| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-Sep-14 01:01:11 |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses constants related to AES Uses constants related to Blowfish |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. |
Resource 27 is possibly compressed or encrypted.
Resources amount for 98.3831% of the executable. |
| Malicious | VirusTotal score: 37/72 (Scanned on 2024-11-30 04:05:42) |
ALYac:
Gen:Variant.Lazy.591825
APEX: Malicious Arcabit: Trojan.Lazy.D907D1 BitDefender: Gen:Variant.Lazy.591825 Bkav: W64.AIDetectMalware CTX: exe.trojan.lazy CrowdStrike: win/malicious_confidence_90% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Lazy.591825 (B) FireEye: Gen:Variant.Lazy.591825 Fortinet: W32/PossibleThreat GData: Gen:Variant.Lazy.591825 Google: Detected Gridinsoft: Malware.Win64.AI.oa!s1 Ikarus: Trojan.Agent Jiangmin: Trojan.Agent.fcbv Lionic: Trojan.Win32.Generic.4!c Malwarebytes: Malware.AI.4290864718 MaxSecure: Trojan.Malware.300983.susgen McAfee: Artemis!7E1922250C57 McAfeeD: ti!60CFEC1DC54F MicroWorld-eScan: Gen:Variant.Lazy.591825 Microsoft: Program:Win32/Wacapew.C!ml Paloalto: generic.ml Panda: Trj/Chgt.AD Sangfor: Trojan.Win32.Lazy.Vc6m SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Generic.wc Symantec: ML.Attribute.HighConfidence TrendMicro-HouseCall: TROJ_GEN.R002H09IE24 VIPRE: Gen:Variant.Lazy.591825 Varist: W64/ABRisk.JACS-8040 Webroot: W32.Malware.gen Zillya: Trojan.Agent.Win64.61040 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2024-Sep-14 01:01:11 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x20000 |
| SizeOfInitializedData | 0xb68a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000000C8BC (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xbb0000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| SHELL32.dll |
SHFileOperationW
SHGetFolderPathW CommandLineToArgvW |
|---|---|
| KERNEL32.dll |
SetLastError
WriteConsoleW HeapReAlloc CreateDirectoryW SizeofResource SetConsoleCtrlHandler GetCommandLineW GetStdHandle WriteFile TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW Sleep GetLastError LockResource CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc MultiByteToWideChar HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Sep-14 01:01:11 |
| Version | 0.0 |
| SizeofData | 780 |
| AddressOfRawData | 0x2b368 |
| PointerToRawData | 0x2a768 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14002e000 |
| XOR Key | 0xf1aaa5f1 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (30795) | 6 |
| C++ objects (30795) | 142 |
| C objects (30795) | 10 |
| 253 (33731) | 2 |
| ASM objects (33731) | 9 |
| C objects (33731) | 16 |
| C++ objects (33731) | 40 |
| Imports (30795) | 5 |
| Total imports | 114 |
| C objects (LTCG) (33813) | 1 |
| Linker (33813) | 1 |