688ce25c0d970bd0cc5a02bbb16a4301

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2024-Jul-31 21:55:52
Comments Delivering next-generation solutions for a dynamic world.
CompanyName EchoWave Technologies Inc.
FileDescription EchoWave Systems
FileVersion 1.0.0.0
InternalName George132Ian.pdf
LegalCopyright Copyright © 2026
LegalTrademarks EchoWave Technologies Trademark
OriginalFilename George132Ian.pdf
ProductName EchoWave Suite
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qEmU
Malicious VirusTotal score: 35/75 (Scanned on 2024-08-01 11:10:55) APEX: Malicious
AVG: FileRepMalware [Misc]
AhnLab-V3: Trojan/Win.RedLine.C5655019
Alibaba: Trojan:MSIL/Generic.86068e72
Avast: FileRepMalware [Misc]
BitDefenderTheta: Gen:NN.ZemsilF.36810.hn0@aW@YCAc
Bkav: W32.AIDetectMalware.CS
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: a variant of MSIL/TrojanDropper.Agent.GCY
Elastic: malicious (high confidence)
FireEye: Generic.mg.688ce25c0d970bd0
Fortinet: MSIL/Agent.GCY!tr
Gridinsoft: Ransom.Win32.Wacatac.sa
Ikarus: Win32.Outbreak
Kaspersky: HEUR:Trojan.MSIL.Agent.gen
Kingsoft: MSIL.Trojan.Agent.gen
Lionic: Trojan.Win32.Agent.Y!c
Malwarebytes: Malware.AI.4269122205
McAfee: Artemis!688CE25C0D97
McAfeeD: Real Protect-LS!688CE25C0D97
Microsoft: Trojan:Win32/Sabsik.FL.A!ml
Paloalto: generic.ml
Rising: Malware.Obfus/MSIL@AI.94 (RDM.MSIL2:5DythnHzo51pDfeFnjP7+Q)
Sangfor: Suspicious.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win32.Downloader.tt
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrendMicro: Trojan.Win32.AMADEY.YXEHAZ
TrendMicro-HouseCall: Trojan.Win32.AMADEY.YXEHAZ
VBA32: CIL.StupidPInvoker-2.Heur
Webroot: W32.Trojan.Agent.Gen
ZoneAlarm: HEUR:Trojan.MSIL.Agent.gen

Hashes

MD5 688ce25c0d970bd0cc5a02bbb16a4301
SHA1 4984205608a7585e8e78326e43cf2442a21c2147
SHA256 4d381490846011bb6f4814a0238194047d2078c90ada48aae6b89afc2b939bb9
SHA3 84187ac3c4ff5f55537f045bd70859741cbe89d73b5b3ca95db0d6d73f3c67c9
SSDeep 12288:saoC1vsSdG7a+CKe3/hR5TlHLAy3IzblaDklxG5MyVHKYp70C8QmBBoZUq9EbJd:sau7N2y0d+5KqP
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2024-Jul-31 21:55:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x11d000
SizeOfInitializedData 0xa00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0011EFBE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x120000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x124000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e81b0cc81e37c0479d2043c66975066b
SHA1 788a0dd0067a383f9937e5b5c20bb4df778f6009
SHA256 1f736c2ce1fb27827ffe42089e8d5826a7cef6a496ae0f87648b427543b7dfaf
SHA3 df4bd16339187549cfe02753788abbd27458f77259a9a3144f0b21fa8e85cc62
VirtualSize 0x11cfc4
VirtualAddress 0x2000
SizeOfRawData 0x11d000
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.50928

.rsrc

MD5 4675eacc0b32b5431b3ced0141f8ec9b
SHA1 9e1d851815dd6466cffcdc02eafaec7bbde332d3
SHA256 a02cf7dd015fd4c4d509c7dd6cca32ada61a1d4c9c2de4ec90bb930187a174af
SHA3 047cebeabd98897573b9da2b23fd8c7f97b3dacca529ee027a8a291321057aec
VirtualSize 0x6b8
VirtualAddress 0x120000
SizeOfRawData 0x800
PointerToRawData 0x11d200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.66246

.reloc

MD5 88b4c4524426657df22f99edebd5020c
SHA1 12890e5d80d529936e0868828a9612f562c2b5a9
SHA256 11b3fb8683d3a3b7a3e8825a1dc9a68a85987dbf03bf3d488292c959b909d44e
SHA3 e1d772e6d677abcec7e527965ffff1f3ca92e320633181a4308f8788130782f6
VirtualSize 0xc
VirtualAddress 0x122000
SizeOfRawData 0x200
PointerToRawData 0x11da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x428
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37167
MD5 54907963646e8f3f9bf031257f94ea91
SHA1 88ddb6d0f6240eb7c7040e4fa5ec771e8aff8fb0
SHA256 6ab27caa4a76df4b05497ee3412cc4c1fa70fa79dc0949811a113227289b586c
SHA3 73d46999eeb32d3dcaa5d9af2082c17bfe050c59532ff8565744bb54ee2bd350

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
SHA3 93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments Delivering next-generation solutions for a dynamic world.
CompanyName EchoWave Technologies Inc.
FileDescription EchoWave Systems
FileVersion (#2) 1.0.0.0
InternalName George132Ian.pdf
LegalCopyright Copyright © 2026
LegalTrademarks EchoWave Technologies Trademark
OriginalFilename George132Ian.pdf
ProductName EchoWave Suite
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

<-- -->