68970b2cd5430c812bef5b87c1add6ea

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Dec-27 11:39:06
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to AES
Malicious The PE contains functions mostly used by malwares. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
Suspicious The PE is possibly a dropper. Resource 101 is possibly compressed or encrypted.
Resources amount for 87.4081% of the executable.
Malicious VirusTotal score: 17/66 (Scanned on 2018-02-09 19:25:33) McAfee: Artemis!68970B2CD543
Cylance: Unsafe
Symantec: Trojan.Gen.2
TrendMicro-HouseCall: Suspicious_GEN.F47V0209
Paloalto: generic.ml
Kaspersky: HEUR:Trojan.Win32.Generic
Tencent: Win32.Trojan.Generic.Wqdj
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.AdwareLinkury.bc
Avira: TR/Dropper.Gen
Endgame: malicious (high confidence)
AegisLab: Troj.W32.Generic!c
ZoneAlarm: HEUR:Trojan.Win32.Generic
SentinelOne: static engine - malicious
eGambit: Unsafe.AI_Score_82%
Fortinet: W32/Generic!tr
CrowdStrike: malicious_confidence_100% (D)

Hashes

MD5 68970b2cd5430c812bef5b87c1add6ea
SHA1 7695d829965b802c50d96a19dbc2fc361169624d
SHA256 e4e1e3c44e01c60fd433c6283bd8cd15a9941e1cbaad72e6409cc92e2e91263e
SHA3 f93a9f8e0c6d80ce2d58e136533c428697109be9ffa224f96bb3fc645b9324b1
SSDeep 12288:CfllCVZmJ8DZ3NneZhCC1Ktgfy7Wbw8b5t2p5g4j2/QvtH4Sde48m7G2:SbCVZmJ8DtNeZhCYtfy7gw82p5g4S/l
Imports Hash da1c2d7acfe54df797bfb1f470257bc3

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2017-Dec-27 11:39:06
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0xee00
SizeOfInitializedData 0xad600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x40f1 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x10000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc1000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0a7d81f07adb281726b8317640ceab0f
SHA1 1e92e18f8af582780c771d00abb4260d648423c4
SHA256 e2ffc648ebce2887e7b17b1558ef4a7ea5485d996b72d27a4f9a079b9133d7f5
SHA3 a374e97fd72ea1911cf77a84ac1820c9d81ef2a185e4f0cdba980c274e6ad8be
VirtualSize 0xecbe
VirtualAddress 0x1000
SizeOfRawData 0xee00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.65174

.rdata

MD5 1ce9ef7a6de69488adfb23689ec2daeb
SHA1 e0daa6d63c91c1f10a1534b616d71f8112916ea3
SHA256 0fb2581bace04c01065c06a73f553ff2cf74a86afec6f54b34badbd09b176101
SHA3 de1b5950abcd3f35278d474820d298ceeebbcd17d77d96f293b22c54d47274b6
VirtualSize 0x67fe
VirtualAddress 0x10000
SizeOfRawData 0x6800
PointerToRawData 0xf200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.09407

.data

MD5 58117d04b6707649d45c9b9314c9f1da
SHA1 3aaacc16579ab392f6d2647b3278adfb61614316
SHA256 a20cf140301e2f217311d270eb7eef505c04c44761abfc3ac51a84cd031f36d9
SHA3 be506587a5acdef62d363ead37735e1d5218c0ad0a55187290ddf7cdb5dc9cc1
VirtualSize 0x1398
VirtualAddress 0x17000
SizeOfRawData 0xa00
PointerToRawData 0x15a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.28365

.gfids

MD5 47ef1dc44f97e3ad8dceb9a6abf66ebc
SHA1 eb3a1fba9d31034b191f9ebccd77e5751c3e20af
SHA256 ce485b6987c719bc0805f01b094256e01112094dca59621d5acf3d7df44ae37a
SHA3 9e82f2eac4452f8050ece79fadcacd668594c01ca64f0492878507f5dc91fce0
VirtualSize 0x11c
VirtualAddress 0x19000
SizeOfRawData 0x200
PointerToRawData 0x16400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.05091

.rsrc

MD5 9780edc8e7fcd68dc14f9f1e35334473
SHA1 68876cfd8d69be2025b86cd6a394f6678a0d2753
SHA256 37def02bf4bb19306ef4a684927bf74d52ed5dd85bf5400c9f5a627f1ec3bc3f
SHA3 84cd238aa949266d6d9a60d7c6bb2181efe174001aae54c52b0b6d746a0e2521
VirtualSize 0xa4430
VirtualAddress 0x1a000
SizeOfRawData 0xa4600
PointerToRawData 0x16600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99954

.reloc

MD5 9647b300bd22cf3acc60b3c000e8ca4f
SHA1 fb1f4592e9f2584dcef8a93bbbced79d13e7bf8f
SHA256 a75cb9eca948a9e93ff37ed0c4bafcd7067a39517c21f5cb8c6d0be40fb71b51
SHA3 a31cbc9f6485269b1e8de699fc112f25c441fe8aa50a8c4f7c5689ab4e81a1a2
VirtualSize 0x10c8
VirtualAddress 0xbf000
SizeOfRawData 0x1200
PointerToRawData 0xbac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.35112

Imports

KERNEL32.dll FreeLibrary
CreateFileW
CloseHandle
WriteFile
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
GetProcAddress
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetCommandLineW
WriteConsoleW
LoadLibraryA
VirtualAlloc
VirtualFree
SizeofResource
VirtualProtect
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer
RaiseException
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetACP
SetFilePointerEx
GetFileType
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleCP
DecodePointer
ADVAPI32.dll LookupPrivilegeNameW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
SHELL32.dll CommandLineToArgvW

Delayed Imports

101

Type BMP
Language English - United States
Codepage UNKNOWN
Size 0xa4200
Entropy 7.99967
MD5 637d7698f54afe8444fd7e9bf58ac408
SHA1 c48637663ac4eed00ed8d0902fb0f7931cfc5062
SHA256 448a8e7cb613fcda3bbe0b3d4d91398f349d542d28f83e407a5c6def0647fe38
SHA3 c0d7964f1671223c30746051ccfcadd9faabf40ab0cb954540277d6f2882cc28

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 f9bb44aef537881abf673616b9f61c56530cf3a96292ccf2ae5654beffc84ec6

Version Info

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x417004
SEHandlerTable 0x4156b0
SEHandlerCount 7

RICH Header

Errors