600fd59a6114e08606f4bbc881c1c156193ff01371e1144a05ca787d365e067d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Oct-07 15:58:42

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Cryptographic algorithms detected in the binary: Uses known Mersenne Twister constants
Microsoft's Cryptography API
Info The PE contains common functions which appear in legitimate applications. Uses Microsoft's cryptographic API:
  • CryptStringToBinaryA
 Has Internet access capabilities:
  • InternetOpenA
Malicious VirusTotal score: 54/71 (Scanned on 2026-08-04 03:02:01) ALYac: Gen:Variant.Downloader.1132
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Trojan/Win.Generic.R755023
Alibaba: Trojan:Win64/MalwareX.f4371ae4
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Trojan.Downloader.D46C
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Gen:Variant.Downloader.1132
Bkav: W32.Malware.47E5CA04
CAT-QuickHeal: TrojanDownloader.Win64
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
DrWeb: Trojan.DownLoader49.35687
ESET-NOD32: Win64/Agent.GTP trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Downloader.1132 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: W64/Agent.GTP!tr
GData: Gen:Variant.Downloader.1132
Google: Detected
Gridinsoft: Trojan.Win64.Agent.sa
Ikarus: Trojan.Win64.Agent
K7AntiVirus: Trojan ( 005d04821 )
K7GW: Trojan ( 005d04821 )
Kaspersky: HEUR:Trojan-Downloader.Win64.LuckyWare.gen
Kingsoft: Win64.Trojan-Downloader.LuckyWare.gen
Lionic: Trojan.Win32.Kepavll.a!c
Malwarebytes: Trojan.Crypt
MaxSecure: Trojan.Malware.695693861.susgen
McAfeeD: Trojan:Win/Agent.NEI
MicroWorld-eScan: Gen:Variant.Downloader.1132
Microsoft: Trojan:Win64/Cerbu.ARA!MTB
Paloalto: generic.ml
Panda: Trj/GdSda.A
Rising: Trojan.Agent!8.B1E (TFE:5:J9MXwzw9VQR)
Skyhigh: BehavesLike.Win64.Infected.dh
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Tencent: Win64.Trojan-Downloader.Luckyware.Mgil
TrellixENS: Artemis!D712BE26FE4B
VBA32: Trojan.Kepavll
VIPRE: Gen:Variant.Downloader.1132
Varist: W64/Agent.LNW.gen!Eldorado
ViRobot: Trojan.Win.Z.Mikey.283648.A
VirIT: Trojan.Win64.Genus.HKT
Yandex: Trojan.Agent!8dBK8xWEDxc
Zillya: Trojan.Agent.Win64.112611
alibabacloud: Trojan:Win/Kepavll.Gen
huorong: HEUR:Trojan/W64.Agent.a!crit

Hashes

MD5 d712be26fe4bbd0ee1fc9156ea74b705 🔍
SHA1 0d73d709f61dcd7d58984dd154c50b925049689c 🔍
SHA256 600fd59a6114e08606f4bbc881c1c156193ff01371e1144a05ca787d365e067d 🔍
SHA3 72876802cb8e92f4f4a1f18fa298f21d7322a6aa0f1169c121e4b06c72ae338d 🔍
SSDeep 3072:cHg0HbTE/QaJkcHVqJr3NPAG0geM4tO/URydJ/28S2sQdJ1:cHgETakcMJrJ3H4cdJ/B/dJ 🔍
Imports Hash a4b6231fae7f0ff5cd8420656357e7cf 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2025-Oct-07 15:58:42
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x38800
SizeOfInitializedData 0x13c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000038704 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x50000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b1bf45fee4c04fedf3b0e551b5aac713 🔍
SHA1 8a268cd7325cfb44844e614fde865790a5d21242 🔍
SHA256 d431d387887ce6807282481fe913ce7dcedd1e78d4a819fad1b15321f3bd96ae 🔍
SHA3 389683992bd390d5f273c6b87185489339c6cf3f9951b781c568e698e0be2685 🔍
VirtualSize 0x38651
VirtualAddress 0x1000
SizeOfRawData 0x38800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.27316

.rdata

MD5 b11670595cdcfb72a0f2dbc3d15a8fd4 🔍
SHA1 187209cb7bc07c50ceb12611d1df2f5891535c9a 🔍
SHA256 8ab0dd83d4e60535251c07db3517f6084dc557145476bbcb214f24ba9573d036 🔍
SHA3 b424fcbed0e55d5ffb389e1334cfae2fbc8af1210c8523351bbf3f546280d4fe 🔍
VirtualSize 0xbbac
VirtualAddress 0x3a000
SizeOfRawData 0xbc00
PointerToRawData 0x38c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.77225

.data

MD5 055760a2ad9ced4a04c0ceb2efc8b7f0 🔍
SHA1 4b74448664a366566e239cbe40ba61789af14a56 🔍
SHA256 b8729615440a02bab0a97eada9450f29d9298ff2895e36aab2ef1221828e7297 🔍
SHA3 e50c0ec4d37206a144ce7a10d9326f5713169093b8293ec1e9b0ac1894be8dd7 🔍
VirtualSize 0x75c8
VirtualAddress 0x46000
SizeOfRawData 0x200
PointerToRawData 0x44800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.21422

.pdata

MD5 8000aa05e6437202300db8be6ca1eaa4 🔍
SHA1 5586296c0141cebf8ec2d722a6748be3d0067d88 🔍
SHA256 1a99099f9de48c9878ef75f9d73d78f4b77d5b79459e43a5057de050ab4242f5 🔍
SHA3 2ec5b3f2b66352041e31ea32045b8b011f61474f4db2b9be29a1ad8abf502104 🔍
VirtualSize 0x6f0
VirtualAddress 0x4e000
SizeOfRawData 0x800
PointerToRawData 0x44a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.72819

.reloc

MD5 4384ef99c20d20f7a79ef6b1d2e1f47e 🔍
SHA1 e542692a4ab100dfa10a3b5062f71d6ed9b45e4d 🔍
SHA256 7aeaef6b5b962a01319d94ff869624ae9d39939399d2bce0a95bac27332edb8b 🔍
SHA3 0ac80d7590078b1f44d96300c3aed05f677716925ef431ee23183ba8c56a6919 🔍
VirtualSize 0x90
VirtualAddress 0x4f000
SizeOfRawData 0x200
PointerToRawData 0x45200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.94197

Imports

CRYPT32.dll CryptStringToBinaryA
MSVCP140.dll ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
dxgi.dll CreateDXGIFactory
WININET.dll InternetOpenA
VCRUNTIME140.dll memcpy
__current_exception_context
__current_exception
_CxxThrowException
__C_specific_handler
memset
__std_exception_destroy
memcmp
__std_exception_copy
memmove
api-ms-win-crt-heap-l1-1-0.dll free
_callnewh
malloc
_set_new_mode
api-ms-win-crt-utility-l1-1-0.dll rand
srand
api-ms-win-crt-runtime-l1-1-0.dll _c_exit
_invoke_watson
_initterm_e
_initterm
_get_narrow_winmain_command_line
_exit
terminate
exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0.dll wcstombs
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-string-l1-1-0.dll isspace
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
KERNEL32.dll AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
ReleaseSRWLockExclusive
VCRUNTIME140_1.dll __CxxFrameHandler4

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Oct-07 15:58:42
Version 0.0
SizeofData 852
AddressOfRawData 0x43e84
PointerToRawData 0x42a84

TLS Callbacks

StartAddressOfRawData 0x1400441f8
EndAddressOfRawData 0x140044200
AddressOfIndex 0x1400461c0
AddressOfCallbacks 0x14003a3d8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140046040

RICH Header

XOR Key 0x425fb380
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 18
ASM objects (35207) 4
C objects (35207) 10
C++ objects (35207) 28
Imports (35207) 6
Imports (33140) 9
Total imports 116
C++ objects (LTCG) (35213) 1
Linker (35213) 1

Errors

Leave a comment

No comments yet.