Manalyze report for 861e423bac870b65beac512ff9645c81bf5849d3ab5094089d244abdedf1c994

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2024-Feb-09 08:57:36
Detected languages	English - United States

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Tries to detect virtualized environments: HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0` `Looks for VirtualPC presence: 0f 3f 07 0b` `Looks for VirtualBox presence: HARDWARE\ACPI\DSDT\VBOX__` `Contains domain names: bdcam.net http://bdcam.net oreans.com yoursite.com`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5`
Suspicious	The PE is possibly packed.	`Unusual section name found: \x00` `Section \x00 is both writable and executable.` `Unusual section name found: .idata` `Unusual section name found:` `Section is both writable and executable.` `Unusual section name found: thjekpwo` `Section thjekpwo is both writable and executable.` `Unusual section name found: eyckmfdz` `Section eyckmfdz is both writable and executable.` `The PE only has 1 import(s).`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`f865bb6bc42d01487cbf765e7f959fb9` 🔍
SHA1	`fa4db6469cde573b6a2ef4dd1a0a325f77327f3d` 🔍
SHA256	`861e423bac870b65beac512ff9645c81bf5849d3ab5094089d244abdedf1c994` 🔍
SHA3	`c807e77c41016dbd2b5e7508461d5ccc6f9aca09759bee5ac85a736f38bfdc2f` 🔍
SSDeep	`98304:9z+NPulY0FOAhoNEtqjSS5urEef4iToIwIAlPDn:5lWdSS5hw4koII` 🔍
Imports Hash	`2eabe9054cad5152567f0699947a2c5b` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`6`
TimeDateStamp	2024-Feb-09 08:57:36
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x26c00`
SizeOfInitializedData	`0x2c000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x004A2000 (Section: eyckmfdz)`
BaseOfCode	`0x1000`
BaseOfData	`0x28000`
ImageBase	`0x250000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x4a3000`
SizeOfHeaders	`0x400`
Checksum	`0x1d7b10`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

\x00

MD5	`6f3872a452165d956502afdbd25bc399 🔍`
SHA1	`a682c05f65ddd1e0538b5fc30d4f0431632c2c78 🔍`
SHA256	`f8eb19c41bc0aa9f92076ef53b1c2e10e322e9259f6f869c91b37f472eaf6407 🔍`
SHA3	`5c414a1c30a241060b7e82d8264f3e64ce841a091c332e87a77616a8232fd20b 🔍`
VirtualSize	`0x48000`
VirtualAddress	`0x1000`
SizeOfRawData	`0x48000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.11431`

.rsrc

MD5	`f0ffdef1f9389afb4fc00250cdbaee0c 🔍`
SHA1	`c5bb67e22f06be5ef9130b02473311c08a86acf4 🔍`
SHA256	`b3ad675a23101278272739e1ba5ce0f1c8c8ae2bccb869b8cb1894a45c8757f2 🔍`
SHA3	`f2a40e659cac317671419d7bcbb9c6450fb8b6e7a839ee0b7fbc088b4194bee7 🔍`
VirtualSize	`0xb6c8`
VirtualAddress	`0x49000`
SizeOfRawData	`0xb6c8`
PointerToRawData	`0x49000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.24916`

.idata

MD5	`4dba74e536bd5f4bdee07fc6af9c9868 🔍`
SHA1	`029847bb8fd3951bb92680b3aa2eff4ae106a4d1 🔍`
SHA256	`b64f155859f6d0533b0c7bf1e688049b10fac88ee82b1bfa6ae8a102e86ace57 🔍`
SHA3	`85165e86341dba37ef24102fde402d91bb5b50a2e80face6ef0b6086dd4de553 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x55000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x55000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.192486`

MD5	`31908dbdd40ca730734e1ab7c9e4c16c 🔍`
SHA1	`8614ba1ca0b21c722ad3321dec93ed4e2a4eff9a 🔍`
SHA256	`8a48edab78713fb926d480b813458c3dbb9a638f3a15bb6608ceb2dab5f11026 🔍`
SHA3	`77e6cfd887720a3ef4158ba146a9d7eee95f9a4d3c4d89509fd9ae347113b06e 🔍`
VirtualSize	`0x2a1000`
VirtualAddress	`0x56000`
SizeOfRawData	`0x2a1000`
PointerToRawData	`0x56000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.84588`

thjekpwo

MD5	`44b3161b0e2e27d5e53a86723b69bd81 🔍`
SHA1	`30cba9232028a804e0740717d2ee9202ceb4bd32 🔍`
SHA256	`d9fc9ecc29a36aaed22f3412cec8933a19189af0b6618bca68b0093c5c59844a 🔍`
SHA3	`f46e56e5d974720e39782e4482c0635e978476ac48c3a9b53d323fc7446d6ea9 🔍`
VirtualSize	`0x1ab000`
VirtualAddress	`0x2f7000`
SizeOfRawData	`0x1ab000`
PointerToRawData	`0x2f7000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.93781`

eyckmfdz

MD5	`39695b225a4d488caf61e5e3ab8f2f2c 🔍`
SHA1	`5df3841cfe4978b807a192b8c7559a5549d72112 🔍`
SHA256	`7937e54ea8e9d59994d9dfbbc2980fc33bcc15ae6e18adef7173f3dca43f698a 🔍`
SHA3	`b4e51ad05d9c312486a6d536c89db467b644fde69cc1cd44bffca5c2248d7aa3 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x4a2000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x4a2000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.14976`

Imports

kernel32.dll	`lstrcpy`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.03616`
MD5	`68d4ccb2e2e5b5a0bcd1eec02bcbd1f6 🔍`
SHA1	`d49dc15e5fa6604266504c63ee1506140a88b2b8 🔍`
SHA256	`53a9274b19ec47518acee84e68c85602de91e875f7990e02d45299992b3b2b0c 🔍`
SHA3	`fdd7f00759095c4be84da293e129f73420282a06222f2b3a85983be5156c35d1 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.32794`
MD5	`78810171a52f6c1dc0ecc11f857a01d9 🔍`
SHA1	`5237c3194b8056c116b34a3b858ab32a3386879f 🔍`
SHA256	`fa5ae7fddc752427dd8822bb819a91b1737ec45a98612db131d74da97439ffa8 🔍`
SHA3	`eecd6d95b172cd6b6791cc2103653e3e552e7fbf88bea66f789aebdabd9974f6 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.46563`
MD5	`891e549dc4e3e69955343c0381119887 🔍`
SHA1	`e11aa320c0981937ffaae2e4a1a119aa23ea4a55 🔍`
SHA256	`0669bc2849347eaa423479a3f6752e4a63159acb08b72a9d523da188df87cd4b 🔍`
SHA3	`2cc83878fbc451effaf5d1f724dc48423f1add933ddb1d0afe3f6cd84868b881 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.63078`
MD5	`5a179c4495d41ba1c4d732ddcf708ed2 🔍`
SHA1	`d8c90b07978436161b98927fd94fbd7332726f93 🔍`
SHA256	`69b9ffb6e5c3e1183d1ecb4c8727e5ce46feed12ad092d3a593cefe2488c2477 🔍`
SHA3	`839ed8d9d8fd2c251c3a3af4ce0d36ef8b497285aa475867d4c683f1e8e07890 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4a88`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.93914`
Detected Filetype	PNG graphic file
MD5	`7e1089f3192e5e6458e49b1adf00831f 🔍`
SHA1	`332accd20841dc7a9f7467fcf2ca9319cf267152 🔍`
SHA256	`2f2095bdf6f632b944062250f983a247a01814576a1746b076bf16bcef8a4fa0 🔍`
SHA3	`0ed847f4929a0b71f1287845e494aa285192dee707f16f58ddd78f6d68fa7752 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.60098`
MD5	`3ceb81d4ef810aa85c8462926c977f6f 🔍`
SHA1	`efdd87368433e9b86f18c17a312c7b3697255c31 🔍`
SHA256	`c5544e8d6f58b2e95aea77717ecdbfb7049efdbb311bc52e753ec18773caece6 🔍`
SHA3	`406580905ff49d18cefb1c155f11b0f1a23b6b8ac51155c382dde196ade4fc07 🔍`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.80743`
MD5	`20873d83f482d0749ca09f15218067c5 🔍`
SHA1	`6844d02367170a941c18a51a3c0cadd5165fd76a 🔍`
SHA256	`c700b4835ee549fb9cef96bd5afd6701df8e9cf0bec488979747651b611e3853 🔍`
SHA3	`473213924a83474d8d7345f221ca516fbee39a78b43daa1a989825b760e80d19 🔍`

8

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.00757`
MD5	`02fb286f31c215e63fde597d8d59c174 🔍`
SHA1	`21f171aea44098bb41fd634af14868f503ac6742 🔍`
SHA256	`b06c1367f8f1447a17eacc05253325fea787f2b1993997b6b0c47ca8fbdf6381 🔍`
SHA3	`0bf8ce2de7e8ee6a9e5f94b751e4dca56c2eb8d2eaa918c3babe31e55a89d338 🔍`

9

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.16172`
MD5	`3b12148b172eb8b0ec0e7ff356209875 🔍`
SHA1	`ca3d8f771db2b1f6b8b773f597f97dabab382dbe 🔍`
SHA256	`dcdbbd128df3c2cbb2a6d700196f60a2cf74d753343fc00d01876be2cc0fbc7f 🔍`
SHA3	`f05c5192c750e09631e47792bdca3c3697a1cac6776c2cf2a75d8d940a53e6f5 🔍`

1 (#2)

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x84`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.84784`
Detected Filetype	Icon file
MD5	`91ae43283421add942059ac6ecde4b20 🔍`
SHA1	`69250acb9dacd1cb0dbdfcc83266b1e52e1d3ab0 🔍`
SHA256	`c1aa9d09d7bf783cd94379adb5b81122437f203d1838fda86d2ad65681216854 🔍`
SHA3	`e1263290c2dc8f762fa98ff084337df307d1316c4e76b77330b1ef45b8c43c28 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x188`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.89623`
MD5	`b8e76ddb52d0eb41e972599ff3ca431b 🔍`
SHA1	`fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍`
SHA256	`165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍`
SHA3	`37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x297000`
EndAddressOfRawData	`0x297008`
AddressOfIndex	`0x6e6374`
AddressOfCallbacks	`0x6e637c`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

RICH Header

XOR Key	`0xb570225c`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`22`
Imports (23013)	`4`
ASM objects (23013)	`11`
C++ objects (23013)	`28`
C objects (23013)	`13`
Imports (65501)	`19`
Total imports	`268`
C++ objects (LTCG) (VS2015 build 23026)	`4`
Resource objects (VS2015 build 23026)	`1`
151	`1`
Linker (VS2015 build 23026)	`1`

Errors

Leave a comment

🪙 New Message from Coinbase. READ 💥➜ graph.org/YOU-HAVE-A-NEW-BI 5 hours ago

🪙 New Message from Coinbase. READ 💥➜ graph.org/YOU-HAVE-A-NEW-BITCOIN-TRANSFER-FROM-COINBASE-08-27?hs=96d181a2bdd3d63933205a57d92c5112& №AI8919  🪙