6d2201cc6ad7db7b7ac7ffc9726d92044fd427e41f05df928688b0eafe667dac

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-25 18:14:36

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Functions related to the privilege level:
  • OpenProcessToken
Enumerates local disk drives:
  • GetDriveTypeW
Manipulates other processes:
  • OpenProcess
  • Process32FirstW
  • Process32NextW
Suspicious The file contains overlay data. 12639105 bytes of data starting at offset 0x75400.
The overlay data has an entropy of 7.99874 and is possibly compressed or encrypted.
Overlay data amounts for 96.3393% of the executable.
Malicious VirusTotal score: 44/69 (Scanned on 2026-09-04 09:56:19) ALYac: Generic.PySpy.B.6C6EA539
APEX: Malicious
AVG: Python:Stealer-GI [Trj]
Alibaba: TrojanPSW:Win32/Almi_Disco.b
Arcabit: Generic.PySpy.B.6C6EA539
Avast: Python:Stealer-GI [Trj]
Avira: TR/Stealer.GI
BitDefender: Generic.PySpy.B.6C6EA539
Bkav: W32.Malware.10166781
CTX: exe.trojan.stealer
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
ESET-NOD32: Python/PSW.Stealer.FE trojan
Emsisoft: Generic.PySpy.B.6C6EA539 (B)
F-Secure: Trojan.TR/Stealer.GI
Fortinet: W32/Stealer.FE!tr.pws
GData: Generic.PySpy.B.6C6EA539
Google: Detected
Gridinsoft: Spy.Win64.Keylogger.sa
K7AntiVirus: Password-Stealer ( 005d77fb1 )
K7GW: Password-Stealer ( 005d77fb1 )
Kaspersky: UDS:Trojan-PSW.Win32.Pycoon
Kingsoft: Win32.Troj.Unknown.a
Lionic: Trojan.Win32.Stealer.12!c
MaxSecure: Trojan.Malware.275221279.susgen
McAfeeD: ti!6D2201CC6AD7
MicroWorld-eScan: Generic.PySpy.B.6C6EA539
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Rising: Stealer.Discord/PYC!1.10249 (CLOUD)
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win64.Injector.rc
Sophos: Mal/Generic-S
Symantec: Trojan.Gen.MBT
Tencent: Malware.Win32.Gencirc.14b47949
TrellixENS: Artemis!C33E381E883E
TrendMicro-HouseCall: Trojan.Win64.STEALER.USBLHR26
VIPRE: Generic.PySpy.B.6C6EA539
Varist: PYC/Hazgrab.A.gen!Camelot
Zillya: Dropper.Agent.Win32.746397
alibabacloud: Trojan[stealer]:Python/Stealer.FA
huorong: TrojanSpy/Python.Agent.a

Hashes

MD5 c33e381e883ecb82ae4af47b08bd74a3 🔍
SHA1 1c825785d6f7ca4e2dc3a8b16a63396e13dcadce 🔍
SHA256 6d2201cc6ad7db7b7ac7ffc9726d92044fd427e41f05df928688b0eafe667dac 🔍
SHA3 a84d1c3d3902fa0f42723efdde342e3938f60d5ab2b6be566088c1211cffefda 🔍
SSDeep 393216:R85vz9yMDIOnGCnGjNeMwBWv0ibJP3+F8bfTeHm:m5vz9LDIOnGCnkNeMwGtdP3O8bLeHm 🔍
Imports Hash 1dcd477cce07724ec6b817b3be71540e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-25 18:14:36
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2ca00
SizeOfInitializedData 0x48600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000E310 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x7e000
SizeOfHeaders 0x400
Checksum 0xc8be18
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dbc45db5c828d067c8d8296eea39eeef 🔍
SHA1 bd42bb6b0c3fa8341ece53429f64671d6929940e 🔍
SHA256 6fcaee6735d961a7ded1c1d8fd789ef6d4a8ac7a5c551b04afbad8e32c1da4e3 🔍
SHA3 c60d549bf5f5cf4d2a3b1e6a527c9b2eb6122117e6238df50118d2b59cccd5bc 🔍
VirtualSize 0x2c820
VirtualAddress 0x1000
SizeOfRawData 0x2ca00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46488

.rdata

MD5 a42163e3d5123524d5c7ab779c133bb7 🔍
SHA1 31208856fed698e008c224b615211fa29098ae2d 🔍
SHA256 6890bf52bd8dd1ef4d026230ee7025b2737c20d6d195dde9117542841109af1a 🔍
SHA3 e427ecaba700ef7b862126b27aab4cf2e08739e4263ff184e02073c515a5af51 🔍
VirtualSize 0x142a0
VirtualAddress 0x2e000
SizeOfRawData 0x14400
PointerToRawData 0x2ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.72232

.data

MD5 95520b60937e1af52257bbc6c81c4470 🔍
SHA1 cfdd3067015dccad0f22501b09f2a32d678fa817 🔍
SHA256 c840049dc4e32cac0b18bae3e0a03a6b98c41b0ab11db51012d4504ec9445544 🔍
SHA3 974b380d2237ce4ad6a5143f0cbae708b6402677f514bc2710a5f78248bb987e 🔍
VirtualSize 0x4af0
VirtualAddress 0x43000
SizeOfRawData 0xe00
PointerToRawData 0x41200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.8178

.pdata

MD5 90e5a87777f5ea746fb444a9f48d1387 🔍
SHA1 b923bf23d1f527437890fddfbd2d7d9190f0f64c 🔍
SHA256 17ecd4bd75d90dfb496e49b5c9b4f56ace348b772642753479cf3c821b1460f7 🔍
SHA3 5d6ee8d42dd16e0212c959044f324dfc7472b6c3aad7874ca1aa2ad1702a1931 🔍
VirtualSize 0x2538
VirtualAddress 0x48000
SizeOfRawData 0x2600
PointerToRawData 0x42000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.43496

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x4b000
SizeOfRawData 0x200
PointerToRawData 0x44600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 eeaacfcc0bb9b19b89ae55720d9bd858 🔍
SHA1 ad0c10d0bc9b389688abcc0fe432aeaad64bdce0 🔍
SHA256 4a4712740ca18038ae75b4682fbb63ba40ec876e7862a7a25e67f97bc63bf4e9 🔍
SHA3 3b5caebf9b92c86afaa3e2739a4df4cab0b3644411895e11c8fb45dbb5e1d8d9 🔍
VirtualSize 0x303cc
VirtualAddress 0x4c000
SizeOfRawData 0x30400
PointerToRawData 0x44800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.98437

.reloc

MD5 d64e371659660ce2dd5153b51730a694 🔍
SHA1 d26b5588366a5395483d1ee0529ff11c0c5b4011 🔍
SHA256 2995bcb2f152a69d2241f279f3ba9a3ea0dfd9db1cfe3f5b5083852750cd32ba 🔍
SHA3 481a7388d59ebb0f78df69cf3917426231e61c30a91015d9cb14185f26994db9 🔍
VirtualSize 0x760
VirtualAddress 0x7d000
SizeOfRawData 0x800
PointerToRawData 0x74c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.2433

Imports

USER32.dll CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
CloseHandle
GetCurrentProcess
QueryFullProcessImageNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
ADVAPI32.dll ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2fa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.651
Detected Filetype PNG graphic file
MD5 781e16c043235c63647032864e81e249 🔍
SHA1 d42c86f8e79e3a0e3540dc44b0c7d8e69d58f598 🔍
SHA256 e5da69001f015dd49996b6fe877b1ea0a942cf96981f07f036cd8e7ba4fcb593 🔍
SHA3 616664704fa0c1ebf83a065340556ca42720c44bcb86876d4666372bed4426fc 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xa49
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91441
Detected Filetype PNG graphic file
MD5 fe01c5097a3269ce53c2cdfd91d41342 🔍
SHA1 ab9cd6cf4c2ba8cd0097a7bf0178354f12cabcf0 🔍
SHA256 1d0457dbd7372e7566ac13a6db2eb904219d3fb69a5371a9960ebb621d9c1ee7 🔍
SHA3 b2dea773862db5ba632adcb05b8acbd860cae38fe58328fbd7caa8fe97c35c0b 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1650
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9489
Detected Filetype PNG graphic file
MD5 341d45073dc19e7a73dc3b3da69a88ab 🔍
SHA1 7df567c43ad81f26b85d230a2d1bc06dd58ad33b 🔍
SHA256 6bec78540ccc4accdfe86449a3002db9c8194dfb7d089d46fbd370d3c93441a3 🔍
SHA3 ea5b6c7b660257aac762c90589bb509c38ee4753689bf68f6dfea094e97196c9 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x26f3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96344
Detected Filetype PNG graphic file
MD5 bac4c090350dfedcc9aeecd19369b34c 🔍
SHA1 770373aee4a45892784c144090cf4ba38aa1e1ad 🔍
SHA256 39a2cd7e7827919e3dc3920e84cdcb2102cbe20e10dc0952d5fee5ffe2b068b4 🔍
SHA3 4ae29a71654ff32668f017587e7f0483314b71b0d5215b20e6e7eebc4ff1a436 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x92a4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98031
Detected Filetype PNG graphic file
MD5 59badd2e737301079f1936ec4aa13873 🔍
SHA1 b43d3657ffe882cd3e7a51d53a5979fab4bffdb2 🔍
SHA256 5eae05f45565851f8d55e62a07e864c7a15aa7dc90c0b8ff89ea8bea20ce0644 🔍
SHA3 09f23b4daaa7df99afc5dc4267b7eb5b89d1e476351d9e9652570af030727f68 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x21f57
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9855
Detected Filetype PNG graphic file
MD5 1ccb3dec77e4dfd801739f206e26365d 🔍
SHA1 fda79f0e1c643fd7d155e41c5487d4c8570c739e 🔍
SHA256 66094a4cd289a216a78c05920429b742a5cbe7484a7f5e04f77f64b155f1b8f3 🔍
SHA3 a23b90fda38fcb59595f70c487706b520c805a99a188d076d4c2aa08727372e8 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66591
Detected Filetype Icon file
MD5 dcce8b8dfebd59ab8a84e9844425b5ac 🔍
SHA1 a5707ba0aaa0a6ff9ac05a02036e0e89aed62ca2 🔍
SHA256 b88bb650f6dd8048a2b589a78f8829c0e6b36b82e12d23b5fb288d858257896b 🔍
SHA3 e5f4e885ada111c97548c00f3c96fd7bd8198d2ea3d8d340e09a9f22628a3701 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae 🔍
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23 🔍
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11 🔍
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-25 18:14:36
Version 0.0
SizeofData 816
AddressOfRawData 0x3e5b8
PointerToRawData 0x3d3b8

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140043040
GuardCFCheckFunctionPointer 5368898768
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xe0284a65
Unmarked objects 0
C++ objects (33145) 183
C objects (33145) 12
ASM objects (33145) 11
253 (35721) 3
ASM objects (35721) 9
C objects (35721) 17
C++ objects (35721) 39
Imports (33145) 11
Total imports 163
C objects (36246) 30
Linker (36246) 1

Errors

Leave a comment

No comments yet.