| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Nov-03 15:10:14 |
| Detected languages |
English - United States
|
| Suspicious | This PE is packed with Themida |
Unusual section name found:
Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: Unusual section name found: .imports Unusual section name found: .themida Section .themida is both writable and executable. Unusual section name found: .boot |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Possibly launches other programs:
|
| Malicious | VirusTotal score: 54/74 (Scanned on 2024-06-28 09:12:01) |
ALYac:
Gen:Variant.Mikey.162607
APEX: Malicious AVG: Win64:MalwareX-gen [Trj] AhnLab-V3: Trojan/Win.Generic.C5559431 Antiy-AVL: Trojan[Packed]/Win64.Themida Arcabit: Trojan.Mikey.D27B2F Avast: Win64:MalwareX-gen [Trj] Avira: TR/CoinMiner.wonhj BitDefender: Gen:Variant.Mikey.162607 Bkav: W64.AIDetectMalware CrowdStrike: win/malicious_confidence_100% (W) Cybereason: malicious.d1bea6 Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: a variant of Win64/Packed.Themida.L suspicious Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Mikey.162607 (B) F-Secure: Trojan.TR/CoinMiner.wonhj FireEye: Generic.mg.9ecdc9ed1bea6c22 Fortinet: Riskware/Application GData: Gen:Variant.Mikey.162607 Google: Detected Gridinsoft: Trojan.Heur!.03210023 Ikarus: PUA.Themida K7AntiVirus: Trojan ( 0057a5231 ) K7GW: Trojan ( 0057a5231 ) Lionic: Trojan.Win32.Themida.4!c MAX: malware (ai score=87) Malwarebytes: Malware.AI.4093198989 MaxSecure: Trojan.Malware.219104223.susgen McAfee: Artemis!9ECDC9ED1BEA McAfeeD: Real Protect-LS!9ECDC9ED1BEA MicroWorld-eScan: Gen:Variant.Mikey.162607 Microsoft: Trojan:Win32/CoinMiner.A Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Trojan.ScarletFlash!8.FB27 (CLOUD) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Generic.rc Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Trapmine: malicious.moderate.ml.score TrendMicro: TROJ_GEN.R002C0DC424 TrendMicro-HouseCall: TROJ_GEN.R002C0DC424 VIPRE: Gen:Variant.Mikey.162607 Varist: W64/Trojan.GKA.gen!Eldorado VirIT: Trojan.Win64.Agent.CHJA Webroot: W32.Trojan.Gen Xcitium: ApplicUnwnt@#15ij81vyoo2q3 Yandex: Riskware.Themida!O6eVvGVSD9g Zillya: Trojan.Themida.Win64.9396 alibabacloud: Trojan:Win/Packed.Themida.L |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 12 |
| TimeDateStamp | 2023-Nov-03 15:10:14 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xc1600 |
| SizeOfInitializedData | 0x91e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000736058 (Section: .boot) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xa9f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x4196bd |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetModuleHandleA
|
|---|---|
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
| USER32.dll |
GetClipboardData
|
| ADVAPI32.dll |
AddAccessAllowedAce
|
| SHELL32.dll |
ShellExecuteA
|
| MSVCP140.dll |
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
|
| IMM32.dll |
ImmGetContext
|
| D3DCOMPILER_47.dll |
D3DCompile
|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
|
| Normaliz.dll |
IdnToAscii
|
| WLDAP32.dll |
#301
|
| CRYPT32.dll |
CertGetCertificateChain
|
| WS2_32.dll |
getsockopt
|
| RPCRT4.dll |
UuidToStringA
|
| PSAPI.DLL |
GetModuleInformation
|
| USERENV.dll |
UnloadUserProfile
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
__current_exception
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_configure_narrow_argv
|
| api-ms-win-crt-stdio-l1-1-0.dll |
fclose
|
| api-ms-win-crt-utility-l1-1-0.dll |
qsort
|
| api-ms-win-crt-string-l1-1-0.dll |
strspn
|
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
|
| api-ms-win-crt-convert-l1-1-0.dll |
strtoul
|
| api-ms-win-crt-math-l1-1-0.dll |
cosf
|
| api-ms-win-crt-time-l1-1-0.dll |
_gmtime64
|
| api-ms-win-crt-filesystem-l1-1-0.dll |
_unlink
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-environment-l1-1-0.dll |
getenv
|
| XOR Key | 0x1062bd07 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 22 |
| C++ objects (VS 2015-2022 runtime 32533) | 2 |
| 253 (32420) | 8 |
| C objects (32420) | 10 |
| ASM objects (32420) | 4 |
| C++ objects (32420) | 35 |
| Imports (32420) | 6 |
| C objects (VS2019 Update 6 (16.6.1-5) compiler 28806) | 105 |
| C objects (VS2022 Update 3 (17.3.0-3) compiler 31629) | 2 |
| C++ objects (VS2022 Update 3 (17.3.0-3) compiler 31629) | 2 |
| Imports (30795) | 35 |
| Total imports | 464 |
| C++ objects (LTCG) (32538) | 18 |
| Resource objects (32538) | 1 |
| Linker (32538) | 1 |