740db825ceed7b49538024a506e2bb1a
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-May-16 17:10:12 |
| Detected languages |
English - United States
|
Plugin Output
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to AES |
| Info | The PE contains common functions which appear in legitimate applications. |
Can create temporary files:
|
| Suspicious | VirusTotal score: 2/65 (Scanned on 2018-05-23 11:40:00) |
ESET-NOD32:
a variant of Win64/Kryptik.BJT
Paloalto: generic.ml |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2018-May-16 17:10:12 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x37400 |
| SizeOfInitializedData | 0x54ce00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000037048 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x589000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x589c3c |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
.reloc
Imports
| KERNEL32.dll |
TerminateProcess
GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess DeleteCriticalSection CreateEventW InitializeCriticalSection CreateMutexW GetProcAddress GetModuleHandleW CloseHandle GetTempPathW CreateFileW GetFileAttributesW Sleep WaitForSingleObject GetStartupInfoW GetSystemTimeAsFileTime |
|---|---|
| SHELL32.dll |
ShellExecuteExW
|
| MSVCP90.dll |
?deallocate@?$allocator@D@std@@QEAAXPEAD_K@Z
|
| MSVCR90.dll |
__crt_debugger_hook
_decode_pointer _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ __set_app_type _encode_pointer _fmode _commode __setusermatherr _configthreadlocale _initterm_e _initterm _wcmdln exit _cexit _exit _XcptFilter free _errno _wremove _beginthreadex rand srand ??3@YAXPEAX@Z wcscat_s realloc wcscpy_s _time64 malloc __wgetmainargs memset __CxxFrameHandler3 vswprintf_s ??2@YAPEAX_K@Z memcpy __C_specific_handler _amsg_exit |
Delayed Imports
1
2
3
4
5
MAINICON
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x9b4ad896 |
|---|---|
| Unmarked objects | 0 |
| 150 (20413) | 1 |
| ASM objects (VS2008 SP1 build 30729) | 2 |
| Imports (VS2008 SP1 build 30729) | 4 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 19 |
| Total imports | 235 |
| C objects (VS2008 SP1 build 30729) | 20 |
| C++ objects (VS2008 SP1 build 30729) | 59 |
| 138 (VS2008 SP1 build 30729) | 2 |
| Linker (VS2008 build 21022) | 1 |
| Resource objects (VS2008 SP1 build 30729) | 1 |