60d7a7c6e185bdd39d14f12313e5e45d23a849090c0d2b045720e754c6f45eda

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2015-Jun-15 16:06:34

Plugin Output

Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h)
UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX -> www.upx.sourceforge.net
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Can take screenshots:
  • BitBlt
  • GetDC
Info The PE's resources present abnormal characteristics. Resource 2 is possibly compressed or encrypted.
Resource 5 is possibly compressed or encrypted.
Malicious VirusTotal score: 23/70 (Scanned on 2026-09-03 17:23:48) Antiy-AVL: Trojan[Backdoor]/BAT.Teldoor
Bkav: W32.Malware.2BCEC67C
CTX: exe.trojan.moderate
CrowdStrike: win/malicious_confidence_60% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
Elastic: malicious (moderate confidence)
Emsisoft: Trojan.Generic (A)
Fortinet: W32/PossibleThreat
Jiangmin: TrojanDropper.Daws.fyt
Lionic: Trojan.Win32.Generic.4!c
Malwarebytes: Generic.Malware/Suspicious
MaxSecure: Trojan.Malware.8328611.susgen
McAfeeD: ti!60D7A7C6E185
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
SUPERAntiSpyware: Trojan.Agent/Gen-Dropper
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Trapmine: malicious.moderate.ml.score
TrellixENS: Artemis!4618BD84307B
VirIT: Backdoor.Win32.Generic.CNLA
tehtris: Generic.Malware

Hashes

MD5 4618bd84307b1a7a6bec39e516118036 🔍
SHA1 5e317d9f2978c2a6c4e7a1ec0d2c4137f759445b 🔍
SHA256 60d7a7c6e185bdd39d14f12313e5e45d23a849090c0d2b045720e754c6f45eda 🔍
SHA3 eb8b1a35b860d2b83211c13758f13635d4ade21af65a23139d2d7a5a87d91bdb 🔍
SSDeep 24576:A5OVLOCgyBRk6zrt9qXDHnwUELjiUr0052KJZ1DOrWHkXNEHS+84O:+Kk6zjqTcLjiUr5n1DOSEXqL 🔍
Imports Hash 7045005ef4130348fa4cbfc30a6f9d04 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2015-Jun-15 16:06:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x167000
SizeOfInitializedData 0x10000
SizeOfUninitializedData 0x48b000
AddressOfEntryPoint 0x005F2040 (Section: UPX1)
BaseOfCode 0x48c000
BaseOfData 0x5f3000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x603000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x48b000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 1b3d97b42169233035dc79e63fb690fd 🔍
SHA1 f1c6fd640bf3acd0fb884fefbc51e0a42682294f 🔍
SHA256 f9395fe27be265bbd3c02c6185adabccf2ef228c7d8e556d37edcd0847afd00a 🔍
SHA3 b4aa3bd37a645415f7b21e1a10e6b40d592ad62dfcacb5684ac8c31b5dd8b65b 🔍
VirtualSize 0x167000
VirtualAddress 0x48c000
SizeOfRawData 0x166c00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99984

.rsrc

MD5 b6570ce0e82bf15d0cdf50052b392d30 🔍
SHA1 ab04b6153bf237713a2c53b7abac7a7046289d52 🔍
SHA256 80207ca949f701aa4393efc2eefed5135b08d679487a8fd14ef4e39e2fbc553a 🔍
SHA3 500c139441dea81a24da387ccebcd5a0223d49aec251a552cd6a1568423b4d87 🔍
VirtualSize 0x10000
VirtualAddress 0x5f3000
SizeOfRawData 0xfc00
PointerToRawData 0x166e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.96221

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
COMCTL32.DLL InitCommonControlsEx
GDI32.DLL BitBlt
MSVCRT.dll fabs
OLE32.DLL CoInitialize
SHELL32.DLL ShellExecuteExA
SHLWAPI.DLL PathGetArgsA
USER32.DLL GetDC
WINMM.DLL timeBeginPeriod

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.28246
MD5 e09edba8f98756fa6dd7851131adb1a2 🔍
SHA1 03b3f91afc1a00ef35b55c3398f6c3758520f119 🔍
SHA256 011df9e704e81d1321f65f0b5530566746ec6536bdd3f8d2d5e180b888daf7fe 🔍
SHA3 61a6051ccef9fccecce4c3efef15cbba13a72db8acac475feece587473aad785 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x368
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.14862
MD5 7ac74a3303921a99893aa42a56e7fa6a 🔍
SHA1 d85060f8539c3365d524f4ba721bc56d9617fb01 🔍
SHA256 90cca98e77b27032cc3c9b4fb146babbafe0fff95df179c5fac6179c484e7e1d 🔍
SHA3 b37382029553e0d8c421a3eadfdc893c202e1551596e7b05105bde81f3219093 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.4584
MD5 303b5f5c58ba6c8b126cfeec1bf39c62 🔍
SHA1 c7c581283fe5a583feb7ca773a6c5655439522bf 🔍
SHA256 0ebed7538c47cc8bf0ccc22b8325b09ed69214100c5cbc551c76cc19f60cdab1 🔍
SHA3 ac2c17d47af2057c1f8dc4f104730eb54d14ef2b048619e8532683c665f30649 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65264
MD5 08eedae7f6f6d481ca518f9d68045a95 🔍
SHA1 057d8f58bd9dc906269232821a42daf04363f94c 🔍
SHA256 e46bc09fab2e5ab06a6fad211723a7edcb64645f2dd3524d9e28136f43e4bdfe 🔍
SHA3 65c4258df0a4e68ba5731d6333bc82db39eb08458a4e8e7ea5f9fdb9ab7bbe19 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.5752
MD5 54e700af4a86f9261be3840a474f694f 🔍
SHA1 74a05b0dad68d198dbab915e31e85947827a40fe 🔍
SHA256 516377ac48373a03193076323329363c6c068c9b7b72553e22be939302eabc0a 🔍
SHA3 255b9c4b57bca468435a83e0d607a56a9f2025f8bf5e24d0037e61c0a9fa36f2 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.58696
MD5 737f6c2b2cba8c0b7eeb4227a3829e95 🔍
SHA1 e9258ef1c6efcf907a2950b4840fc4c413c7764c 🔍
SHA256 8670c44207dade2c63f5fcbd051b2a81a974c53132ec22d6f91f612fc4e1e941 🔍
SHA3 96dbf9cb0b13e7269599dfa2a579006b135a55bdb8cd626ff5e02930cca2009c 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.9489
MD5 5532d12fcc5f8974789e77181c649d09 🔍
SHA1 0901ec4c55c93d9b390c4e6a3d58e0977f500df7 🔍
SHA256 9d8ef7b7c05b009ef38b38ea43814c523d50459f406695fcded3dd4ddd06fccd 🔍
SHA3 0c260d76c83dc70a7e079cb02dfd6c9bc0ce9d598de5094fa6affaed824b178e 🔍

8

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1ca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.84566
MD5 396ef5d1f712538f1bf2f592bc4cd2a9 🔍
SHA1 ad853ef7f004e1091c8c4bff2c96dfbae7f7333c 🔍
SHA256 af62a1a65f091a3d4415fbc88206ed72f7d6bd7b97a2711fe6eb0b13ce43a188 🔍
SHA3 16daeb9ae9bf5102fb83221c37cd9ecdaf1226b6a733a5e4e21f07c69bbf9465 🔍

9

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.16129
MD5 30d820d23ea4c8bf34108b0413025437 🔍
SHA1 22839ee912b8d3920bbd7655adb2cfb286166112 🔍
SHA256 905a559ba79cc16645da94d5f1502680503898886892fac27631471e345c35f1 🔍
SHA3 9d8f306ff6c72204161e6f982c1b050e29d20d55d263411fd6f4b882b32236cb 🔍

10

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xa68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97996
MD5 42386bf8b761d77eee8f118ed069281d 🔍
SHA1 02e1d7ff81913cf42daac367d805c1388af41158 🔍
SHA256 512b3cec5f5862534be60a2268d75701b1849e926d0f663f67662f12ac142764 🔍
SHA3 a8fd70b847066221fd78909cc3e39cc2a4246f2f8b6b8749a6d13e95e4e12858 🔍

11

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.86938
MD5 807d89d52dcf83b522d42f32f2a0a019 🔍
SHA1 dd75838a09d82caada691a57e19da07aa286770f 🔍
SHA256 5a30df1faffe8a6e42a4645474d68c4f2e19dd3ada5d32a514bbd1d62996be5f 🔍
SHA3 f60728d6e6c2d6cb6a4db012a0eb0ce18f8677a389b8d3db6833c976391d59b6 🔍

12

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40919
MD5 7355fdd7ddc858f427c2c42c7f57044d 🔍
SHA1 0c98160789f4b746ab68cb50569533cb51d68199 🔍
SHA256 6576e1e5101f5a388f188322c55b231572f389d18c752ab0e4f4553f3bb0a070 🔍
SHA3 37049ba0833690f6a6988a402f1a4d3600040f045ad22acd520d8b463e5818aa 🔍

D

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

I

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x24
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89215
MD5 f98893abdd9ab798a50e5ab1f2c3c7ac 🔍
SHA1 8de203b85799b229bd65cd2faefff2abeb8fdb59 🔍
SHA256 e677f25da8f66a69319653c5db67863be34c6c0c555a9e337d7715cdbbeecf63 🔍
SHA3 3c733460d3cd206c3c448b9345d5ecb63752298882db04748afb629073827367 🔍

N

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.94362
MD5 b615c6129062c96c2f1d749a1f1662bc 🔍
SHA1 1cd2906bb1bde52d939fedc0ec3e615792dece23 🔍
SHA256 3e14827f87e68fbc923f55091000544cea5ac2ce316e90d2caabbba65f2c92c4 🔍
SHA3 ef80d88b82c0bcf4445a0011a374d34306218572699cd0197c64a04a6c11a26a 🔍

O

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.58496
MD5 0aec67f3c550583b4fd24124b83d8dea 🔍
SHA1 ca89d743d49f0d03fe7c0c397de36f7b8d38e8e2 🔍
SHA256 69af550370222d22cc518440979c56db99c3589e542dc959e317cba32ff7c312 🔍
SHA3 be5f9252fb663251bb56981c7f46095dd2adf177c2ba84600f7523d8c422e62b 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93706
Detected Filetype Icon file
MD5 38864da26302591a3d5fe2ae85b94d9f 🔍
SHA1 cc1e6e78d732a367c22288abd3ca692c3c59d448 🔍
SHA256 6d0a1ee25d328a3304688b4dd595fa6d9b04ee582f7ce1396cf6c3367b355d68 🔍
SHA3 6887578a54a5dd6892fbf49a2c8dd811bafe6e7b5aa6bad3c42d5e1e7ff715b1 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x29c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.09999
MD5 3df1be5b119989ee3061fb3f3759d3fd 🔍
SHA1 2826967a233634277c39075ad3b4ac99d32e2acd 🔍
SHA256 cbb90bd969933f7ddfe27fad7c3649f1f1bdaf2ffcaa1ffc4eb7a96376bd49c8 🔍
SHA3 54d306c8d89ab29a564c4c67b384dafa665b3b994627ea189f9ffffd7b48df94 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Ignored an invalid IMAGE_RESOURCE_DATA_ENTRY [*] Warning: Ignored an invalid IMAGE_RESOURCE_DATA_ENTRY [*] Warning: Section UPX0 has a size of 0! [!] Error: Resource D is bigger than the PE. Not trying to load it in memory. [!] Error: Resource D is bigger than the PE. Not trying to load it in memory. [!] Error: Resource D is bigger than the PE. Not trying to load it in memory. [!] Error: Resource D is bigger than the PE. Not trying to load it in memory. [!] Error: Resource D is bigger than the PE. Not trying to load it in memory. [*] Warning: Resource D is empty! [!] Error: Resource D is bigger than the PE. Not trying to load it in memory. [!] Error: Resource D is bigger than the PE. Not trying to load it in memory.
Leave a comment

No comments yet.