| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jun-12 11:21:22 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 54/67 (Scanned on 2026-06-26 06:04:44) |
ALYac:
Gen:Variant.Application.Mikey.108129
APEX: Malicious AVG: Win64:MalwareX-gen [Misc] AhnLab-V3: Trojan/Win.Generic.C5801837 Alibaba: Trojan:Win64/Mikey.1ade1626 Antiy-AVL: Trojan/Win64.Mikey Arcabit: Trojan.Application.Mikey.D1A661 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Gen:Variant.Application.Mikey.108129 Bkav: W32.Malware.566F5FD4 CAT-QuickHeal: Trojan.Multi CTX: exe.trojan.mikey CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win64/Agent.GUY trojan Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Application.Mikey.108129 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: Adware/Agent GData: Gen:Variant.Application.Mikey.108129 Google: Detected Gridinsoft: Trojan.Win64.Agent.sa K7AntiVirus: Trojan ( 005ce2c31 ) K7GW: Trojan ( 005ce2c31 ) Kaspersky: UDS:DangerousObject.Multi.Generic Kingsoft: malware.kb.a.712 Lionic: Trojan.Multi.Generic.4!c Malwarebytes: Malware.AI.3300400203 MaxSecure: Trojan.Malware.325668341.susgen McAfeeD: ti!97D52F54DFDB MicroWorld-eScan: Gen:Variant.Application.Mikey.108129 Microsoft: Trojan:Win64/Mikey!pz Paloalto: generic.ml Panda: Trj/GdSda.A Rising: Trojan.Agent!8.B1E (TFE:5:AWGNN05nltM) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.NetLoader.dh Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.10c48c4a Trapmine: malicious.high.ml.score TrendMicro: Trojan.Win32.ZYX.USBLFC26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFC26 VIPRE: Gen:Variant.Application.Mikey.108129 Varist: W64/ABApplication.NGBF-6725 VirIT: Trojan.Win64.GenK.JAX Webroot: W32.Malware.gen Zillya: Trojan.Agent.Win64.188222 alibabacloud: Riskware:Win/Mikey.Gen huorong: Trojan/Injector.cmi |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Jun-12 11:21:22 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x28000 |
| SizeOfInitializedData | 0x17200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000000A5F4 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x43000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
ReadProcessMemory
WriteProcessMemory GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot VirtualProtectEx Process32Next WriteConsoleW CreateFileW HeapReAlloc HeapSize VirtualAllocEx GetTickCount64 OpenProcess CreateRemoteThread Sleep WaitForSingleObject GetLastError Process32First CloseHandle SetFilePointerEx GetFileSizeEx ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwind |
|---|---|
| USER32.dll |
GetAsyncKeyState
SendInput |
| ADVAPI32.dll |
RegSetValueExA
RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteKeyA RegCreateKeyExA RegCloseKey RegSetValueExW |
| WS2_32.dll |
socket
WSAGetLastError recv connect closesocket WSAStartup WSACleanup freeaddrinfo getaddrinfo send |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-12 11:21:22 |
| Version | 0.0 |
| SizeofData | 800 |
| AddressOfRawData | 0x32be8 |
| PointerToRawData | 0x31fe8 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14003c2c0 |
| XOR Key | 0x8fa0b4db |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33140) | 149 |
| C objects (33140) | 12 |
| ASM objects (33140) | 9 |
| ASM objects (35207) | 9 |
| C objects (35207) | 17 |
| C++ objects (35207) | 46 |
| Imports (33140) | 9 |
| Total imports | 125 |
| C++ objects (35217) | 3 |
| Linker (35217) | 1 |
No comments yet.