8e0ec194eb796c9caffc819176c34c57

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2020-Aug-16 23:22:50

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • #14
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 19154748 bytes of data starting at offset 0x43400.
The overlay data has an entropy of 7.99749 and is possibly compressed or encrypted.
Overlay data amounts for 98.5823% of the executable.
Suspicious VirusTotal score: 1/68 (Scanned on 2020-09-16 04:49:38) APEX: Malicious

Hashes

MD5 8e0ec194eb796c9caffc819176c34c57
SHA1 d45d79588d641558aaed514a8cf3a0b702bbfdbc
SHA256 6d4358905bd29bb53478e01901cc95bce089662340e13a009c462105a51ed525
SHA3 8ebfafe0c3988c837a2b87d182cea10f9599db9c1257ee754ac3f58ad5d16f2b
SSDeep 393216:tAPUByW93xKXGzHFD1vlh2p47X9UHC1A3CL9QYSgHVEZcaB:tIUByW93M2zHF7Qp47Nn1PLqY3La
Imports Hash 7154ec8457f93b40d1d01ea72ffdd0e0

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2020-Aug-16 23:22:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21600
SizeOfInitializedData 0x2c000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000835C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x51000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dc908680f3caadde96fc9e1942d0e3ef
SHA1 0a8b1ea57448d23b279c1e7867cbd7a39a3e491b
SHA256 e19d0ee5ecd93b9c7a7123843d18772d46c36f8db49a6f54e95f54ecb44bf2e1
SHA3 506413dda9e6374dd391abbe9bfcefd9a62573ef6563f5d81fbf1e4558505f56
VirtualSize 0x214c0
VirtualAddress 0x1000
SizeOfRawData 0x21600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47278

.rdata

MD5 8800fc100d8a5efd46b01f5d37ba89b7
SHA1 c41a477e1edacbc53c9bee80852032f6fc7a2508
SHA256 e017be36f20dc0bd7f3781452babeca590d7274e1af00410a987b8000857e770
SHA3 61548bf4b2ab689400e9bddb07c428e99fbc9f2dab75c9260a45935158545e2e
VirtualSize 0xf70a
VirtualAddress 0x23000
SizeOfRawData 0xf800
PointerToRawData 0x21a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.83056

.data

MD5 abf1798dc873e7cfbb8a929f0609e662
SHA1 3f8e5f6e60a996c3da1acb65b98d3e9303316b99
SHA256 610e280d3b1b8622729bfaf0bb04323a2cb988bfb4fdecc6a89c0089c046de3c
SHA3 a0ee268e51941ca065a625bc3e143a29f70f4e5140c3d06a1de9c38922a26f8d
VirtualSize 0xb0e8
VirtualAddress 0x33000
SizeOfRawData 0xc00
PointerToRawData 0x31200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.82738

.pdata

MD5 ee6d99ef597658da15d6e598f7358889
SHA1 d242ad6ab83ff464322506a2554e88f14aaeb54f
SHA256 c58f9da7a44d7c64f2f619fcf27dcb00bff07e5eb83aca5cdc1494e0e0d2e26b
SHA3 243aa185549ad60c579855ae59241d9b8a83c5f1e36eb88f26324cfe2d82327f
VirtualSize 0x1c50
VirtualAddress 0x3f000
SizeOfRawData 0x1e00
PointerToRawData 0x31e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.10805

.rsrc

MD5 1d6570dd962b223eab2e6f22b8444680
SHA1 f761f509375871d4a8133f0aea0c35afb1d91282
SHA256 6a4eeba72f6f6c39a69db10e00bf7f0faab68549091d7be2dc2e2fd975aa039d
SHA3 1d50ad94ad63f7b1bc92194d1de69384bc9fa06ab7cb7b3d90f0f6d8066b18d1
VirtualSize 0xeec8
VirtualAddress 0x41000
SizeOfRawData 0xf000
PointerToRawData 0x33c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.517

.reloc

MD5 7cd05cbd64aea99952b44b741526ee2a
SHA1 db248fb7efff3f99792872959151b67819d74143
SHA256 739ec0735be3b2bba08aa6574471d0bb53d5dfce6d5b59eea18c2e23338b6a77
SHA3 7bb0ae07fa7ae51958a0ad7865f9afbcf17aa00b7f089e92f8b1fe0b6f28df2e
VirtualSize 0x69c
VirtualAddress 0x50000
SizeOfRawData 0x800
PointerToRawData 0x42c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.99034

Imports

USER32.dll MessageBoxW
MessageBoxA
KERNEL32.dll WriteConsoleW
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
SetEndOfFile
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
LoadLibraryA
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WaitForSingleObject
RaiseException
HeapSize
GetTimeZoneInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
GetFileSizeEx
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
ADVAPI32.dll ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll #14

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15653
MD5 15d6a8563184abef13a1ee75aea262ad
SHA1 d7d896432efd845f283f2b98a66486df05bf5e10
SHA256 7cccfafd00332ac9c9f6ac0112cc0653991eb169943919e55d05f3fa15929821
SHA3 93904dad7224f31021bf8d53753e553f8233c2f40f6dbe25e67b692c6ae378ab

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.44895
MD5 1c06420cfb94514d35c088699a04774d
SHA1 2c23d7df4bc8ce3fb15f33e78c042b12814aea3b
SHA256 d73c1848a067a0fd094423213dc1e855b5b29b0b441f0bcb315feb90d662972e
SHA3 a630c0bd054ccf853d3673897d2a553e10797d288b3f09898503304ecec7d7f3

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.77742
MD5 db1208cf5d76055be1c3a34567af9f5a
SHA1 c5adcd7407c8b18459e4b4ce96fb70ecf5701a97
SHA256 5a008270f7254f5ca861e9936f4b5b7a23c04d63165895234fd1782bc03ec0e5
SHA3 549076010917e74ff3fe656848779d90468b96740184b07016dbf2833e9abf99

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x952c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95095
Detected Filetype PNG graphic file
MD5 f6fbada22d6a6c07ef8fdaa504f117d5
SHA1 591a723501eff1a4920462f8efcaf3715e829450
SHA256 3919b11194f130d310dfe08bdce2891c5b64f2703107f53a5a1cbc016fdb609f
SHA3 ceca597fff3f436773eb9e48be245ce9d24439b9527a0d3aedaa1469e49d3f5c

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.0521
MD5 86ce219c337119fe35646823cb56d091
SHA1 74d3090f01f3128bda93a3a7525f139c495bffbd
SHA256 7ef5a24efde1748c0eb12c5817b14cfe1397ae968489a7824a269d02c8223cee
SHA3 8daaa7aab035df895cb478d3b92385d12aebd96c8bbde3a05a615ff56d41aebf

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15081
MD5 58b7700e8f20d0a3c77021eb7e7019dc
SHA1 87f7668b96ab48bd6ba5c8b9968dbb024a028407
SHA256 c5536b396be6dcfc96f4e4f77cc7007b2a56730ee57598a6979cc1c1c71c920a
SHA3 13bb36cea0c569109ddca6560016003d3ce662f8e0bc189e9750019ccdc7bc72

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.39466
MD5 9de69c1c4b3a06597da9c275b38bffb6
SHA1 a4ed3bd1bb4edc0eaa187b68929f596906e9ee87
SHA256 ac2e25dc4a4f7bd96a0bcf3ea63cd1bcf26a6f6a05835e32f96ef99cb4323f30
SHA3 6ff197b54509b5c0fa643d6bdbc756cccec2b5bc8495c770883c021e833f7509

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 cd3a631eace19041876b4c4c6ec8461a
SHA1 d4b3f99c4d648e3446dc05e7fb6e444e42dfed01
SHA256 f5b94a42f1c77c9eef858a0dfd656419fea900b00318c2c0bf49c2fce345d838
SHA3 b6dcbb1b4c262eb5aee12773a52c29ff20fef809a4e61822700d005457944b9f

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2020-Aug-16 23:22:50
Version 0.0
SizeofData 680
AddressOfRawData 0x2fd20
PointerToRawData 0x2e720

TLS Callbacks

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140033018

RICH Header

XOR Key 0x6b76df8a
Unmarked objects 0
C objects (26213) 10
ASM objects (26213) 7
C++ objects (26213) 185
C++ objects (VS 2015/2017 runtime 26706) 38
C objects (VS 2015/2017 runtime 26706) 17
ASM objects (VS 2015/2017 runtime 26706) 8
Imports (26213) 9
Total imports 113
C objects (27042) 16
Resource objects (27042) 1
Linker (27042) 1

Errors

<-- -->