| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Aug-28 21:40:59 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .mcgk
Section .mcgk is both writable and executable. The PE only has 1 import(s). |
| Malicious | VirusTotal score: 54/71 (Scanned on 2026-04-09 13:41:58) |
ALYac:
Generic.ShellCode.Marte.3.E68A050C
APEX: Malicious AVG: Win32:Meterpreter-C [Trj] AhnLab-V3: Trojan/Win.Generic.R734916 Antiy-AVL: Trojan/Win32.Meterpreter Arcabit: Generic.ShellCode.Marte.3.E68A050C Avast: Win32:Meterpreter-C [Trj] Avira: TR/Crypt.XPACK.Gen BitDefender: Generic.ShellCode.Marte.3.E68A050C Bkav: W32.AIDetectMalware CTX: exe.unknown.marte CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.Inject6.5094 ESET-NOD32: Win32/Rozena.BZ trojan Elastic: Windows.Trojan.Metasploit Emsisoft: Generic.ShellCode.Marte.3.E68A050C (B) F-Secure: Trojan.TR/Crypt.XPACK.Gen Fortinet: W32/Rozena.D!tr GData: Win32.Backdoor.Swrort.C Google: Detected Gridinsoft: Malware.Win32.Gen.bot!se23023 Ikarus: Trojan.Win32.Rozena Jiangmin: Trojan.Generic.guisj K7AntiVirus: Trojan ( 00117be11 ) K7GW: Trojan ( 00117be11 ) Kaspersky: HEUR:Trojan.Win32.Generic Malwarebytes: Trojan.MetaSploit MaxSecure: Trojan.Malware.121218.susgen McAfeeD: Real Protect-LS!6C9AF6B275B4 MicroWorld-eScan: Generic.ShellCode.Marte.3.E68A050C Microsoft: Trojan:Win32/Meterpreter.RPZ!MTB NANO-Antivirus: Virus.Win32.Gen.ccmw Rising: HackTool.Swrort!1.6477 (CLASSIC) SUPERAntiSpyware: Trojan.Agent/Gen-Crypt Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Infected.zz Sophos: Troj/Swrort-K Tencent: Trojan.Win32.Metasploit_heur.16000690 Trapmine: malicious.high.ml.score TrellixENS: Trojan-JBAQ!6C9AF6B275B4 TrendMicro-HouseCall: Trojan.Win32.VSX.PE04C9z VBA32: BScope.Trojan.Meterpreter VIPRE: Generic.ShellCode.Marte.3.E68A050C Varist: W32/Trojan.JFLT-0704 VirIT: Trojan.Win32.Rozena.AA Webroot: W32.Trojan.Agent.Gen ZoneAlarm: Troj/Swrort-K Zoner: Probably Heur.ExeHeaderL alibabacloud: Backdoor:Win/shellcode.api(dyn) huorong: HVM:Trojan/Swrort.gen!A |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xc8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2025-Aug-28 21:40:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 1.0 |
| SizeOfCode | 0x2000 |
| SizeOfInitializedData | 0x3000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00005000 (Section: .mcgk) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x51c8 |
| SizeOfHeaders | 0x288 |
| Checksum | 0x7cfd |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
VirtualProtect
|
|---|
| XOR Key | 0x946b65dd |
|---|---|
| Unmarked objects | 0 |
| Imports (33140) | 3 |
| Total imports | 1 |
| C objects (35207) | 1 |
| Linker (35207) | 1 |
No comments yet.