9522a0347222b4a2a4adfed4670f0cc99ea4fb6c7ddcd017293fbc29829995bc

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00

Plugin Output

Suspicious PEiD Signature: HQR data file
Info Interesting strings found in the binary: Contains domain names:
  • .eq.github.com
  • .hash.net
  • GoneopensyncStat.com
  • eq.github.com
  • github.com
  • golang.org
  • https://go.dev
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Malicious VirusTotal score: 6/71 (Scanned on 2026-09-25 22:47:18) Bkav: W32.Malware.9F106A7E
CrowdStrike: win/malicious_confidence_60% (D)
Kaspersky: VHO:Trojan.Win64.Agent.gen
Microsoft: Trojan:Win32/Wacatac.B!ml
Sangfor: Trojan.Win32.Save.a
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 2cbef294fd347e7856b342f2bda42e13 🔍
SHA1 3b01edd2f6c65947f3e4a5f62fd216c89fe96030 🔍
SHA256 9522a0347222b4a2a4adfed4670f0cc99ea4fb6c7ddcd017293fbc29829995bc 🔍
SHA3 14b714e68caf8e7961321af2de20626188e0631206881dff8bef479626e0dba6 🔍
SSDeep 49152:C1Vil6nQqV4bwMWTTVSaQx2XG3/BtBth4+sLmp7jA1qua4s9qc3CiDwKeK9Kt/x:CrVn5iB5jsLA23q6/TEw 🔍
Imports Hash d42595b695fc008ef2c56aabd8efd68e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x60e800
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x2c3600
SizeOfInitializedData 0x4ec00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000077C80 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x66a000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 9988e02c22e9935a70bd32a739ac2089 🔍
SHA1 d09a8da86a6d08c64bbd0cd03546a8d7caca618a 🔍
SHA256 bf0ba058eb0f234051b69c349693c7c3b624bf2ef0b7c4ef14c3785d1fd491e7 🔍
SHA3 62a655d1b20ab511e469061987007509c179d94645e9a01052bb224535b7b69e 🔍
VirtualSize 0x2c34f1
VirtualAddress 0x1000
SizeOfRawData 0x2c3600
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.20285

.rdata

MD5 84e120a1fcf8168a4ad790c319eb4919 🔍
SHA1 ef0977af104868c4f915131bbf74fc3bc308e5a7 🔍
SHA256 707f3d02280147516e27c2da773fdf71c9b1825f8a7caec1894421ee19a7b0c5 🔍
SHA3 7eef08c50f90f7d5af2003d3cbc0e72fb01c80e058bf8e1459f985967f3f0437 🔍
VirtualSize 0x2dd668
VirtualAddress 0x2c5000
SizeOfRawData 0x2dd800
PointerToRawData 0x2c3c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.53368

.data

MD5 1cdef75f263a91583b6fb15323a51a77 🔍
SHA1 51a7827c523168bd6fce236ef3cf890ca364ca19 🔍
SHA256 0a04b707ffe3038827fc63ec544cddcf05ac7845a8e258461424bf4563aae9e7 🔍
SHA3 5163b2e20439fbac33fcd48e34158aa506591795af0befefc56c7eb40ea22afd 🔍
VirtualSize 0xa4970
VirtualAddress 0x5a3000
SizeOfRawData 0x4ec00
PointerToRawData 0x5a1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.13406

.pdata

MD5 d6defc77c998ca33b7e1179174a9eae5 🔍
SHA1 1168291d49e86f94fccc3917e5f6e84014ed2a74 🔍
SHA256 46ca79c90e868c227f5f840288b15e45a858fafbd8943e827d799f7ac0084115 🔍
SHA3 a1cc0dd812520986484d5056c8a72b76b60771ba0d750b27531e1547268c937d 🔍
VirtualSize 0x104ac
VirtualAddress 0x648000
SizeOfRawData 0x10600
PointerToRawData 0x5f0000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.51426

.xdata

MD5 0137d59d2d52ba8be102900e742600a5 🔍
SHA1 8c75caa6c5bbd530b5e7b22da12325e771fd7337 🔍
SHA256 ccf9800ab76c784f9a0ffd20d0115470c456ef28f5417bdb2148b2ddbc83b9c5 🔍
SHA3 f3cc8ca194c6f6958d8fab3b74126c795ff0a8db3470274f0f078a5c81df384e 🔍
VirtualSize 0xb4
VirtualAddress 0x659000
SizeOfRawData 0x200
PointerToRawData 0x600600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78321

.idata

MD5 290a42569baea64b74130b88886ad214 🔍
SHA1 229423b08af57922855f098c3151f957fbba7a24 🔍
SHA256 17afd56cb4e20b7030d2d7213392729b8604abafe5d1fcfa21f78258364a763c 🔍
SHA3 3b3a56690b27c9e5ec20ceb052e0351c41591fd91b9fa69968f9ea3a7e8f7e37 🔍
VirtualSize 0x53e
VirtualAddress 0x65a000
SizeOfRawData 0x600
PointerToRawData 0x600800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.927

.reloc

MD5 7974d0d4782e642e53c85b99f2dc9d56 🔍
SHA1 d20b1c7c4e739a8578b66e10869fc3d95b36cedc 🔍
SHA256 2762318b2c247decc245457c3bea3be380fc4aacfef377c9de3090575871eac2 🔍
SHA3 1534df2a04a371c1518793ec0ccfdf57b4fb951ff649f15a7591c2052aeec3d7 🔍
VirtualSize 0xd91c
VirtualAddress 0x65b000
SizeOfRawData 0xda00
PointerToRawData 0x600e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.42512

.symtab

MD5 07b5472d347d42780469fb2654b7fc54 🔍
SHA1 943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍
SHA256 3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍
SHA3 a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍
VirtualSize 0x4
VirtualAddress 0x669000
SizeOfRawData 0x200
PointerToRawData 0x60e800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0203931

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.