA3 e101ab3c9f669104863951e990479491394d008d88e6b247b6f16b306ef08cf0 🔍
VirtualSize 0x100528
VirtualAddress 0x141000
SizeOfRawData 0x100600
PointerToRawData 0x13fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.39112

.data

MD5 31b0dc3fa6c0181d5129c873ee968acf 🔍
SHA1 10e36ff40dfd8ec462267c3b43072362e99fb96e 🔍
SHA256 2dd2020ded643f081b877ba44212126d06d5c677e3d581db9484a97c606a7e03 🔍
SHA3 bfe376661a70f349ce860818beae56a1cf1d2a2d633a4096c21ca99c19e87bb5 🔍
VirtualSize 0x634d0
VirtualAddress 0x242000
SizeOfRawData 0xc400
PointerToRawData 0x240400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.09526

.pdata

MD5 0633cd84b0426be09fb7657d99cca077 🔍
SHA1 801b0c58815aa3fbb86d3d1c98b5df914b893c70 🔍
SHA256 9fe57ae4ad0fee45b21e8ba96faab127814a2d419a47dca9bc14ce6c38764632 🔍
SHA3 2b96f6c82ca8f8189b91d016c5c8066107d2b5d35bd9e580932b7987383c97f8 🔍
VirtualSize 0x4068
VirtualAddress 0x2a6000
SizeOfRawData 0x4200
PointerToRawData 0x24c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.12793

.xdata

MD5 b2a3c959871ba9d8655b7bd9b604a52e 🔍
SHA1 fbf3e2f14182cc2ba5a420333139c72354031663 🔍
SHA256 107d584e750c4d68e44e936cbf5df5f88e0c61b4a379ec86cc54b5ea20b7a50d 🔍
SHA3 a6bd17b1f25d10bb458ce348975ae375764f52daf45022ec01d4ecf997511399 🔍
VirtualSize 0x9c
VirtualAddress 0x2ab000
SizeOfRawData 0x200
PointerToRawData 0x250a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.53692

.idata

MD5 ec179f1aa22b53f22fb6c983b1b16d90 🔍
SHA1 65b2a0e4b52334ab74dd6d04051990c87f10e289 🔍
SHA256 c1e4af8946e71de25ceaeb02f900cce67183640cf5b6b2dfd51afd5c62b87b25 🔍
SHA3 355093293b38bbc2d159eb9020b9d8c3b726ccda9cad82546eeeb8a02f614bdf 🔍
VirtualSize 0x516
VirtualAddress 0x2ac000
SizeOfRawData 0x600
PointerToRawData 0x250c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.91855

.reloc

MD5 2ca88a1f81bfbd7f8713329c123d8d6c 🔍
SHA1 ee5fd6dd4ca0e3db352ee18171057f579251b2a7 🔍
SHA256 f0f79143e222dc999aa3b47396ca4274e60aa44ac83b759c757f7007f64bc2c9 🔍
SHA3 2a90e128fcc00e67af5bc492d58ca6243a5ce9da8408b7ff9a1052a81096ae02 🔍
VirtualSize 0x2b6a
VirtualAddress 0x2ad000
SizeOfRawData 0x2c00
PointerToRawData 0x251200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43749

.symtab

MD5 66d8fc59ae1a125adaecf5ceac252914 🔍
SHA1 c4070ed22328892c142eb2007917ff9679a4956e 🔍
SHA256 201e0958f2d5c8c392ccea3afac79df7a9b529dcb2f365e0c4e6d00dbc8b2800 🔍
SHA3 1437775cb5296f9132c25931bb16498c6c36c90cd0f0c1446b640b1f777d3de4 🔍
VirtualSize 0x15102
VirtualAddress 0x2b0000
SizeOfRawData 0x15200
PointerToRawData 0x253e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.00007

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.