9749458270dacc3212fd3a7ee0e98842

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Aug-28 21:41:05

Plugin Output

Malicious The file headers were tampered with. The RICH header checksum is invalid.
Malicious The PE contains functions mostly used by malware. Code injection capabilities (process hollowing):
  • ResumeThread
  • SetThreadContext
  • WriteProcessMemory
 Possibly launches other programs:
  • CreateProcessA
 Manipulates other processes:
  • WriteProcessMemory

Hashes

MD5 9749458270dacc3212fd3a7ee0e98842
SHA1 2231e7e8a58a7249663e190d732acdbae779634d
SHA256 4196b421fe618da111cd1067a2bcd0a8fb4ce0212c110f2e614f57f5463e19a4
SHA3 d4cd8253c53b4be72b13a22d8f1ac426fb3d705f48569c003968f65b5b29bbdc
SSDeep 48:iRlW3zEuuQlME1fiXDmGhQ0kaTBiIAAc7KkTs1W+u:EbnQlM4jITiHukTL
Imports Hash e550b33002ddf6b08033f9077a78bb7c

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xc8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2025-Aug-28 21:41:05
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x400
SizeOfInitializedData 0x2800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001200 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x7000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 617b1679519ee5bf97cb1bc9444397ec
SHA1 43904127671362ddaa0d374a48a7402640491edd
SHA256 552cda2668c2a8ccecca0ffe5e95dd1129dbeb9a494c8acc63f1dcc206d57d2c
SHA3 b1cb5faa283f45ea56b80d328391f790d47ea34d19546e934112cc49e22cd83e
VirtualSize 0x233
VirtualAddress 0x1000
SizeOfRawData 0x400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 3.40619

.rdata

MD5 07654959e752f67a20ef85c8511cc7b4
SHA1 6537ba84ec64424ad22394d40e59ff5e38a49bc7
SHA256 b65a10aae28c2ed0623ffdf36b45835f1b416dad2811a6b34c3c88131bad9689
SHA3 d62ef54bfa12df593d110ffa9578969a289955b3a210d84973288970a22299e0
VirtualSize 0x2b6
VirtualAddress 0x2000
SizeOfRawData 0x400
PointerToRawData 0x800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.29281

.data

MD5 a75d2abc304b408a23bf22bab1fc3165
SHA1 e11be211d1e2fb7e43c0b6c14367221e0286a6f5
SHA256 49f1159df5eedb916ab34f18ba38b7a361d8d55e4042631fc65b91f2c56bdbc1
SHA3 5d5907cebcc0768a2ad835e5fdcb86401e043e72e41edb7fbf8cd9d42d77bfc0
VirtualSize 0x207c
VirtualAddress 0x3000
SizeOfRawData 0x2200
PointerToRawData 0xc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.637515

.reloc

MD5 af3bea92a320c3fe97b5300ac909296b
SHA1 1ed4632a7a4b839c91035b0139a2ce2073f00cbd
SHA256 0b5e5447c9ecfe9d663d00d0da2a66440fe630aa32b6aaace5bfdc06d81f2133
SHA3 f0d9b3d45aea287576da0a658d944e8f760f9c54278bf35eaa75a6a51fb145bb
VirtualSize 0x48
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x2e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.10066

Imports

ADVAPI32.dll SetServiceStatus
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
KERNEL32.dll CloseHandle
ExitProcess
ResumeThread
CreateProcessA
GetThreadContext
SetThreadContext
VirtualAllocEx
WriteProcessMemory

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Aug-28 21:41:05
Version 0.0
SizeofData 220
AddressOfRawData 0x2070
PointerToRawData 0x870

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xb48d88bd
51233 (47281) 0
Imports (33140) 5
Total imports 11
C objects (35207) 1
Linker (35207) 1

Errors

[*] Warning: Please edit the configuration file with your VirusTotal API key. [!] Error: Could not load yara_rules/bitcoin.yara! [!] Error: Could not load yara_rules/monero.yara! [!] Error: Could not load yara_rules/compilers.yara! [!] Error: Could not load yara_rules/findcrypt.yara! [!] Error: Could not load yara_rules/suspicious_strings.yara! [!] Error: Could not load yara_rules/domains.yara! [!] Error: Could not load yara_rules/peid.yara!