66c058437ec794aba3f851cc7e3cf4fa
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2019-Jul-30 08:52:21 |
Plugin Output
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource 59671D98D7F1E5DF77F1919DEFB07252 is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 37/72 (Scanned on 2024-11-28 22:10:40) |
Alibaba:
Trojan:Win64/Coinmin.43ed5e6b
Antiy-AVL: Trojan/Win32.SchoolGirl Bkav: W64.AIDetectMalware CTX: exe.trojan.generic Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) FireEye: Generic.mg.66c058437ec794ab Fortinet: W64/CoinMiner.526230!tr GData: Win64.Trojan.Agent.N5BCPD Google: Detected Gridinsoft: Trojan.Win64.CoinMiner.ca Ikarus: Trojan.PowerShell.Agent K7AntiVirus: Riskware ( 00584baa1 ) K7GW: Riskware ( 00584baa1 ) Kingsoft: malware.kb.a.876 Lionic: Trojan.Win32.Gen.tqzj Malwarebytes: Generic.Malware.AI.DDS MaxSecure: Trojan.Malware.300983.susgen McAfee: RDN/Generic.grp McAfeeD: ti!00748D7EA4CC Paloalto: generic.ml Rising: Trojan.Agent!1.E32B (CLOUD) Sangfor: Virus.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Generic.ch Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: suspicious.low.ml.score TrendMicro: Coinminer.Win64.MALXMR.TIAOODHT TrendMicro-HouseCall: Coinminer.Win64.MALXMR.TIAOODHT VBA32: TrojanPSW.Win64.Banker Varist: W64/Bulz.BB.gen!Eldorado VirIT: Trojan.Win32.Banker1.BMNA Zillya: Trojan.Generic.Win32.838255 tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2019-Jul-30 08:52:21 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x16200 |
| SizeOfInitializedData | 0x13200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2e000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.code
.text
.rdata
.pdata
.data
.rsrc
Imports
| msvcrt.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathAddBackslashW
PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW DefWindowProcW GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW EnableWindow DestroyWindow UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled GetSystemMetrics CreateWindowExW SetWindowLongPtrW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|