7c00e4f028f2f44a440ffa02e32b250b
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2063-Dec-08 19:12:01 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
Deep.pdb
|
| Comments | |
| CompanyName | |
| FileDescription | |
| FileVersion | 1.0.1 |
| InternalName | Deep.exe |
| LegalCopyright | Copyright © BuPyC12 2022 |
| LegalTrademarks | |
| OriginalFilename | Deep.exe |
| ProductName | |
| ProductVersion | 1.0.1 |
| Assembly Version | 1.0.0.1 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses known Mersenne Twister constants |
| Suspicious | The PE is possibly packed. |
Unusual section name found: * ~K5 \x1e\x05
Section * ~K5 \x1e\x05 is both writable and executable. Unusual section name found: .ldata Section .ldata is both writable and executable. Section .textbss is both writable and executable. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 26/72 (Scanned on 2025-01-17 22:15:38) |
ALYac:
Gen:Variant.Ulise.527307
APEX: Malicious Antiy-AVL: GrayWare/Win32.Wacapew Arcabit: Trojan.Ulise.D80BCB BitDefender: Gen:Variant.Ulise.527307 Bkav: W64.AIDetectMalware CTX: exe.unknown.ulise ClamAV: Win.Malware.Lazy-10040068-0 CrowdStrike: win/malicious_confidence_70% (D) Cylance: Unsafe Cynet: Malicious (score: 100) Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Ulise.527307 (B) FireEye: Generic.mg.7c00e4f028f2f44a GData: Gen:Variant.Ulise.527307 Gridinsoft: Trojan.Heur!.03012203 Malwarebytes: Generic.Malware.AI.DDS McAfeeD: Real Protect-LS!7C00E4F028F2 MicroWorld-eScan: Gen:Variant.Ulise.527307 NANO-Antivirus: Virus.Win64.Virut-Gen.bwpxnc SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Generic.wc Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score VIPRE: Gen:Variant.Ulise.527307 Zoner: Probably Heur.ExeHeaderL |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2063-Dec-08 19:12:01 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x141600 |
| SizeOfInitializedData | 0x50000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000019BB70 (Section: .textbss) |
| BaseOfCode | 0x28000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x24e000 |
| SizeOfHeaders | 0x2000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x8000 |
| SizeofHeapReserve | 0x200000 |
| SizeofHeapCommit | 0x4000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
* ~K5 \x1e\x05
.text
.rsrc
.ldata
.textbss
Imports
| kernel32.dll |
GetStdHandle
GetConsoleMode TlsGetValue GetLastError SetLastError RaiseException GetTickCount ExitProcess GetStartupInfoA GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetCurrentProcess ReadProcessMemory GetModuleFileNameA GetModuleHandleA WriteFile ReadFile CloseHandle SetFilePointer GetFileSize SetEndOfFile GetSystemInfo LoadLibraryW LoadLibraryA GetProcAddress FreeLibrary FormatMessageW DeleteFileW CreateFileW GetFileAttributesW CreateDirectoryW RemoveDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetEnvironmentVariableW GetConsoleOutputCP GetOEMCP GetProcessHeap HeapAlloc HeapFree TlsAlloc TlsFree TlsSetValue CreateThread ExitThread LocalAlloc LocalFree Sleep SuspendThread ResumeThread TerminateThread WaitForSingleObject SetThreadPriority GetThreadPriority GetCurrentThread OpenThread IsDebuggerPresent CreateEventA ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection MultiByteToWideChar WideCharToMultiByte GetACP GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx EnumResourceTypesA EnumResourceNamesA EnumResourceLanguagesA FindResourceA FindResourceExA LoadResource SizeofResource LockResource FreeResource GetVersion FlushInstructionCache VirtualAlloc VirtualFree VirtualProtect VirtualAllocEx VirtualProtectEx CreateRemoteThread PostQueuedCompletionStatus SetErrorMode WriteProcessMemory GetThreadContext SetThreadContext FlushFileBuffers DeviceIoControl FindClose GetLocalTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToDosDateTime GetLogicalDriveStringsW GetModuleFileNameW GetSystemDirectoryW GetTempPathW GetTempFileNameW GetWindowsDirectoryA GetWindowsDirectoryW QueryDosDeviceW SetFileAttributesW FindFirstFileExW FindNextFileW IsBadReadPtr IsBadWritePtr GetVersionExA CreateActCtxW ActivateActCtx CompareStringA GetLocaleInfoA GetDateFormatA EnumCalendarInfoA CompareStringW GetLocaleInfoW GetDateFormatW GetCPInfo GetThreadLocale SetThreadLocale GetUserDefaultLCID |
|---|---|
| oleaut32.dll |
SysAllocStringLen
SysFreeString SysReAllocStringLen SafeArrayCreate SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement SafeArrayPutElement SafeArrayPtrOfIndex VariantChangeTypeEx VariantClear VariantCopy VariantInit |
| user32.dll |
MessageBoxA
CharUpperBuffW CharLowerBuffW CharUpperA CharUpperBuffA CharLowerA CharLowerBuffA GetSystemMetrics MessageBeep |
| advapi32.dll |
RegOpenKeyA
|
| ole32.dll |
CoUninitialize
CoInitialize |
| ntdll.dll |
ZwProtectVirtualMemory
RtlFormatCurrentUserKeyPath RtlDosPathNameToNtPathName_U RtlFreeUnicodeString RtlInitUnicodeString |
| shlwapi.dll |
PathMatchSpecW
|
Delayed Imports
1
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.1.0 |
| ProductVersion | 1.0.1.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | |
| FileDescription | |
| FileVersion (#2) | 1.0.1 |
| InternalName | Deep.exe |
| LegalCopyright | Copyright © BuPyC12 2022 |
| LegalTrademarks | |
| OriginalFilename | Deep.exe |
| ProductName | |
| ProductVersion (#2) | 1.0.1 |
| Assembly Version | 1.0.0.1 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Jan-04 03:39:53 |
| Version | 0.0 |
| SizeofData | 33 |
| AddressOfRawData | 0x2a0f0 |
| PointerToRawData | 0x27ef0 |
| Referenced File | Deep.pdb |
TLS Callbacks
| StartAddressOfRawData | 0x596028 |
|---|---|
| EndAddressOfRawData | 0x596050 |
| AddressOfIndex | 0x596050 |
| AddressOfCallbacks | 0x596058 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000000599A70
|