780c64adafac76b2663aa8ca25ad41b0

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2075-Aug-05 12:37:31
Detected languages English - United States
Comments
CompanyName
FileDescription AX
FileVersion 1.0.0.0
InternalName AX.exe
LegalCopyright Copyright © 2021
LegalTrademarks
OriginalFilename AX.exe
ProductName AX
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .imports
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
The PE only has 2 import(s).
Malicious VirusTotal score: 29/67 (Scanned on 2021-10-16 03:18:23) Bkav: W32.AIDetect.malware2
Elastic: malicious (high confidence)
MicroWorld-eScan: Gen:Variant.Zusy.394638
ALYac: Gen:Variant.Zusy.394638
Cylance: Unsafe
Sangfor: Trojan.Win32.Save.a
CrowdStrike: win/malicious_confidence_60% (D)
Symantec: ML.Attribute.HighConfidence
APEX: Malicious
BitDefender: Gen:Variant.Zusy.394638
NANO-Antivirus: Virus.Win32.Gen-Crypt.ccnc
Ad-Aware: Gen:Variant.Zusy.394638
Emsisoft: Gen:Variant.Zusy.394638 (B)
McAfee-GW-Edition: BehavesLike.Win32.Generic.rc
MaxSecure: Trojan.Malware.300983.susgen
FireEye: Generic.mg.780c64adafac76b2
Sophos: Generic ML PUA (PUA)
SentinelOne: Static AI - Malicious PE
GData: Gen:Variant.Zusy.394638
Avira: HEUR/AGEN.1144635
Gridinsoft: Trojan.Heur!.032104A1
Arcabit: Trojan.Zusy.D6058E
Microsoft: Trojan:Win32/Sabsik.FL.B!ml
Cynet: Malicious (score: 100)
MAX: malware (ai score=84)
VBA32: BScope.TrojanDownloader.MSIL.Pasta
Rising: Trojan.Generic@ML.98 (RDML:Hy9so8iDo6FPWCO5bIJEuQ)
BitDefenderTheta: Gen:NN.ZexaF.34218.@F0@a8I!6sli
Qihoo-360: HEUR/QVM19.1.A2B3.Malware.Gen

Hashes

MD5 780c64adafac76b2663aa8ca25ad41b0
SHA1 6c673a2ba8b83f1fcd9a6577bc5f32d12668dc68
SHA256 89a153619f4c4bb59ff2bea09042489de9e5208cee611a99fb7f52bddcb69693
SHA3 6f82550f4dcef26b8e3187f41890b74a432dbaef1a43c6de1f2caaa7ce91c85c
SSDeep 98304:uttGIpmwqhlCmnpgTiZ0lko2JK4WfPW0SLeEdrKshtTWUdSM8T:OtG0mwYlC+uTiIko2Jr4ceCrK6htQHT
Imports Hash 4328f7206db519cd4e82283211d98e83

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2075-Aug-05 12:37:31
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x7400
SizeOfInitializedData 0x1a800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0074E058 (Section: .boot)
BaseOfCode 0x2000
BaseOfData 0xa000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xbe4000
SizeOfHeaders 0x400
Checksum 0x4b9b0b
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 a6d405a187ef987f40ae308bd9735a58
SHA1 adee0ad06e7ce60b944781881804376ac582ec78
SHA256 e12d7162e3fa13ca0c206ef6fd6913acf6278c9fba627273bed77888b8e72f61
SHA3 4fb399a4d63e0beb24067d8df6087206c9258c2f6c7186b0a13985944c706a92
VirtualSize 0x8000
VirtualAddress 0x2000
SizeOfRawData 0x2ee8
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.932

(#2)

MD5 a71053ebe60c41e15d4c337e4dfcb446
SHA1 b3fd99dae1bf505824a7cccdad0e7fd8572ac5ac
SHA256 40093ee6bd5758a0907cafde10bb6ecd3d7fb29cb044069f359f9a323bce11d9
SHA3 19d76936c5ba8f75ae1484291c50ac9e5d5e35e7b9cd1043877ec2da70588a8c
VirtualSize 0x1a550
VirtualAddress 0xa000
SizeOfRawData 0x2c0d
PointerToRawData 0x3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.92973

(#3)

MD5 e6e108ed26fa11fa5eb9bd0ba8bd487f
SHA1 216059e7f8ce77dda15876d62ab56fb537793548
SHA256 9c689b144d653ac8f96c9429fc962b09022cce739ce3c33287a4fd442f0cd27b
SHA3 679fd569aeb79d68454736f1ab520bbf564b00974596b52f027d434d28266d44
VirtualSize 0xc
VirtualAddress 0x26000
SizeOfRawData 0x10
PointerToRawData 0x6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4

.imports

MD5 83d5cbc2b9753e75d2d94ec0a6838f7f
SHA1 107bb2a2345f04a40fcfa5907472f41f257a1aef
SHA256 caf30607444d783bd6fb90f219850e1c4a4db19fc190566bb77d6143af8b9782
SHA3 724da9fc8a84040cbfbfa8f1d88e08486d738ea452937b1b30b6320d933f7e1a
VirtualSize 0x2000
VirtualAddress 0x28000
SizeOfRawData 0x200
PointerToRawData 0x6400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.14055

.rsrc

MD5 0a43ce01b36cde31ea2e89977d0c7fbd
SHA1 4a934b7d7ed0ed4c174bbee729b8290866d763a7
SHA256 dd195df2672bce46ccd73da7255433c9907d6a47d578225f8e5ddce27ed4b14d
SHA3 7d5e2ebf31ae890999e53410652296862a7dd8a7d9c2bd10a94b58c44c7495ac
VirtualSize 0x1a600
VirtualAddress 0x2a000
SizeOfRawData 0x1a600
PointerToRawData 0x6600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.95392

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x708000
VirtualAddress 0x46000
SizeOfRawData 0
PointerToRawData 0x20c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 ff0fa185996874adba436e8ab08e59f2
SHA1 01d9b4239157b358af75f4ba48221000ad3f5fc2
SHA256 d1b15437495affca8a0d2f6168d655349e66672c0d5c7ae986695045315af6c2
SHA3 0796a241738093a00f866947a2685f76d2c1e6f7916d9a62f53324500a57dd8e
VirtualSize 0x496000
VirtualAddress 0x74e000
SizeOfRawData 0x495f24
PointerToRawData 0x20c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.95386

Imports

kernel32.dll GetModuleHandleA
mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xe80
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73809
Detected Filetype PNG graphic file
MD5 9d4ede7c4519ecc0fb9bf39304e02598
SHA1 622d58d3e06040b10c61a7ef110e6cc027af92b2
SHA256 ca61bca8633099239820f103b32720584f5d5f1afeb3beeeca3d89156a425b89
SHA3 82a98dd06b23d0e802212243e817cc19885b3c4df17aa25087e3e0070fe19731

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.06703
MD5 6b947603bb5187c076d1f9ef63aa33b6
SHA1 be7768b1072bb1429435bb3f3a3ab65875dfb43f
SHA256 3927bc85d74f6f666301bb1deabdfa9e5f91b042f1f267975b239d7ad8057f45
SHA3 9057317e356ef7c5530528e8b3affd2ceb85686ff8828426ca19e3fcd124ed4f

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.36557
MD5 7e85be5956cc70b0990b85683bd8f3e4
SHA1 65cf3114269c6fa2c6e8eaf5a586141e37f79821
SHA256 bedfd3c6bb70bff0b220f3d74e6e8ec3f537ebdbad5aa9fbde8a1a6d84e6f496
SHA3 60bbc2e1b4940ff38d772e24b8249ea969e790163b4e506b70e4a40caccfadd3

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.71933
MD5 c86b0a1eb24b8dbe58b95eac452e11ed
SHA1 6cfc926308a2eb26ff4dea3e1cb254e882fef5fe
SHA256 6dc67090ea85fcf443afe0fbdedf212cbc2a9c7acfe593fdd04240906a90af59
SHA3 7b0d5e65e2eaa974fbfe85e770b4593863fd7c0ac620f1213f25fc088bdef01e

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.75441
MD5 ddc8f9edc5e4020b0f33327f14442f75
SHA1 f0e0f3ae01b7f65b74f4b6781b1a229cbb654f2a
SHA256 1284dbc7fb1acbbbdc0d5641f7c5b2d69a6bdabca51d7dcee9e47dc740b3c90a
SHA3 36d05d5781280e34f746bcd9119f4028722abf9abd4eeb6bdcf693ef4a01563a

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.54621
MD5 0a5ccee55dd7a3fe05450e25b203903d
SHA1 c2996de00be9dd6df1f86a607a8e5b487d12f529
SHA256 659731a1eeefda901a7abde91ab5290628964f15c39b85233d9a68f6b9f93c7e
SHA3 1d46584f0ef8b3f917c011b6d3496a373de16ae94d2e97d4c776f288361aba7a

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.76847
Detected Filetype Icon file
MD5 391988bc2dc9f8a551e9852ad9ee31fe
SHA1 4d4ab5ad4bdfb596d05190e3b5306854b8613a7a
SHA256 dd821befdac1a3a4dbb99634bcf6061cc72f977fc38ae5b5d846bbd3fc555c04
SHA3 c7eba625a34700b79eac25b734698aef0f8cd461adddab64adf26ae6495e3493

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23401
MD5 033d09741c68b5ba8f47f9b939d83461
SHA1 21651b8eccfde75b0c436f0da361cb3013817d06
SHA256 62727571effaf74d586e966fc76a2f0030c0ef5184deac412f6b45d5432a8f37
SHA3 eac5bb3bb857637baed5111746395fe49a90034e252e04a0906cccb73c49f5ae

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0xc59
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01754
MD5 3eecffaa6da77e053e6898ae832540f2
SHA1 1afc668f2ee8241073a9046aaa0216bfa2fa38d9
SHA256 85c41bb23dbb569b6cec2ffadecc8399b799d5c606c489480877a48b3e11cfc9
SHA3 d4d3e1449af20e9c355141708dbb231adc619f5abd6287f1bb5fdcd61f19d370

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription AX
FileVersion (#2) 1.0.0.0
InternalName AX.exe
LegalCopyright Copyright © 2021
LegalTrademarks
OriginalFilename AX.exe
ProductName AX
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .themida has a size of 0!
<-- -->