8d9aed2ea77f3bd9912cc598f0d2956e46d6147b8b4f50cf54b021f9f9bc0aaf

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-01 17:26:01

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegCloseKey
  • RegOpenKeyExA
  • RegQueryValueExA
 Possibly launches other programs:
  • CreateProcessW
 Uses Windows's Native API:
  • NtClose
  • NtCreateFile
  • NtDeviceIoControlFile
  • NtLockFile
  • NtQueryObject
  • NtSetInformationFile
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Interacts with the certificate store:
  • CertOpenSystemStoreW
Malicious VirusTotal score: 37/63 (Scanned on 2026-09-01 23:08:07) ALYac: Generic.Dacic.11262.C6C3843C
APEX: Malicious
AhnLab-V3: Malware/Win.Dacic.R765588
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Generic.Dacic.11262.C6C3843C
Avira: TR/W64.Agent
BitDefender: Generic.Dacic.11262.C6C3843C
Bkav: W32.Malware.BE045858
CTX: exe.unknown.dacic
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DrWeb: Trojan.DownLoader49.40340
ESET-NOD32: Win64/FakeTool.C trojan
Elastic: malicious (high confidence)
Emsisoft: Generic.Dacic.11262.C6C3843C (B)
F-Secure: Trojan.TR/W64.Agent
GData: Generic.Dacic.11262.C6C3843C
Google: Detected
Gridinsoft: Trojan.Win64.Agent.oa!s1
K7AntiVirus: Riskware ( 00584baa1 )
K7GW: Riskware ( 00584baa1 )
Kaspersky: HEUR:Trojan-Downloader.Win32.Magnar.gen
Kingsoft: malware.kb.a.829
Malwarebytes: Trojan.Loader
MaxSecure: Trojan.Malware.121218.susgen
McAfeeD: ti!8D9AED2EA77F
MicroWorld-eScan: Generic.Dacic.11262.C6C3843C
Microsoft: Trojan:Win64/Convagent.RVA!MTB
Panda: Trj/GdSda.A
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.10c46679
VIPRE: Generic.Dacic.11262.C6C3843C
Varist: W64/Convagent.FI.gen!Eldorado
Webroot: Win.Trojan.Gen
Zillya: Trojan.Agent.Win64.178605
huorong: Backdoor/Agent.rv

Hashes

MD5 de55b87eaae1f3c67daede9e62913ca9 🔍
SHA1 385206887d8a28fb881b5c10e3f20462cf8f2786 🔍
SHA256 8d9aed2ea77f3bd9912cc598f0d2956e46d6147b8b4f50cf54b021f9f9bc0aaf 🔍
SHA3 2d139d5d2b21630a90f83ddc0bd0f116f48bfe68fc864aae2d40ff2e6c5183ab 🔍
SSDeep 12288:ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDnvfqItNqdg:ebOVE5ifGPRZwLvf3fd 🔍
Imports Hash 73f461c771aef77ec43d53a0c54f0c8d 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-01 17:26:01
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x75400
SizeOfInitializedData 0xa0c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x11c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4805b8ccce84685fe4530a58a8d231e3 🔍
SHA1 95a7b04c41576916d0ac0288bf8605d5c31eb579 🔍
SHA256 24ebe676b71ee6b6cb8688d2a894ca1be55bc90f9beb11e8780bbc072425d338 🔍
SHA3 799df72a55efd5db178edb71b89333a67d08d735b03ae82de5d52719e5112ae6 🔍
VirtualSize 0x75286
VirtualAddress 0x1000
SizeOfRawData 0x75400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36945

.rdata

MD5 e2411b0a87a546774a6dd278a2247bee 🔍
SHA1 43f943d0cc74c9fb8b3f34a1f9938b1b3be19e89 🔍
SHA256 beffca01e9a66a1db19cdd9732608300ab69b2cd141ab75dcbe4f7b1251abe5e 🔍
SHA3 46e2038dc277a2d50bb950834c0aee9d4982674e948adb5a01ab285edfd71a53 🔍
VirtualSize 0x9c5a0
VirtualAddress 0x77000
SizeOfRawData 0x9c600
PointerToRawData 0x75800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.08556

.data

MD5 a13d039c43daffca9acd20a4cbed5310 🔍
SHA1 f30592fddfb9b43877aaf272169fb63eab4a9d79 🔍
SHA256 abf459a36b81847fdb2450b94e80bc9663e8e17de149f9d468c0f88828ac0d9c 🔍
SHA3 7316759545f6fc8fbc1e3da0baef19275347ce0e691da1b03f46d9d0e1f54bbc 🔍
VirtualSize 0x780
VirtualAddress 0x114000
SizeOfRawData 0x800
PointerToRawData 0x111e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.75727

.pdata

MD5 d5a6d76f34c7753a6619ce8e1e8189fd 🔍
SHA1 ebc0f1a8fbb2f3743f6c4ab4cee3491695970e63 🔍
SHA256 1d56fca469f24149ff128a4797a631ade1dbf0ca8b333a246c2929868e112d6d 🔍
SHA3 155e69466cbf9a7b67d6da17abc8816bab302a6b0bfe44dfd18b1718d07070c4 🔍
VirtualSize 0x13f8
VirtualAddress 0x115000
SizeOfRawData 0x1400
PointerToRawData 0x112600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80006

.CRT

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x117000
SizeOfRawData 0x200
PointerToRawData 0x113a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 d4163cd782027139760d0eb803098005 🔍
SHA1 8be6c130911dd3328555930f4b13db76d4b65066 🔍
SHA256 bf09ac4ea974dffd64ea60096241978f8774580594a40cbba53630fcff37bddd 🔍
SHA3 d73b0ce6b63ab03d4bcff3cbda4d2efe32e258bcad61fb32f90083c96758bec1 🔍
VirtualSize 0x2219
VirtualAddress 0x118000
SizeOfRawData 0x2400
PointerToRawData 0x113c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0100799

.reloc

MD5 aa7540e1601bc82bd90cea5f4c52ed0f 🔍
SHA1 7dc9be6e43734bf77d328d68290fe1189dea4f05 🔍
SHA256 73cffbcff84c03f5b021f968764c007fbc618a048a66bd6eced70099abad3af3 🔍
SHA3 1744bacd428d679c8af597b32ce1650285852e8fd2554abc3cfbca7af0b6da78 🔍
VirtualSize 0x2bc
VirtualAddress 0x11b000
SizeOfRawData 0x400
PointerToRawData 0x116000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.11754

Imports

ntdll.dll NtClose
NtCreateFile
NtDeviceIoControlFile
NtLockFile
NtQueryObject
NtSetInformationFile
RtlEqualUnicodeString
RtlExitUserProcess
RtlGetFullPathName_U
RtlWaitOnAddress
KERNEL32.dll AcquireSRWLockExclusive
CloseHandle
CreateProcessW
ExitProcess
GetCurrentThreadId
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileAttributesW
GetLastError
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
GlobalMemoryStatusEx
MoveFileW
MultiByteToWideChar
ReadFile
ReleaseSRWLockExclusive
SetEnvironmentVariableA
SetFilePointerEx
Sleep
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteFile
ADVAPI32.dll RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SystemFunction036
CRYPT32.dll CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
WS2_32.dll WSAGetLastError
WSASocketW
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x518000
EndAddressOfRawData 0x51a218
AddressOfIndex 0x514000
AddressOfCallbacks 0x517000
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4096BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.