7251be287147484a106564987fa80f371077b911a8d96455100669dbe8055241

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-16 21:03:06
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • https://t.me
Info Cryptographic algorithms detected in the binary: Uses known Mersenne Twister constants
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can access the registry:
  • RegCloseKey
 Possibly launches other programs:
  • ShellExecuteW
 Has Internet access capabilities:
  • WinHttpOpen
Malicious VirusTotal score: 12/70 (Scanned on 2026-09-16 21:09:39) Bkav: W32.Malware.35C8C0E2
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
Elastic: malicious (moderate confidence)
Google: Detected
Ikarus: Trojan.Win64.Krypt
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: ti!7251BE287147
Microsoft: Trojan:Win32/Wacatac.B!ml
Skyhigh: BehavesLike.Win64.Dropper.vc
Sophos: Generic ML PUA (PUA)

Hashes

MD5 1749f30ffe87c16bb37fea47726918e2 🔍
SHA1 ddcf9e1ffbb46780b5eefc898583957e85c5eb2b 🔍
SHA256 7251be287147484a106564987fa80f371077b911a8d96455100669dbe8055241 🔍
SHA3 26b7b0fee175eec03234b361a2affa289c6b5a31b3da640c9ae71d92bf0cea8b 🔍
SSDeep 49152:ClS7PRv/cPcw+MhSnZQburQ9TZbIJf0BADXvzBFITOerWv:CPcJMheZXrqTZkJsBArvlFmOz 🔍
Imports Hash 2ce419b2835a6bb97e1bbd09d9afa5cd 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 3
TimeDateStamp 2026-Sep-16 21:03:06
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x25d000
SizeOfInitializedData 0x1000
SizeOfUninitializedData 0x3f6000
AddressOfEntryPoint 0x000000000064E980 (Section: UPX1)
BaseOfCode 0x3f7000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x655000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x3f6000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 0d99d64822a1f2ab7906717734cf371f 🔍
SHA1 1f430ac70073f69096af126b9eeb97dcbbfcf3eb 🔍
SHA256 1a8ad62cfa22a8ab6113c872517002227e799e0f93531379815e4b58bae2be33 🔍
SHA3 559dcf1993bdc4a6c2ede4b4ee5195ac3f440ab1c7779f026dabecc395abe0d5 🔍
VirtualSize 0x25d000
VirtualAddress 0x3f7000
SizeOfRawData 0x25c200
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.91841

.rsrc

MD5 190a201071999b44a45df9f5f047fc89 🔍
SHA1 3b9815eaa4076daec69c49b63d9ed7c70e7319fc 🔍
SHA256 843da1334a587d5bc61a4a5584c71c4900e5877bf18cea666e54a25cf5d8ab1a 🔍
SHA3 d635a18b7d799db05d83f38667d8468e8d29b5f04f3e6091baeb674080f25b69 🔍
VirtualSize 0x1000
VirtualAddress 0x654000
SizeOfRawData 0x600
PointerToRawData 0x25c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.72716

Imports

ADVAPI32.dll RegCloseKey
api-ms-win-core-synch-l1-2-0.dll WaitOnAddress
api-ms-win-core-winrt-error-l1-1-1.dll RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0.dll RoGetActivationFactory
d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
ole32.dll CoInitializeEx
OLEAUT32.dll SysStringLen
pdh.dll PdhCloseQuery
SHELL32.dll ShellExecuteW
USER32.dll SetCursor
WINHTTP.dll WinHttpOpen

Delayed Imports

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x87
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.66463
MD5 d531bf1544c19ee7c3dc477d8fd9c302 🔍
SHA1 3120b5f05a48d41b42e8542d23725c98e1af83b9 🔍
SHA256 39abce8cd98964b342942a3770e2ce865cda054577ddc4b790ccc0ece897a371 🔍
SHA3 892e36cfcac6e08d443805d5b103b9b2be2f46665b35309eb4561d0f8bb18d88 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180612a00

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section UPX0 has a size of 0!
Leave a comment

No comments yet.