| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-Oct-17 12:16:00 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| CompanyName | GetCreds |
| FileDescription | GetCreds |
| FileVersion | 1.0.0.0 |
| InternalName | GetCreds.dll |
| LegalCopyright | |
| OriginalFilename | GetCreds.dll |
| ProductName | GetCreds |
| ProductVersion | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Suspicious | PEiD Signature: | HQR data file |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses known Mersenne Twister constants |
| Suspicious | The PE is packed with Enigma Protector |
Unusual section name found:
Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: .imports Unusual section name found: .themida Section .themida is both writable and executable. Unusual section name found: .boot Unusual section name found: .enigma1 Section .enigma1 is both writable and executable. Unusual section name found: .enigma2 Section .enigma2 is both writable and executable. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 16/72 (Scanned on 2025-05-24 20:28:48) |
APEX:
Malicious
AVG: Win64:Evo-gen [Trj] Avast: Win64:Evo-gen [Trj] Bkav: W64.AIDetectMalware CrowdStrike: win/malicious_confidence_90% (D) Cylance: Unsafe Elastic: malicious (high confidence) Gridinsoft: Trojan.Heur!.03212023 Ikarus: PUA.Themida Malwarebytes: Generic.Malware.AI.DDS McAfeeD: ti!B7029BFBF163 NANO-Antivirus: Virus.Win64.Virut-Gen.bwpxnc Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 14 |
| TimeDateStamp | 2024-Oct-17 12:16:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x15a00 |
| SizeOfInitializedData | 0xd000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000005A2058 (Section: .boot) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x965000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x32ac7f |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x300000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x200000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetStdHandle
GetConsoleMode TlsGetValue GetLastError SetLastError RaiseException GetTickCount ExitProcess GetStartupInfoA GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetCurrentProcess ReadProcessMemory GetModuleFileNameA GetModuleHandleA WriteFile ReadFile CloseHandle SetFilePointer GetFileSize SetEndOfFile GetSystemInfo LoadLibraryW LoadLibraryA GetProcAddress FreeLibrary FormatMessageW DeleteFileW CreateFileW GetFileAttributesW CreateDirectoryW RemoveDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetEnvironmentVariableW GetConsoleOutputCP GetOEMCP GetProcessHeap HeapAlloc HeapFree TlsAlloc TlsFree TlsSetValue CreateThread ExitThread LocalAlloc LocalFree Sleep SuspendThread ResumeThread TerminateThread WaitForSingleObject SetThreadPriority GetThreadPriority GetCurrentThread OpenThread IsDebuggerPresent CreateEventA ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection MultiByteToWideChar WideCharToMultiByte GetACP GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx EnumResourceTypesA EnumResourceNamesA EnumResourceLanguagesA FindResourceA FindResourceExA LoadResource SizeofResource LockResource FreeResource GetVersion FlushInstructionCache VirtualAlloc VirtualFree VirtualProtect VirtualAllocEx VirtualProtectEx CreateRemoteThread PostQueuedCompletionStatus SetErrorMode WriteProcessMemory GetThreadContext SetThreadContext FlushFileBuffers DeviceIoControl FindClose GetLocalTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToDosDateTime GetLogicalDriveStringsW GetModuleFileNameW GetSystemDirectoryW GetTempPathW GetTempFileNameW GetWindowsDirectoryA GetWindowsDirectoryW QueryDosDeviceW SetFileAttributesW FindFirstFileExW FindNextFileW IsBadReadPtr IsBadWritePtr GetVersionExA CreateActCtxW ActivateActCtx CompareStringA GetLocaleInfoA GetDateFormatA EnumCalendarInfoA CompareStringW GetLocaleInfoW GetDateFormatW GetCPInfo GetThreadLocale SetThreadLocale GetUserDefaultLCID |
|---|---|
| oleaut32.dll |
SysAllocStringLen
SysFreeString SysReAllocStringLen SafeArrayCreate SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement SafeArrayPutElement SafeArrayPtrOfIndex VariantChangeTypeEx VariantClear VariantCopy VariantInit |
| user32.dll |
MessageBoxA
CharUpperBuffW CharLowerBuffW CharUpperA CharUpperBuffA CharLowerA CharLowerBuffA GetSystemMetrics MessageBeep |
| advapi32.dll |
RegOpenKeyA
|
| ole32.dll |
CoUninitialize
CoInitialize |
| ntdll.dll |
ZwProtectVirtualMemory
RtlFormatCurrentUserKeyPath RtlDosPathNameToNtPathName_U RtlFreeUnicodeString RtlInitUnicodeString |
| shlwapi.dll |
PathMatchSpecW
|
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | GetCreds |
| FileDescription | GetCreds |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | GetCreds.dll |
| LegalCopyright | |
| OriginalFilename | GetCreds.dll |
| ProductName | GetCreds |
| ProductVersion (#2) | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
| StartAddressOfRawData | 0x140028000 |
|---|---|
| EndAddressOfRawData | 0x140028010 |
| AddressOfIndex | 0x140028010 |
| AddressOfCallbacks | 0x1408b0058 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x00000001408B2A70
|
| XOR Key | 0x653c27b5 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (33731) | 10 |
| C objects (33731) | 12 |
| C++ objects (33731) | 87 |
| Imports (VS2008 SP1 build 30729) | 16 |
| Imports (33136) | 9 |
| Total imports | 201 |
| C++ objects (LTCG) (33811) | 10 |
| Linker (33811) | 1 |