8939dff210ebeb96d99d7741850a43d855d197ecb6914ac4ac02f41736a29841

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Jun-22 20:00:11

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Can access the registry:
  • RegCreateKeyExW
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegSetValueExA
  • RegSetValueExW
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessW
Malicious VirusTotal score: 12/70 (Scanned on 2026-08-09 03:45:07) APEX: Malicious
Antiy-AVL: Trojan/Win32.Agent
CrowdStrike: win/grayware_confidence_60% (D)
Gridinsoft: Trojan.Win32.Agent.oa!s1
K7AntiVirus: Riskware ( 0040eff71 )
K7GW: Riskware ( 0040eff71 )
McAfeeD: ti!8939DFF210EB
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!14679C3C5B44
VBA32: Trojan.Yomal
Webroot: W32.Malware.Gen

Hashes

MD5 14679c3c5b44bac4cb71fa120694eb3f 🔍
SHA1 31451b527ec81312bc4c90af1c88172e3f535dda 🔍
SHA256 8939dff210ebeb96d99d7741850a43d855d197ecb6914ac4ac02f41736a29841 🔍
SHA3 b6293de6dcd6b75d02df66bda0495818a48c7e05f950264d0a0aa51f24c645f2 🔍
SSDeep 6144:gh2Uly/Tg7dSxHLZExMSpqdJ5L2rnBWonKQfEZ:ghRM/2uLZExMgqorBznKS 🔍
Imports Hash 5a6e533a847e4a6c14333c31892a86eb 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2021-Jun-22 20:00:11
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0xfe00
SizeOfInitializedData 0x32a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001A93 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x11000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x46000
SizeOfHeaders 0x400
Checksum 0x46655
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e8701eb309fa22a0de62fc46cb3f9e7c 🔍
SHA1 8e20ee60516c22e19d96590368d51eb36eab1b40 🔍
SHA256 f7aa34bfe1b575f7a15df5c86995189e4fbdc50d7b7fb3d0dea082425f6e3e87 🔍
SHA3 e2ddc2bf9562a14b2c820c7a80650c727c04765f74aa86c24255ea31a189221e 🔍
VirtualSize 0xfc3b
VirtualAddress 0x1000
SizeOfRawData 0xfe00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.63187

.rdata

MD5 e16a4d3435c6bd07bd04b5b5e31b850c 🔍
SHA1 367fa1e9f82da28738dc1b6137905aef49c08901 🔍
SHA256 da4704d40d360ea6b01a528e395ef5a90dfc9fef3a1f5dbf2d7adbe257be4761 🔍
SHA3 8c8578265cbdbd01a7cb861a12f6aff827dc030ee38d690ba9486b3c74e0fd6b 🔍
VirtualSize 0x6a22
VirtualAddress 0x11000
SizeOfRawData 0x6c00
PointerToRawData 0x10200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.20106

.data

MD5 00dec8f6afe6c8e35c6ea809822f2a95 🔍
SHA1 188273660ad6fec554004fedeafc468b0c05dde2 🔍
SHA256 6fa29402c956953cbe32b9f64d4d1b9249e22ffbd0215390c79e9a244eaf0141 🔍
SHA3 6d8e78ea0ab2b04309d49158987c26b706da75be9f4d7cd9a46008433d18c18d 🔍
VirtualSize 0x13c8
VirtualAddress 0x18000
SizeOfRawData 0xa00
PointerToRawData 0x16e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.82343

.gfids

MD5 8695c3183ee740e2ced5cf29ce0d0dd9 🔍
SHA1 bf6b805ac138f76df62790f66041288522f04bab 🔍
SHA256 180755d9c5daf5446b67af5efef738c8c148896cb5cc7c5226deab6b4cc82ab8 🔍
SHA3 eff6f8d237b4e594ba25682b26d14ebfaa426ea076dc8c14c1c2423f601e8dc8 🔍
VirtualSize 0xb0
VirtualAddress 0x1a000
SizeOfRawData 0x200
PointerToRawData 0x17800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.909243

.reloc

MD5 030fdc397f0090b95b5b697d70eb4285 🔍
SHA1 77816f75ffc3d4bafc6a79efaa4806fbece96024 🔍
SHA256 46fb388efa1280bf5e34f58be8ca4f7d75afd1b4d1292a1972752c218a0b1d29 🔍
SHA3 9b93ed24fe40efa4d81f894c3400f01d85f167bd52ba4a787dba5b7c423a7e16 🔍
VirtualSize 0xedc
VirtualAddress 0x1b000
SizeOfRawData 0x1000
PointerToRawData 0x17a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.29252

.rsrc

MD5 1435d0cf6f9f7be2e5dd89f273c888d4 🔍
SHA1 4112cc75453d73f7ffd927860ae9681611a3b01f 🔍
SHA256 3fb6ef3ac81b1c0fc470ba434a8ea9d06c23cf248465725ba6409e5c761ad910 🔍
SHA3 7b3a5b1c68a0bbf25b63ff2f3bd8369fbbc1169d94850d38cfa606edf075fe98 🔍
VirtualSize 0x2964a
VirtualAddress 0x1c000
SizeOfRawData 0x29800
PointerToRawData 0x18a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.51356

Imports

ADVAPI32.dll RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegCloseKey
USER32.dll MessageBoxA
KERNEL32.dll WriteConsoleW
CreateFileW
SetEnvironmentVariableW
GetFileAttributesW
GetFullPathNameW
CloseHandle
WaitForSingleObject
GetCurrentProcessId
TerminateProcess
ResumeThread
CreateProcessW
GetModuleFileNameW
GetModuleHandleW
lstrcpyW
lstrlenA
lstrlenW
GetPrivateProfileStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
LCMapStringW
GetProcessHeap
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DecodePointer
RaiseException

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.88923
MD5 ab42f2048adc604cb7b912bf75b578af 🔍
SHA1 85e78423726b0a32e2776e38a2f6b2503c98dee6 🔍
SHA256 f7ee5117b7646711e8b04a14def4d72a1f3a2fa3ccd440d1d46befe3a95c3905 🔍
SHA3 750646e22b343ae1ba49b2f21e54abcc9dc5f8b420081be2fe12b260e63c55a7 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.069
MD5 6a34485f6ac1fdec2f5d6c2e71798de4 🔍
SHA1 430cb9b4d4a7477a1bc418f84f8c7259482442bd 🔍
SHA256 9279a0c7ff61c638e6a9f1b0e2d4dc3b247b6dafd3c0a43304f5d698d1d69cdb 🔍
SHA3 19196e1376d8a837578e64230d97593f91fdd540105c95fb03db0de2613b361c 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37009
MD5 e5fc65bda74a013b679eb92d5bb5bed3 🔍
SHA1 774b45407813c1551e506d8d982c5a83486d70ad 🔍
SHA256 099c0c3f751deb6faf41ceca4b80748c277a64b1fda4f7f627f999fc99f82ef4 🔍
SHA3 d3b9aabeee2e4cf550f4fcdf2810faa3913da283031c7527fd4ba8e7978a1b9f 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xd394
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98854
Detected Filetype PNG graphic file
MD5 a4fa10fc13f3a99be4776d4fc258e10c 🔍
SHA1 f34466feaa47fe336796b4912f1680540f836e9b 🔍
SHA256 b5d29b954c529bde16b4a0c0c2a8a5ce5601bbb27ca7c75469a2151f977d4363 🔍
SHA3 2e9b16d0df28476a6aae6fae5d2cd64c614681544d64730a63891b892c6e3738 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31631
MD5 7b8995c814b9e9c2b9287e835ff7a0b5 🔍
SHA1 3f8d93ae0d80ca25bc1b95f150c72ae89964b060 🔍
SHA256 459426160fd4790ce57eff785193a0b59d4970e5b5790f024529ee642db5dbf5 🔍
SHA3 6d094febede73ca10f98fb020414add4d9ec5641d4fa18f5a7091bed89944e89 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.83305
MD5 c8e001013223d65272d1c6edea4c1929 🔍
SHA1 a3268bb37cee1fc50066553b3800bee89295d6ac 🔍
SHA256 84f5d7040ed8903fa39e292a6d2463bd2e98a63194fafc4fc1e89e670f0fb9d7 🔍
SHA3 37b7ab7a398f57a6c65ca2a31ebc0dd31f183a357eaec93082f644701d3d0e26 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.00491
MD5 5529e8aa6196410493c00f0d53a26dd7 🔍
SHA1 5665e803a823bb63da74e99b354eb43029da9b3a 🔍
SHA256 dfb91c6a83cde8042487e4e6836af1ba8842a302aad07a2b5bfb65fa2242c465 🔍
SHA3 d6edde722ae26582626102ea77cfdcd55b2d0dccbbf654a567b0c939c5f8672c 🔍

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x11b45
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99122
Detected Filetype PNG graphic file
MD5 44fa6c3eeab28b9322a018e7a6e61a32 🔍
SHA1 649808999bfabc4236622144bfd38980240c508b 🔍
SHA256 0feeffb8e3fd8422790dcf92a9fa077c40b2eb489db2b8c046622d09aa4108ce 🔍
SHA3 425ef4848ab0d326cf068b12017692d240853f7620aedbbc545d5f88185655c1 🔍

9

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.70432
MD5 4260a3c79926662eee5d10c0556ea9e5 🔍
SHA1 c177304af3468aaf71b4082a32bb361b4a1c2803 🔍
SHA256 fbdec9d885092a94723d592c8602adc905ae1ee36f5aac88b41b24040c7ffce8 🔍
SHA3 d4eaeb40700e1831768064feed952f8b7ab8467d88bd99b71d827ef09fa99161 🔍

10

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.95554
MD5 23e0f93a22ab15cb2011b64eb40447ea 🔍
SHA1 818f9bd5bbff08f98d5789830c2506dd0344521a 🔍
SHA256 7ba72dc3601fd6b6f92e080e3662e645c55b87e6d236211451f25162f73a2027 🔍
SHA3 2bbfd503f59340b137ad3235a749a0a14f720851a5320bf668b050a5b281644c 🔍

11

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.0547
MD5 f2ee0cdd53e67b72c8ca79e755211606 🔍
SHA1 f6f4d895c97d55b23f849fd949b9e01bab749098 🔍
SHA256 4b08b9fa59171bed092940560dbccfcdc0017f0b5fcbf557de5178c940044b51 🔍
SHA3 ca91767844d63ac973c4b51b56ed138ca92f9416bf1fc0e44b81759d5833c9cf 🔍

12

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25405
MD5 885f8c44eb693db2ca8397b83d9d77e8 🔍
SHA1 6460a7923f9ac846f230d3625ea518644e5a8556 🔍
SHA256 184b43251f3292e6186ee66abc40f45beccfe2065a695dd5d581aa0d9dcd6672 🔍
SHA3 a3b0cd270ec21aad0a85bffd25a2b46f99b9cd0698ad6f028f53c9808dc087a5 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01141
Detected Filetype Icon file
MD5 edb157309af56d48e065efbb71bf737c 🔍
SHA1 53aa740b1250919418501acf1c9fad6f82ac0877 🔍
SHA256 151344270e2280eed888a3e9f7e887392a3801066a8403a36719e81875857348 🔍
SHA3 74cfc4ecdc716fbd6629e3f629d03b7a966c69d8d086a78a26399d29c758d71c 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Jun-22 20:00:11
Version 0.0
SizeofData 636
AddressOfRawData 0x16c7c
PointerToRawData 0x15e7c

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x418004
SEHandlerTable 0x416c70
SEHandlerCount 3

RICH Header

XOR Key 0x7f34f26c
Unmarked objects 0
ASM objects (26213) 9
C++ objects (26213) 138
C objects (26213) 18
ASM objects (24237) 16
C++ objects (24237) 29
C objects (24237) 17
Imports (26213) 7
Total imports 96
C++ objects (24245) 1
Linker (24245) 1

Errors

Leave a comment

No comments yet.