5c6749c56f5850c80ef3b8262a7fd2e6

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Apr-03 08:05:15
Detected languages English - United States
Turkish - Turkey
Debug artifacts C:\Users\YooouHomie\Desktop\AlisInjector\Release\AlisInjector.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • Fischerwww.google.com
  • google.com
  • http://scripts.sil.org
  • http://scripts.sil.org/OFL
  • http://scripts.sil.org/OFLhttp
  • scripts.sil.org
Malicious The PE contains functions mostly used by malware. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • VirtualAlloc
  • OpenProcess
  • WriteProcessMemory
  • VirtualAllocEx
  • CreateRemoteThread
 Manipulates other processes:
  • Process32First
  • OpenProcess
  • Process32Next
  • WriteProcessMemory
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 13/72 (Scanned on 2025-03-23 12:13:14) APEX: Malicious
Bkav: W32.AIDetectMalware
CrowdStrike: win/grayware_confidence_90% (W)
FireEye: Generic.mg.5c6749c56f5850c8
Google: Detected
Gridinsoft: Trojan.Win32.Agent.cl
Ikarus: Trojan.Graftor
Kingsoft: malware.kb.a.800
McAfee: Artemis!5C6749C56F58
McAfeeD: ti!084DDDEBD93F
Paloalto: generic.ml
Skyhigh: BehavesLike.Win32.Injector.fh
Trapmine: malicious.high.ml.score

Hashes

MD5 5c6749c56f5850c80ef3b8262a7fd2e6
SHA1 75edcb624995ade202a8088c5cdd40a878066635
SHA256 084dddebd93f5c814ce239fe59e64f610e18ebfb606706c25ed296e1b6f63591
SHA3 335dcd1b233b5308bc94c783ec7604a9df2fc752ec5a9530cd36e61b2f893fa0
SSDeep 6144:qGYdQ4ZC7OMwiu2/LnvbZ3E4Zmdjt1Yx299R/+vbbyfBLLorKQE+hcLrpca:+Zdiu2/p3E4Zm71Jh/GbbZ4FR
Imports Hash ee136dcd5ba4b5eb36044c82a8916329

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2017-Apr-03 08:05:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x24a00
SizeOfInitializedData 0x34800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0002457A (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x26000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x5f000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 92ce5be3957833458b6e60087c73ae16
SHA1 65764edce5fe0aa41453c1710ec9c343984b01a0
SHA256 e43cb83111703c5121d6d67e833f1ffa49b88be065e444580dc5e1a10a64241b
SHA3 c16d5df6365e814f56f353d2a124f62246f77a6ebf81104a1af9c4900a899f3e
VirtualSize 0x24969
VirtualAddress 0x1000
SizeOfRawData 0x24a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.49074

.rdata

MD5 46517f363cb615b19d87db6d51bdf302
SHA1 d10d9bcd58dde4f77d65c5d3b1d4dd3720f51f79
SHA256 5b4f4d3dfed3616c7b82bf92c3430b611e9da6835a97189bb805b7a46727772b
SHA3 39a3f18a2f0894ff24d571a599294ad79b4ff66a17cef7f7b093f3e143511a4c
VirtualSize 0x6474
VirtualAddress 0x26000
SizeOfRawData 0x6600
PointerToRawData 0x24e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.17245

.data

MD5 29716e30a02f19639816caa5c13376d0
SHA1 a1ed2ccbf93f2c70d3ab4cb7cdd61e7e647cedbf
SHA256 6811798efa1af285a2fa3684ff9f252edd349c156e61b0b7a09b4e058fc3a299
SHA3 56ceeb42eafcdb35bde744168bda9a9dd1faafc2ca3cfffe9315ec3bf0a825c1
VirtualSize 0x217b4
VirtualAddress 0x2d000
SizeOfRawData 0x1d400
PointerToRawData 0x2b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.00146

.tls

MD5 1f354d76203061bfdd5a53dae48d5435
SHA1 aa0d33a0c854e073439067876e932688b65cb6a9
SHA256 4c6474903705cb450bb6434c29e8854f17d8324efca1fdb9ee9008599060883a
SHA3 991fbbd46bbd69198269fe6c247d440e0f8a7d38259b7a1e04b74790301d1d2b
VirtualSize 0x9
VirtualAddress 0x4f000
SizeOfRawData 0x200
PointerToRawData 0x48800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0203931

.gfids

MD5 c960431631a7f95b2760f34609f4ae28
SHA1 8495b64b93e317e515e6d09639fe06ec31572dd6
SHA256 00963efc7bf3156f612e5fb8541d2329f0dad9e30f1d6532badffeabc7c02b8b
SHA3 75b1946b1ec7ce37efe58369a354fec1d0f8e9a7ffbf707fe73cb894490d0cf1
VirtualSize 0x58
VirtualAddress 0x50000
SizeOfRawData 0x200
PointerToRawData 0x48a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.428784

.rsrc

MD5 73ff53bbbbf5fcf9d0fb4784137784c8
SHA1 93b152070eb85444aca9d70774928679ce48e3bd
SHA256 0561cde1a24cb8ef1ddd9ba26fc72518ba20b401c4c65d48e46167e676113886
SHA3 f069763a07b256c44bacffa26aa9d9a7aeedffea2b8aa53183be7f54f89f1afc
VirtualSize 0xb0f8
VirtualAddress 0x51000
SizeOfRawData 0xb200
PointerToRawData 0x48c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.17118

.reloc

MD5 39628dc93835744c1dc4dceadc7a81c9
SHA1 933d42c4f399b4128a882a653b7ba7691bbb4e63
SHA256 5058590f606955ee2ab3d676fa6bdb7f6d7fd75e899d1308799c075db34142dd
SHA3 8813739169b36a4ca9d44522bd3c2479797d0dc508a4190dcc9ac9c6eb80e7f5
VirtualSize 0x1274
VirtualAddress 0x5d000
SizeOfRawData 0x1400
PointerToRawData 0x53e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.47209

Imports

KERNEL32.dll Process32First
VirtualFree
VirtualAlloc
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
CreateFileA
Process32Next
CloseHandle
CreateThread
GetProcAddress
GetFileSize
WriteProcessMemory
WaitForSingleObject
VirtualAllocEx
CreateRemoteThread
VirtualFreeEx
ReadFile
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceCounter
GlobalAlloc
ExitProcess
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
EnterCriticalSection
USER32.dll DefWindowProcA
CreateWindowExA
GetWindowLongA
EmptyClipboard
CloseClipboard
SetWindowLongA
ShowWindow
LoadCursorA
SetLayeredWindowAttributes
DispatchMessageA
OpenClipboard
GetCursorPos
GetClientRect
SetCursor
SetWindowPos
GetKeyState
MessageBoxA
SetForegroundWindow
UpdateWindow
RegisterClassExA
PostQuitMessage
UnregisterClassA
GetClipboardData
PeekMessageA
LoadIconA
TranslateMessage
SetClipboardData
GDI32.dll CreateSolidBrush
COMDLG32.dll GetOpenFileNameA
IMM32.dll ImmSetCompositionWindow
ImmGetContext
d3d9.dll Direct3DCreate9
MSVCP140.dll _Thrd_sleep
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
_Xtime_get_ticks
imagehlp.dll ImageNtHeader
VCRUNTIME140.dll __vcrt_InitializeCriticalSectionEx
memcpy
__CxxFrameHandler3
memmove
__std_exception_destroy
__std_exception_copy
_except_handler4_common
memset
__std_terminate
strstr
_CxxThrowException
memchr
strchr
api-ms-win-crt-stdio-l1-1-0.dll ftell
__acrt_iob_func
__p__commode
_set_fmode
fflush
fclose
fseek
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0.dll strncpy
strcpy_s
isprint
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-heap-l1-1-0.dll free
_callnewh
malloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0.dll _set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_cexit
exit
_controlfp_s
terminate
_configure_narrow_argv
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0.dll _except1
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
ceil
floor
_libm_sse2_cos_precise
_CIfmod
__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_ICON
Language Turkish - Turkey
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.98133
MD5 2cb99fd907dbc666e78f7f837d4b4acd
SHA1 a3e2afff1e4a3ed583ed493181cc10e360265d38
SHA256 bbeada362579578c45861d5586d3dad3ee3e5b50f56e0480eac9cffaa38cd296
SHA3 bdf7f6de22ad49eeb0af53f806f302dc05dab6a0c89bd157eba7e8b2f7bce9da

2

Type RT_ICON
Language Turkish - Turkey
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.71508
MD5 9633fe1461ebe6e7fdd0ffe6533bbb4e
SHA1 32bc9cdef31fd387d116e632be83ba38f4ede5c9
SHA256 d0ef6c43dc8a0d47d25059e2024a970634b01dc09771c847ae3c9c5ed021dae1
SHA3 7b0776cadbac33f8287abc244eab5425f6b07b5d14f1f1a74fdf683619aa9297

3

Type RT_ICON
Language Turkish - Turkey
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.51205
MD5 13dba3b08e609f1356e56a095c12d494
SHA1 d3a5d1240e24acadf73d81ff22d5a2f363389eea
SHA256 4e5a0493e3540b3c2b78823cdc82a9f9bab7887c62e758799b063a12b1a1e40f
SHA3 e170a92b27c8d5aa91fd67ab1aafaf34dcae0de5b3585871f5aeed1f714f401c

4

Type RT_ICON
Language Turkish - Turkey
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.31879
MD5 0ab0e2c04743a93ebc44ffe4115193d0
SHA1 951d1cb61cdd30d315b4e557142cf895e566282b
SHA256 851bada21357d3de1b87cc77576b30e88afde3eff135dbcd815083a9a40acc5e
SHA3 c85973ca82a328b135bee21dc48b58c3c129b0f9abf78ad3f1acd2dd5a57329d

5

Type RT_ICON
Language Turkish - Turkey
Codepage UNKNOWN
Size 0x692e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97015
Detected Filetype PNG graphic file
MD5 a458c41461da34f42636acd9aa2c349d
SHA1 6d3448fc234ec2d9368bcda2f73b89e36dcf4aa4
SHA256 40a50870ccd57b0945bc0dedef7de726408cd77a6c635e8ac121377d2451d8cb
SHA3 958bb78cfe6c83c6c55f0b72ad1cdbdc6927105340cbc7bebca6192c8ddc90a3

101

Type RT_GROUP_ICON
Language Turkish - Turkey
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.81633
Detected Filetype Icon file
MD5 bd7bf3da0a5e56d86c351a298eaafce7
SHA1 79758e41a67dbb14dfd464947e51f7472db0fe93
SHA256 857c0d7111a90cb62a612389cdbfcfe8c949609395f7be241323dc15c0994fe2
SHA3 bc642750f3b9dca2605b2ddfc3f5a5cd5d87a55a2e724ef53520bd0802cb38f5

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2017-Apr-03 08:05:15
Version 0.0
SizeofData 90
AddressOfRawData 0x2aac4
PointerToRawData 0x298c4
Referenced File C:\Users\YooouHomie\Desktop\AlisInjector\Release\AlisInjector.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2017-Apr-03 08:05:15
Version 0.0
SizeofData 20
AddressOfRawData 0x2ab20
PointerToRawData 0x29920

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2017-Apr-03 08:05:15
Version 0.0
SizeofData 860
AddressOfRawData 0x2ab34
PointerToRawData 0x29934

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2017-Apr-03 08:05:15
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x44f000
EndAddressOfRawData 0x44f008
AddressOfIndex 0x44a738
AddressOfCallbacks 0x4262a4
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x42d00c
SEHandlerTable 0x42aa70
SEHandlerCount 21

RICH Header

XOR Key 0x8bd0d397
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
Imports (VS2015 UPD3 build 24123) 4
Imports (VS2012 build 50727 / VS2005 build 50727) 2
ASM objects (VS2015 UPD3 build 24123) 8
C++ objects (VS2015 UPD3 build 24123) 28
C objects (VS2015 UPD3 build 24123) 13
Imports (23917) 13
Total imports 149
C++ objects (LTCG) (VS2015 UPD3.1 build 24215) 8
Resource objects (VS2015 UPD3 build 24210) 1
151 1
Linker (VS2015 UPD3.1 build 24215) 1

Errors

<-- -->