67545eabfb574fa05d42ef159c29b15e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2020-Nov-18 08:53:02

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • #14
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 6592164 bytes of data starting at offset 0x47a00.
The overlay data has an entropy of 7.99825 and is possibly compressed or encrypted.
Overlay data amounts for 95.7392% of the executable.
Malicious VirusTotal score: 8/72 (Scanned on 2020-11-20 16:05:00) ESET-NOD32: Python/PSW.Agent.ED
APEX: Malicious
Kaspersky: HEUR:Trojan-PSW.Python.Disco.gen
Antiy-AVL: Trojan[PSW]/Python.Agent
ZoneAlarm: HEUR:Trojan-PSW.Python.Disco.gen
Tencent: Malware.Win32.Gencirc.11b166a9
Ikarus: Trojan-Spy.Win32.Cordimik
Fortinet: Python/Agent.CD!tr

Hashes

MD5 67545eabfb574fa05d42ef159c29b15e
SHA1 42c59c3dd8962e93ef5656d7a25026f0b901e697
SHA256 c8c55b0ab9b6d3015c7d6fa9fdaa455c4c9f952bc0fe20a6e7f5fa418519dac3
SHA3 76302e2fc4dfd9b42c562d1ebcacfb8f5590e6a2a55f137e4537c4011feb6d58
SSDeep 196608:8GVeIs9onJ5hrZER4yiU8AdZYJERurTvrd0X7RcXqbDn:xs9c5hlEREAdZYygrHd0X7
Imports Hash 1584c4fb2d734c7604ced8bc66a2637d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2020-Nov-18 08:53:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x20e00
SizeOfInitializedData 0x26800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008704 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x56000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0d749f33fb1bf7c639b9887721f739e9
SHA1 8b64628e838e56d22ab1418f56a0b462499992bf
SHA256 6c2d6496b09ba335d02af400ffaf5fb76aa43277980e51a3ce631afac0fc868e
SHA3 f888db65fecc7cc09dd49289aa9b54148e83bdcac448788fb5e093c2b4fa8122
VirtualSize 0x20d60
VirtualAddress 0x1000
SizeOfRawData 0x20e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46265

.rdata

MD5 c1be0c6f00a1903209ee0d72cd133cc2
SHA1 fd03143f358d615c51711e8596dd833d840d798d
SHA256 39357b295f925c364cc6dc1aa16fa87edb99a5e894a7623b31aef5cc071adf4b
SHA3 2df016f0bedaeafb6a99aa85df126df3dc93e609722592bf54fdbda64092476f
VirtualSize 0xf6ee
VirtualAddress 0x22000
SizeOfRawData 0xf800
PointerToRawData 0x21200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.838

.data

MD5 d4f76363fc0b51f424c12dd11fe213d0
SHA1 b519337e47c4055bf28cc3e664d3be6da9e74ccd
SHA256 cda81e28d9abcda12c7833f3bb20dcb90ea8b06986df226d21c055fb24ee2cf0
SHA3 be161b29886acd0a1953dc3657a7e9bd0f4dd31b9a9af4cc99bb676720e2df48
VirtualSize 0xb0f8
VirtualAddress 0x32000
SizeOfRawData 0xc00
PointerToRawData 0x30a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.83628

.pdata

MD5 a19e1c900dbd7e281b2521e80386edb2
SHA1 141de02b92b9fd2394a7623c4afdd7ba1ebaaca9
SHA256 ccac9cb50133457a0b302f3fd1d15ff300a88bbb33a54e4ceb6228910c6c244e
SHA3 2cd3f842dc840298587b6c759d465b67e50f56a9a71094826fe4449ed4a793f1
VirtualSize 0x1cec
VirtualAddress 0x3e000
SizeOfRawData 0x1e00
PointerToRawData 0x31600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.23941

.gfids

MD5 7d8f7ca0a48ed9952dc9c55eb93cf178
SHA1 2a8d360e2936f4e4fbb7249fefb101a833b6f5f1
SHA256 d87f51b7bd200bb2b7674375c7daa5b69a29cb1efc6099a567d8bd7a52031958
SHA3 2695a0cb7cfe3e01224bb413ac31458c16ebdc550ca7c6a77562b22265160f47
VirtualSize 0xac
VirtualAddress 0x40000
SizeOfRawData 0x200
PointerToRawData 0x33400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.77966

.rsrc

MD5 770cd3ae7660161ac27a57611d6f4979
SHA1 e1a9b773f50c0c5649baca867da0d97630b1ece7
SHA256 68c3b2bd58be7d088bcf98868570c11e9c36a04437e022ab3ea8ffb0006a7afe
SHA3 ee5c66531f397a6872003fa284b676e1a824544cbeca86141e16f7fba3a62959
VirtualSize 0x13a80
VirtualAddress 0x41000
SizeOfRawData 0x13c00
PointerToRawData 0x33600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.38103

.reloc

MD5 1834e9fbd32b3cd88a7d0fbcef47c92b
SHA1 5dfc42d9393fa1d15a23dc5c89354b4f63a32447
SHA256 c26ded04cd8c8d9cf93b961db7c5da4f5ae84a0e378917b09285797c62ac9a21
SHA3 577329b484abb21fcc76cd367485b127415bf94ffbdb319364f7abcae238ee7b
VirtualSize 0x690
VirtualAddress 0x55000
SizeOfRawData 0x800
PointerToRawData 0x47200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.99631

Imports

KERNEL32.dll GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
ADVAPI32.dll ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll #14

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.1938
MD5 d61164e2af43fd81ce17ad5272f48382
SHA1 ff1045ef57a3c5b1cfbdf5f037168bcf0828d49e
SHA256 eb6a93d4d5586e57e7448589eee29f9dd2036d16654bf14e3d0dd0d522b0a904
SHA3 da9e8822e2230a3f5be2633c247ec5a6a98ba1a11a384bdcf38ddfde9adfd751

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.88771
MD5 c6e31c2ec040bc08ec8e6c91e76431ec
SHA1 69859fdc030079bfcae72a84ebea38a36fa926be
SHA256 b88b551a1c45ab523f9b83b8dcd1deb4bd63239e8e3dc0b0623a2a9a9253cd1e
SHA3 dea0554733aaf06bc6be3ae8dd0700b32412b9850d2f25416b2db8a91e54c67b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.64899
MD5 ac5d6be96914bbb66920daad46166201
SHA1 0ef131bb056d5a858a0f466921b961198ed38f72
SHA256 8134faa8118cf5495774f4c63fed5fa9abc2ed76461853c4567c8d39f98ed60f
SHA3 a3c16ff576ac6e1c721c6531871e9b62a17776c47655604c88553fb1d7a339f0

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28907
MD5 7a315c49c200c1fbcff74aaf436167c3
SHA1 b085773b7bb59e06617c6cb99cbbb950be4c8945
SHA256 29ba4c38c719c6ab7399afbb82297fcd083d74e41b2b70e7e5f390a9f439b004
SHA3 7d9a5b16a83ca348592e7841fb40a1f6079b54fc105899bd99d025737a543299

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xd948
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.80668
MD5 48ac13e975279ec64906b33bfbb035e3
SHA1 5a770bc61ab662a8d90d3e139765d29a774047c3
SHA256 15c50f731cfbba85c94196e247e9c644b421cb2db4ec60a7bf621280c283b356
SHA3 ae23e4fa4c40e52eb0cf6b0eb5baddf03e56f141f3910dbefed03955faf0d798

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.85257
Detected Filetype Icon file
MD5 0d854f6cf5a68d537e71b732c89cecd1
SHA1 bea5f230281219c7d5bbb87166c59e82646c36db
SHA256 44255bc4a2710e8b4c1d5c765f5264a6f6b131ba88ad274d7f225efcc3d800a5
SHA3 f08367d7ebde43906dfadfba7bef7c5f341f71824fe783c2aafa25cf432a96d6

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4fa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.26864
MD5 3e307aef380b96603870f8b61ba9fec4
SHA1 cbd71c65725b4aefcf023bc7303a453e78ebcf02
SHA256 dff8034dda36b314666b87d7c8a0f2913953b15abdea28037363e8d3c54715c1
SHA3 2c2db18a17a71ddf46fd3d532bd70402ea08650408cd41079edb8ab2ffb59f54

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2020-Nov-18 08:53:02
Version 0.0
SizeofData 720
AddressOfRawData 0x2ed18
PointerToRawData 0x2df18

TLS Callbacks

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140032010

RICH Header

XOR Key 0x281a5b95
Unmarked objects 0
241 (40116) 7
243 (40116) 169
242 (40116) 13
ASM objects (VS2015 UPD3 build 24123) 7
C++ objects (VS2015 UPD3 build 24123) 28
C objects (VS2015 UPD3 build 24123) 19
Imports (65501) 7
Total imports 114
C objects (VS2015 UPD3 build 24210) 16
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors

<-- -->