a3c6f1c383488bc8e2d0e65dbca2d0e8

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2018-Sep-04 14:42:13

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • ntohl
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 4586230 bytes of data starting at offset 0x3ba00.
The overlay data has an entropy of 7.98937 and is possibly compressed or encrypted.
Overlay data amounts for 94.9441% of the executable.
Malicious VirusTotal score: 8/72 (Scanned on 2023-12-07 00:19:59) APEX: Malicious
Bkav: W32.AIDetectMalware
FireEye: Generic.mg.a3c6f1c383488bc8
MaxSecure: Trojan.Malware.11973.susgen
McAfee: Artemis!A3C6F1C38348
Skyhigh: BehavesLike.Win32.Generic.rc
Webroot: W32.Trojan.Gen
Xcitium: Malware@#252h059y460he

Hashes

MD5 a3c6f1c383488bc8e2d0e65dbca2d0e8
SHA1 2296993e147a5b50c6813a84ba79aa69299adebe
SHA256 43a09bd38b5f0b0aaaee703e415ba41cb3274a692b191a7bba3a895d1e3cc4e4
SHA3 a499803f965da65b21255b7e61ea092cc888357312cedd4e56cd48e8cf031dfc
SSDeep 98304:aiMuKXmTjJ5q9Jt4gy9ImjXE3cPtEBO7oV6gqcNtvIBsd3yL7t9:9hK4J5q9D4ImjXEMGBO7oLqcNtv9ZQt
Imports Hash 4df47bd79d7fe79953651a03293f0e8f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2018-Sep-04 14:42:13
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x1f400
SizeOfInitializedData 0x2a000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000779A (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x21000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x4e000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 83d209c1cb42f196076b0b806d37f6ee
SHA1 32dc735fcc703ab193dc6f46746f38d028f035d3
SHA256 658129ab9c680696c38d4f408e6e4282684c9d34f04df7d926df6098e6272469
SHA3 28127c4b31e6093b87461a0f272b829a7715e6d6d41281051e9f0f39255573cf
VirtualSize 0x1f224
VirtualAddress 0x1000
SizeOfRawData 0x1f400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.65269

.rdata

MD5 7881067ccbd6c373e2a388de0ee98b35
SHA1 d56af2ce5bace4b4ea1027254066cbb796c81176
SHA256 9939b0d7b43f4cf093473456b23c999fcfd8c53c70f836a60fa58f65ec6630f2
SHA3 f5ce36ff30888001ac3ec2a7c6fe0a38a182451e4967018cbd535b6f9f22fdce
VirtualSize 0xb0ec
VirtualAddress 0x21000
SizeOfRawData 0xb200
PointerToRawData 0x1f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.10091

.data

MD5 9feaed8c93f4a5b5b9a365d49e7facd3
SHA1 a881d60cad9c6a1ee456a951cceb3d13cbac03be
SHA256 e5a2e03840c1b3a0c0b8edf71a91dd21adb2c6923efd468276eb813658a0793e
SHA3 234411a1fa3b004e8fb92c167df9ca728810c0760dc46e6ee17c61e35a90ecbd
VirtualSize 0xe680
VirtualAddress 0x2d000
SizeOfRawData 0xa00
PointerToRawData 0x2aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.94098

.gfids

MD5 45c9e970b68ba03dad926e5dc49f1d09
SHA1 6e85c639f553f864f10faa617ff3a92792a661aa
SHA256 15c0e4f54b38d7ce55076062fe55b8f2f3dd48ce6d1d97c131ada2d032cdb379
SHA3 a1e3d86d975d4d97a3f04e48ed9776a80e3348d26c31206b311fc4466e333efd
VirtualSize 0xb8
VirtualAddress 0x3c000
SizeOfRawData 0x200
PointerToRawData 0x2b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.89006

.rsrc

MD5 21ad278e9b55501bb3ff33c41c379b80
SHA1 42c8df519dbd1bb7766cbff71a70aa3693bfd6f9
SHA256 bed57776ed692898b5c255bdbbded0397dd856f0727c0106caebd44742c7eae9
SHA3 7437940ddd8ebd59561ff87bf28b5ff4a69851ec8e3e451a25f73c87a7bf07c8
VirtualSize 0xea38
VirtualAddress 0x3d000
SizeOfRawData 0xec00
PointerToRawData 0x2b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.29706

.reloc

MD5 c3aec152305abf246078fa5b1e108c45
SHA1 6a849122213c64eddf65a4252be9c8750b8f566e
SHA256 316c22025025afd943c942337a849659684369b6e941e4542c731a2eea7f1b06
SHA3 30fa41faa2062b794a57b2365506f1149058abb03833787c76c053375a885be8
VirtualSize 0x17b8
VirtualAddress 0x4c000
SizeOfRawData 0x1800
PointerToRawData 0x3a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.65088

Imports

KERNEL32.dll GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
HeapReAlloc
SetEndOfFile
RaiseException
WS2_32.dll ntohl

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2018-Sep-04 14:42:13
Version 0.0
SizeofData 696
AddressOfRawData 0x2aecc
PointerToRawData 0x296cc

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x42d008
SEHandlerTable 0x42aec0
SEHandlerCount 3

RICH Header

XOR Key 0x512e62a6
Unmarked objects 0
241 (40116) 12
243 (40116) 170
242 (40116) 24
ASM objects (VS2015 UPD3 build 24123) 18
C++ objects (VS2015 UPD3 build 24123) 29
C objects (VS2015 UPD3 build 24123) 18
Imports (65501) 5
Total imports 113
C objects (VS2015 UPD3 build 24210) 17
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors

<-- -->