| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2021-Mar-30 10:30:11 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 21/67 (Scanned on 2022-02-02 00:43:08) |
MicroWorld-eScan:
Gen:Variant.Ulise.219029
FireEye: Gen:Variant.Ulise.219029 McAfee: Artemis!7C74FB64715F Cylance: Unsafe Sangfor: Riskware.Win32.Uwamson.A Symantec: ML.Attribute.HighConfidence TrendMicro-HouseCall: TROJ_GEN.R002H09GI21 BitDefender: Gen:Variant.Ulise.219029 Ad-Aware: Gen:Variant.Ulise.219029 McAfee-GW-Edition: BehavesLike.Win32.Generic.dh Emsisoft: Gen:Variant.Ulise.219029 (B) GData: Gen:Variant.Ulise.219029 MAX: malware (ai score=99) Gridinsoft: Malware.Win32.Uwamson.oa Microsoft: Program:Win32/Uwamson.A!ml Cynet: Malicious (score: 100) ALYac: Gen:Variant.Ulise.219029 APEX: Malicious Rising: Malware.Heuristic!ET#96% (RDMK:cmRtazqfFgZhfoLaR2oO33aPlv1h) MaxSecure: Trojan.Malware.138718321.susgen Fortinet: W32/PossibleThreat |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2021-Mar-30 10:30:11 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x31000 |
| SizeOfInitializedData | 0x14600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000016C0 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x32000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x49000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
UnhandledExceptionFilter
SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapValidate GetSystemInfo CompareStringW LCMapStringW GetFileType OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap HeapFree HeapReAlloc HeapSize HeapQueryInformation WriteConsoleW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx CloseHandle CreateFileW DecodePointer |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-30 10:30:11 |
| Version | 0.0 |
| SizeofData | 728 |
| AddressOfRawData | 0x41684 |
| PointerToRawData | 0x40a84 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-30 10:30:11 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| Size | 0xbc |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x443004 |
| SEHandlerTable | 0x44165c |
| SEHandlerCount | 10 |
| XOR Key | 0x4351568c |
|---|---|
| Unmarked objects | 0 |
| ASM objects (27412) | 13 |
| C++ objects (27412) | 147 |
| C objects (27412) | 18 |
| C++ objects (VS 2015/2017/2019 runtime 29804) | 37 |
| C objects (VS 2015/2017/2019 runtime 29804) | 16 |
| ASM objects (VS 2015/2017/2019 runtime 29804) | 19 |
| Imports (27412) | 3 |
| Total imports | 83 |
| 265 (VS2019 Update 9 (16.9.2-3) compiler 29913) | 2 |
| Resource objects (VS2019 Update 9 (16.9.2-3) compiler 29913) | 1 |
| Linker (VS2019 Update 9 (16.9.2-3) compiler 29913) | 1 |