7f0054674d21b0bd03bc1f6874e4a18437ba12bf664af0e0c20db67790c1c207

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-17 20:39:02
Detected languages English - United States

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %TEMP%
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • cmd.exe
  • virus
 Contains domain names:
  • crl.microsoft.com
  • github.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
  • http://www.microsoft.com
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
  • http://www.microsoft.com/pkiops/Docs/Repository.htm0
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crt0
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crl0
  • http://www.styleseven.comFreeware
  • http://www.styleseven.comSmallest
  • http://www.zkysky.com.ar
  • http://www.zkysky.com.ar/Julieta
  • https://fontawesome.comCopyright
  • https://github.com
  • https://openfontlicense.orgThis
  • https://openfontlicense.orghttp
  • https://www.microsoft.com
  • https://www.microsoft.com/en-us/windows
  • microsoft.com
  • www.microsoft.com
  • www.zkysky.com
  • zkysky.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Uses functions commonly found in keyloggers:
  • GetForegroundWindow
  • GetAsyncKeyState
 Functions related to the privilege level:
  • CheckTokenMembership
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious The PE is possibly a dropper. Resource 102 detected as a PE Executable.
Resource 103 detected as a PE Executable.
Malicious VirusTotal score: 21/71 (Scanned on 2026-10-17 20:51:48) ALYac: Gen:Variant.Adware.Yogi.1196
APEX: Malicious
AVG: Win64:Malware-gen
Antiy-AVL: RiskWare/Win64.Application
Arcabit: Trojan.Adware.Yogi.D4AC
Avast: Win64:Malware-gen
BitDefender: Gen:Variant.Adware.Yogi.1196
Bkav: W32.Malware.BC6B71C3
CTX: exe.adware.yogi
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
Cynet: Malicious (score: 100)
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Adware.Yogi.1196 (B)
GData: Gen:Variant.Adware.Yogi.1196
Kaspersky: VHO:Trojan-Downloader.Win64.LuckyWare.gen
McAfeeD: ti!7F0054674D21
MicroWorld-eScan: Gen:Variant.Adware.Yogi.1196
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
VIPRE: Gen:Variant.Adware.Yogi.1196

Hashes

MD5 53da3b7b62a2b0abfd16d2a4e77ee47b 🔍
SHA1 808a20a0c7bbe4e9fd8855462399eec306f1bb23 🔍
SHA256 7f0054674d21b0bd03bc1f6874e4a18437ba12bf664af0e0c20db67790c1c207 🔍
SHA3 7a796b74ced870a985e5ca319973836a7dad306c674b52967b32c353eabbf5a9 🔍
SSDeep 49152:D9hdp6W7CnjYl19DYl1hFqhrH72IjXNwNpHYa2F:jd9wFqhrqIzNi6F 🔍
Imports Hash 306bb19c3ed4e4bfbf3afcbaf62a8f02 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Oct-17 20:39:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x70600
SizeOfInitializedData 0x361200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000004D9F8 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3d6000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0a9d5a89df5e1dcce84c5a61259e8bcf 🔍
SHA1 1da37aa960c44f4364b6fd46ad151128835587f8 🔍
SHA256 d5a82f6ee879c92fa1b55a29a0b62232caedac93ad9a058650d792ee645c8191 🔍
SHA3 2bbcbde44add591868bdd8a27a28b80b24f264a360047a4bc9f1ee1801b35de8 🔍
VirtualSize 0x70570
VirtualAddress 0x1000
SizeOfRawData 0x70600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.55668

.rdata

MD5 1ffa003a4694712295d155fdc61acf36 🔍
SHA1 9670d62ad2a52633f11b6e77e2644bda86431e26 🔍
SHA256 06e59ba2db7ae8abec5b11ff5cf1e8cdc01c007b041f7f0413bc1f05f897d0e9 🔍
SHA3 dad160d9b7fac002150f7aa025c84fc2a31e363a338d2d302af2113c7d0dcc31 🔍
VirtualSize 0x44d3a
VirtualAddress 0x72000
SizeOfRawData 0x44e00
PointerToRawData 0x70a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.43988

.data

MD5 6616fc2cdcddb5b7745f2f50a8295c9b 🔍
SHA1 1582c969cb0aebef7450f72689ba38740c0f72d9 🔍
SHA256 c0d18e17691f5ea464e6f0e2eccc19ee08c99ccd516fa88c35310dfb704fdc30 🔍
SHA3 e4f0c79cd438b08e7a44f957ab07f70ab698d5a94f70b863be597907885875fc 🔍
VirtualSize 0x19a4d4
VirtualAddress 0xb7000
SizeOfRawData 0x195800
PointerToRawData 0xb5800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.14567

.pdata

MD5 85ffeee26d548e4af81b98915d875d50 🔍
SHA1 f4e117d1e44e0e39824a62a95f20d2be38aa1e6c 🔍
SHA256 6ef4f533fa42794829538f366baaacb558d34709a7a218b26054ecb32cba1964 🔍
SHA3 9e43cf85843fde58127f70ddc1c6600de4b9a31fcace44781588721d68c6ba3d 🔍
VirtualSize 0x58e0
VirtualAddress 0x252000
SizeOfRawData 0x5a00
PointerToRawData 0x24b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.88391

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x258000
SizeOfRawData 0x200
PointerToRawData 0x250a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 da70a9f630e2cab0f3a2246e8c9f4174 🔍
SHA1 f60b03eb2d91075e517aa8682f73f2037d833dff 🔍
SHA256 74e856f01e7d09510dd478da7c4d92df661252dd4d769d276cb5183a0f39fda5 🔍
SHA3 6b2bf198da2a32a19bf0e8960f0e5344c5cbf7ab65ad8eba7218f2059d38e36b 🔍
VirtualSize 0x17b698
VirtualAddress 0x259000
SizeOfRawData 0x17b800
PointerToRawData 0x250c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.22316

.reloc

MD5 69c6b62cfc58bdb2eaf3c0ec21a2e367 🔍
SHA1 521a223f7caea97cb018aa8fade8089492f45128 🔍
SHA256 2d3eba855a441942f7417de2d96ab9f2b24f0222afee7db6e3d5598d04931820 🔍
SHA3 dec5f87e40b575cc6e3289dc5b46b5a96fb40fd66748d6a8c88231cdf71ba345 🔍
VirtualSize 0x98c
VirtualAddress 0x3d5000
SizeOfRawData 0xa00
PointerToRawData 0x3cc400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.35306

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
dwmapi.dll DwmSetWindowAttribute
KERNEL32.dll GetTempPathW
CloseHandle
WaitForSingleObject
CreateProcessW
LoadResource
LockResource
SizeofResource
FindResourceW
GetModuleHandleW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocaleInfoA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
GetConsoleOutputCP
WriteFile
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetFileType
HeapReAlloc
LCMapStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetStdHandle
ExitProcess
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RemoveDirectoryW
DeleteFileW
CreateFileW
CreateDirectoryW
GetModuleFileNameW
GetProcessHeap
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetLastError
HeapSize
SetEndOfFile
WriteConsoleW
FlushFileBuffers
FindNextFileW
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
FindClose
FindFirstFileExW
RtlUnwind
GetLastError
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
USER32.dll LoadCursorW
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetForegroundWindow
IsWindowUnicode
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
SetProcessDpiAwarenessContext
LoadImageW
ScreenToClient
GetClientRect
UpdateWindow
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
ReleaseCapture
ShowWindow
PostMessageW
SendMessageW
MessageBoxW
ADVAPI32.dll FreeSid
AllocateAndInitializeSid
CheckTokenMembership
SHELL32.dll ShellExecuteExW
ShellExecuteW
IMM32.dll ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

Delayed Imports

101

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x147
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.96698
MD5 a86d0ada00007cd360593f0e88a606de 🔍
SHA1 deddd8d6def40a56edbcc81f6cb635759bdd4fb6 🔍
SHA256 e081243513c260336026705231741a41ad99cc2f2c5ff00baeafff70d7330264 🔍
SHA3 8dbade3b9eb1bf707e6e6e7fad66355fc235cf0bfb2d0b13676ea961e928a97d 🔍

102

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x3cc8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.45319
Detected Filetype PE Executable
MD5 83a611a03e2c021bf989918687c2c667 🔍
SHA1 a0fb5ad4fd89669a68a6ef12faec98f05b9923cc 🔍
SHA256 c3330971fd51c40d32c388031d065279903727f7327f7e299490ad067bbbfa13 🔍
SHA3 8137386b05fcbe0e0e8a0d9d1c119a5ad2a396b441691c02ce87d58bb679eef9 🔍

103

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x177600
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.22426
Detected Filetype PE Executable
MD5 651ea4cacdfdb8ae7400aa49e72a270a 🔍
SHA1 8cc6a8439ca269d71fee7452cc23186317460684 🔍
SHA256 8d35b0ef009a660c02a6605ad7463733a9e911dc0c8d6d379029f88b49668206 🔍
SHA3 376da923c83152e8e1f679974eb39bd6bdc2aad314784ca8802bad3f4fad33b7 🔍

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-17 20:39:02
Version 0.0
SizeofData 1052
AddressOfRawData 0xadce0
PointerToRawData 0xac6e0

TLS Callbacks

StartAddressOfRawData 0x1400ae158
EndAddressOfRawData 0x1400ae184
AddressOfIndex 0x140250370
AddressOfCallbacks 0x1400725f8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14024b8c0

RICH Header

XOR Key 0x2d9b5bee
Unmarked objects 0
C++ objects (33145) 179
C objects (33145) 43
ASM objects (33145) 26
ASM objects (35207) 10
C objects (35207) 16
C++ objects (35207) 93
Imports (33145) 19
Total imports 231
C++ objects (35228) 35
Resource objects (35228) 1
151 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.