6529e8478a6145df86d3703b861bb4714651341366afcad158167c6a340b7711

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-21 17:33:10
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • -mvPosition.xyz
  • .shadow.camera.top
  • .status.info
  • A.parkFit.top
  • camera.top
  • e.object.top
  • envColor.xyz
  • github.com
  • gmail.com
  • http://www.w3.org
  • http://www.w3.org/1999/xhtml
  • http://www.w3.org/2000/svg
  • https://github.com
  • instanceColor.xyz
  • mvPosition.xyz
  • object.top
  • parkFit.top
  • plane.xyz
  • shadow.camera.top
  • shadowCoord.xyz
  • status.info
  • tangent.xyz
  • this.shadow.camera.top
  • tshadowCoord.xyz
  • tvColor.xyz
  • worldPosition.xyz
  • www.w3.org
Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • ShellExecuteW
Suspicious The file contains overlay data. 1775706 bytes of data starting at offset 0xfc00.
Overlay data amounts for 96.4943% of the executable.
Malicious VirusTotal score: 14/71 (Scanned on 2026-11-10 10:23:20) ALYac: Trojan.GenericKD.81984002
APEX: Malicious
Arcabit: Trojan.Generic.D4E2FA02
BitDefender: Trojan.GenericKD.81984002
Bkav: W32.Malware.AE9D442F
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_60% (D)
Elastic: malicious (moderate confidence)
Emsisoft: Trojan.GenericKD.81984002 (B)
GData: Trojan.GenericKD.81984002
McAfeeD: ti!6529E8478A61
MicroWorld-eScan: Trojan.GenericKD.81984002
Symantec: ML.Attribute.HighConfidence
VIPRE: Trojan.GenericKD.81984002

Hashes

MD5 3e3089468d162efab89ef3b97c130c3e 🔍
SHA1 aea783e354a68564a5454d1d53198e55f9b22739 🔍
SHA256 6529e8478a6145df86d3703b861bb4714651341366afcad158167c6a340b7711 🔍
SHA3 01c4dd83fc21b3cafcfd6cdedd709bbe5abc36ed262d7c9e5cf00bcf5f91def6 🔍
SSDeep 49152:A6yqoENbazWZe7Y6zLBLSRPJkE/4IRlGNgLQXBHiV2eTChriwr:XTCd 🔍
Imports Hash 31816eddb8f2acd505e80008f87a112f 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2026-Oct-21 17:33:10
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xc00
SizeOfInitializedData 0xec00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x53000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 484f3cfd5f64cdaf39e5dc042fd50f6f 🔍
SHA1 54f249855978a49b7155af2a8501372e315834a8 🔍
SHA256 1a57e9111d1a051280c81a7a2f183a447e42de809938ca5d533ffb9f7b526200 🔍
SHA3 1aeaad2efe9bf985163b49f621d9c85b77d397d507b49a607aa1c88319e52e8d 🔍
VirtualSize 0xbe8
VirtualAddress 0x1000
SizeOfRawData 0xc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.70558

.rdata

MD5 b40fa61deec0eac9b11118aa69ae8725 🔍
SHA1 b1ede532f6a1979ed32dea70f8b5328d6037bcd8 🔍
SHA256 e91a8949bd32e436f54845aaf7faa98542d59a07181273882d190e76f0e7b4c6 🔍
SHA3 f6a9a5a49a1662914cf7289d42735beb142bbd886dc16045c4109ee3d420b315 🔍
VirtualSize 0x6ec
VirtualAddress 0x2000
SizeOfRawData 0x800
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.13112

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x40000
VirtualAddress 0x3000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 6655c8d57b553b7dbb42bb9b7d8220d0 🔍
SHA1 d256b8c1af2a1149e3a408684092745c30d9bfa0 🔍
SHA256 d4b06fc6d54c1c47e229510792df4fbc6e857d9756a646b9dafaa972638f1c48 🔍
SHA3 422ab7f9795251207c419f0ffd9595a0cdd5312053481eb3cb22f6978bd2fac1 🔍
VirtualSize 0xc
VirtualAddress 0x43000
SizeOfRawData 0x200
PointerToRawData 0x1800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.10191

.rsrc

MD5 eaad55147413ba06ca93743d2342865e 🔍
SHA1 a9d4523ff07b1ee7d3f97dfdbe9b77d36052ff9e 🔍
SHA256 ceca29b2e6ccee69ec9cce772a703932c06602491149b777c454ec41cd29f6b0 🔍
SHA3 f4c2bcc6f2d45a9fb3a3829bb7774d38d42d1d6fe10f9230af91ccf63037f1a3 🔍
VirtualSize 0xe01f
VirtualAddress 0x44000
SizeOfRawData 0xe200
PointerToRawData 0x1a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.9536

Imports

KERNEL32.dll CloseHandle
CreateDirectoryW
CreateFileW
ExitProcess
GetEnvironmentVariableW
GetFileSizeEx
GetModuleFileNameW
ReadFile
SetFilePointerEx
WriteFile
SHELL32.dll ShellExecuteW
USER32.dll MessageBoxW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x31c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.68164
Detected Filetype PNG graphic file
MD5 285ed241ddcf8d05b8193b561e8edc18 🔍
SHA1 936cd0e3dbed318491a29422cb7fa683a4384b28 🔍
SHA256 7ea627680cf7cdd6e2bcbed5c4946bf5a44552e0234380db81c6cbe4d8237f81 🔍
SHA3 50a0d150c29b333649076cf36548abd57fdeb486540ca95e0b070a5ff2858345 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x550
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.82587
Detected Filetype PNG graphic file
MD5 4cdb391c5d71f4987131156f3212f64c 🔍
SHA1 e459b92c2a0c77cab513944a87ec3154cfa1afc6 🔍
SHA256 3cb9f5e60f723b081e2d52738e2bb1dc44d199459fad1ac5c5e6d87a78388b21 🔍
SHA3 eb788ecbe2c36cb46735cf1d2a829db91e97117e8bec1ae458b7ca8ac00e93f4 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x856
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88677
Detected Filetype PNG graphic file
MD5 7cf269e98bbc953e9539bff3a132a2e2 🔍
SHA1 7ae11912704554754a5a53fd88eb678304535019 🔍
SHA256 53491f814f56e089cf0e2f4f8a5a32120b6a03a16e018b940f288c8610b0d3eb 🔍
SHA3 be0a57f7e8363fd7247b3164dc718e21cbb2412b3badb78431162fceb8d94ef8 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xebe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92498
Detected Filetype PNG graphic file
MD5 8029312a3ace253403e06ae1bd0f7776 🔍
SHA1 2755848ab4173951257b90dc49369c58bdce7c99 🔍
SHA256 68754654208b5a839bb76a8f484fb7fb940d4dc6ac9bfc53c1560dab2210fd9b 🔍
SHA3 df93821898d27d54cb5a4a0f0d8a4ecda54f4c664960ffb28cb58fa0a29c8d3f 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1581
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9453
Detected Filetype PNG graphic file
MD5 219d406688c7933427e762a526b6e4fb 🔍
SHA1 fc04b20e2dee8e6ed192259c2b72da89ea7af99b 🔍
SHA256 b3c81e0530f76fa1c6c9b3244202107893eac10db3a5a3ee8fc5ee31c8d80156 🔍
SHA3 e679c30a07911fc96662e4e2527505f9e6a59031d13be53caeb04b983be7675e 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x335a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97613
Detected Filetype PNG graphic file
MD5 674ed7de41bd4ae56dc697cec95c73fb 🔍
SHA1 376a0f89107b079438318fbb8a0e30af4622b987 🔍
SHA256 c288fccf34102330488cedf2b00fc15e84c7f477c883f082c7896688cbb7a408 🔍
SHA3 c15812e907dc2fe949966e7621c689e166c5f2aa1508581915a78fb43f27a99e 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x7284
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97598
Detected Filetype PNG graphic file
MD5 944dad71c415ff1e6f24bfd81dd1e6c7 🔍
SHA1 5ceadf397d5cc360212d6ed1a4c09257094f03f8 🔍
SHA256 11f2ca18bd3d4efa8795bd6d11d3b56b593bb56ef54e46eaf5f4e8de61fdb939 🔍
SHA3 26da88d5ca3d3fe190176d3f5c7dea06acb01e2b041ca9055f485afca35d36e2 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9405
Detected Filetype Icon file
MD5 21ee61ae1ef054cac1cba42bddd4239c 🔍
SHA1 787c1d24f15bb4d85a372915975ec29783774941 🔍
SHA256 f130cfdf9844089d07e4129292a3cc45e34d237a9bb4440b27e006fd1fb45978 🔍
SHA3 349a5e31608e91ec00dfed4af1b3a9842fe6ef7d765fcb29427b3c75c09276c3 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x2c7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.12777
MD5 a3d654f97475efbe2f43e63992c9d07d 🔍
SHA1 5fd6c24284b5f4d7171084e02689360a89c81859 🔍
SHA256 c9c021dd46681cdfbb273c1dd999f61c22e16987e22603c1c6d9cba7c198228b 🔍
SHA3 f2908e9670838411fb062909e603edc126fc4a1215bc49e243c0aea0018ab0fa 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .data has a size of 0!
Leave a comment

No comments yet.