| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Sep-22 04:26:42 |
| TLS Callbacks | 1 callback(s) detected. |
| Suspicious | The PE is possibly packed. |
Section .data is both writable and executable.
Section .text is both writable and executable. The PE only has 6 import(s). |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 23/71 (Scanned on 2026-10-18 03:40:23) |
APEX:
Malicious
AVG: Win64:Evo-gen [Trj] AhnLab-V3: Trojan/Win.Evo-gen.R799103 Avast: Win64:Evo-gen [Trj] Avira: TR/W64.Evo Bkav: W32.Malware.9AE31B6 CrowdStrike: win/malicious_confidence_90% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win64/GenKryptik_AGen.FWV trojan Elastic: malicious (high confidence) F-Secure: Trojan.TR/W64.Evo Kaspersky: HEUR:Trojan.Win32.SelfDel.pef MaxSecure: Trojan.Malware.300983.susgen McAfeeD: ti!858C175A0EDC Microsoft: Trojan:Win32/Wacatac.C!ml Rising: Trojan.Kryptik@AI.83 (RDML:5L8ljwekBrYktlspLGGTPA) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score Webroot: W32.Trojan.Gen |
| MD5 | d454156cee8df3244abc4f945f684ad5 🔍 |
|---|---|
| SHA1 | 0b88be473c5470a3cdc0f9675ba1d222bcc8c07b 🔍 |
| SHA256 | 858c175a0edcd42d3a952cda0289318611daa23e7901cc10decb3c1aac2976ec 🔍 |
| SHA3 | 486e07ef3dd178f2714dfcecc871dab7e8363d74a59f2d062703d12a7db83021 🔍 |
| SSDeep | 768:lMNKdSvm9XPAybmbYI6OfeLyNMRUQOjv4WqiCT2o0blPKhYZX8ON4tywAj4+gbS:lGdS/AY9Ik0CUQ0v4YCao5hYWFtFAj4 🔍 |
| Imports Hash | b920d0991f4648fe46f38cb48270d268 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 2026-Sep-22 04:26:42 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xc000 |
| SizeOfInitializedData | 0x1000 |
| SizeOfUninitializedData | 0x15000 |
| AddressOfEntryPoint | 0x0000000000021380 (Section: .text) |
| BaseOfCode | 0x16000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x23000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x15000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | 6c20969450f887d819f8bf75bbb70b52 🔍 |
|---|---|
| SHA1 | ced826198dfacc29deed4d02f1b80ce6c5edb922 🔍 |
| SHA256 | afeb3077f455b7e0fa5a7fce1e24cf9908f001ec164cb0423f2288808958c595 🔍 |
| SHA3 | 80bed086216e9d97f815b7c80ba61e960ce08af14445d4425e9ccd793a6f5e43 🔍 |
| VirtualSize | 0xc000 |
| VirtualAddress | 0x16000 |
| SizeOfRawData | 0xb800 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.84989 |
| MD5 | 906c2ebad17e67d1db26e877b8c315e8 🔍 |
|---|---|
| SHA1 | 319243da9cf1c952d8d59a2a495f63b478321d24 🔍 |
| SHA256 | 115cf0b33ffcbf5d1c86b1e297971a3cd1f3e3d103a88957db4b7151e830381b 🔍 |
| SHA3 | 8bd24e807152a3b6cd616417f32ab9752cb58fb4a79b10cc128eaa4552a5d649 🔍 |
| VirtualSize | 0x1000 |
| VirtualAddress | 0x22000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xba00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.24418 |
| KERNEL32.DLL |
LoadLibraryA
ExitProcess GetProcAddress VirtualProtect |
|---|---|
| msvcrt.dll |
exit
|
| WS2_32.dll |
bind
|
| StartAddressOfRawData | 0x140021648 |
|---|---|
| EndAddressOfRawData | 0x140021650 |
| AddressOfIndex | 0x14001c08c |
| AddressOfCallbacks | 0x140021650 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x00000001400215F4
|
No comments yet.