a4c9af98ca721a82e8470ab5f81fcfb2bda74fcbc36bdfbea8854934ad3f0420

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2023-Jun-20 07:00:00
Detected languages English - United States
FileDescription VxKex Setup and Maintenance Tool
FileVersion 1.1.5.1679
InternalName KexSetup
OriginalFilename KEXSETUP.EXE

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Malicious The file contains overlay data. 6078442 bytes of data starting at offset 0x8800.
The file contains a 7-Zip compressed file after the PE data.
Overlay data amounts for 99.4305% of the executable.
Malicious VirusTotal score: 33/70 (Scanned on 2026-05-29 22:09:46) APEX: Malicious
AVG: Win32:MalwareX-gen [Misc]
Antiy-AVL: Trojan/Win32.Agent
Avast: Win32:MalwareX-gen [Misc]
Avira: TR/W32.Malware
Bkav: W32.Malware.9D145F3E
CAT-QuickHeal: Trojan.Agent
CTX: exe.trojan.generic
CrowdStrike: win/malicious_confidence_70% (W)
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
Elastic: malicious (high confidence)
F-Secure: Trojan.TR/Crypt.XPACK.Gen
Fortinet: W32/PossibleThreat
GData: Win32.Trojan.Agent.XBJNFL
Google: Detected
Ikarus: Trojan.Crypt
Jiangmin: Trojan.Zenpak.pdh
Lionic: Trojan.Win32.Zenpak.tssz
Malwarebytes: Malware.AI.4059435543
MaxSecure: Trojan.Malware.325188728.susgen
McAfeeD: ti!A4C9AF98CA72
Microsoft: Trojan:Win32/Wacatac.B!ml
Paloalto: generic.ml
Sangfor: Trojan.Win32.Agent.Vvds
Sophos: Mal/Generic-S
Symantec: Trojan.Gen.MBT
TrellixENS: Artemis!B9880FD2B660
TrendMicro: Trojan.Win32.ZYX.USBLEN26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLEN26
Varist: W32/ABTrojan.PDDY-5149
Webroot: Win.Trojan.Gen
alibabacloud: Trojan[dropper]:Win/Wacatac.B9nj

Hashes

MD5 b9880fd2b66000d549a94e744ff9abec
SHA1 7b26d8957afb2da34576797f01774377b13222c2
SHA256 a4c9af98ca721a82e8470ab5f81fcfb2bda74fcbc36bdfbea8854934ad3f0420
SHA3 9ee564b9d4e35d148122c9d0334d178e1534a0c44edc8737dccdaeeb62f40514
SSDeep 98304:DSjT+NzpQN/B7ly3JDtKX9llVZ3mv0yHZr8+Ec8FOE55PnW+PXflJORdecTuBIaw:ujapQNBJoDtWllVE95wDcMO0PxfblGu0
Imports Hash 7a5e2524b66da5177b4ec46d305a3dd7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2023-Jun-20 07:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6e00
SizeOfInitializedData 0x1600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00007B04 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xd000
SizeOfHeaders 0x400
Checksum 0x132fd
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 27189f2f9a9ba1e318a01410aa4c7ad8
SHA1 73f5a35ca1dd758cf7d07df929279201f25ac229
SHA256 2c6b2f34a4a12c0f965274b76d89007001600b0261126775340559757a3cec98
SHA3 fc2b17eab48b36e6a8b35c180584683e6dcc2a8c04975a50ef32a0dbcf6814af
VirtualSize 0x6c9c
VirtualAddress 0x1000
SizeOfRawData 0x6e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.58673

.rdata

MD5 8e31db5c36356408a9d72a74aae3ed17
SHA1 1689c00197e0dc3aa08ab9bb50b314f65a7ceea6
SHA256 db4bd2f77a0d2f9d1e54babbca242e2d727d2c74f869e8562d0d9d25c61bf701
SHA3 41a9f5a7ef45db63110fb31de29b4c6466520cea52fb2795f4bebba7b3cc3f60
VirtualSize 0x858
VirtualAddress 0x8000
SizeOfRawData 0xa00
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.50466

.data

MD5 598e1aae6ecbd8237c4383f4be94b9f1
SHA1 ab4a6d7509b109b24572e011b0696647c7af25f0
SHA256 f60983e21c9cca08114b490d798ca0c0435a6857fd6176a2da8222694af0e852
SHA3 6a6b8c71015beef8a08636cc20b9dc37e55151b2ebf483b758e88d727edf68cb
VirtualSize 0x2050
VirtualAddress 0x9000
SizeOfRawData 0x200
PointerToRawData 0x7c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0203931

.rsrc

MD5 cf6c6c9e198e48c0e1de9a5481678fee
SHA1 c3e2aa6f91627b97f67c4232e9d7a84ad991ced2
SHA256 3c8f8c8aeb60db5bf23f84112fbd6b9ffd7aec3f9dbda8f6af46612ce9acc214
SHA3 28632ddfd971d7f03a2543fa651297a625fcaadd0aaab553d88544ad0ba0afc6
VirtualSize 0x9b4
VirtualAddress 0xc000
SizeOfRawData 0xa00
PointerToRawData 0x7e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.68317

Imports

USER32.dll MessageBoxA
SHELL32.dll ShellExecuteExW
MSVCRT.dll _controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memcpy
free
malloc
wcscmp
memcmp
memmove
strlen
memset
KERNEL32.dll GetCurrentDirectoryW
GetStartupInfoA
GetModuleHandleA
GetSystemDirectoryW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetVersion
SetFilePointer
WriteFile
ReadFile
CreateFileW
DeleteFileW
FindNextFileW
RemoveDirectoryW
FindFirstFileW
FindClose
GetModuleFileNameW
GetCommandLineW
GetTempPathW
lstrlenW
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
lstrcpyW
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessW
SetCurrentDirectoryW
SetFileAttributesW
SetFileTime
lstrcatW
GetLastError
CreateDirectoryW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.80589
MD5 9fef9676ae7c2069b24da67e98f0539b
SHA1 906d5eeb14c92ad810063b1906b029c68bbb7256
SHA256 6805a90dc52c437cd2aa120a28900f2da8d447b94a3e2796040e74ecaa80df73
SHA3 281cb61acc2308bd530c20446b5c974c68be689be72720f7948a702da3f33ee8

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.18403
MD5 a792cef939f02d76cd876d1da1ffd1b7
SHA1 63e2d98ac53e5763e269277d05a1d1737dc04974
SHA256 fe174802e7a3a9d4ef79ae6e9baf2f3dedb02b8c0f5f5342ad04a37e3b9d6eeb
SHA3 39848cd80ec893f2971c96b27a6bdce65825c9f9dfb824e4b3f86ab87df3e3e7

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.37086
Detected Filetype Icon file
MD5 d59e0d372ea5fd8c1f4de744376a6af4
SHA1 6883ce60e71a83424db0b41d0ab6bf61080e3de2
SHA256 b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b
SHA3 5e39df982879204dd9f129a37d1e1c2ff906e88de9ae01b4418db5e8455e7ae1

1 (#3)

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x21c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32212
MD5 5989fda56a25e6d46c4d55e31b99f71e
SHA1 8f440f7e0107b409ac8aad9327feed4dc6a53480
SHA256 a28863ee70ea6370201370151f30c7da68f5ec673b71471f5c5325f6f4a93b6c
SHA3 7df9be479def76e977074e168ab6c726b0af63c8a2d8a97a7b6ef0c90137d961

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x201
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.04716
MD5 d8c691533b2030c51c5853bfb02aaf88
SHA1 586978ad69058657b6d14127968f438e684201b9
SHA256 b14001d080e6dc477a7e47b5a8c59c2e92d47ee98ffe64fa1ef71711602de3ed
SHA3 73af1443f864f494b656df0a4b3bfc13ac653e827f584137e7049a7b1e2500bc

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.1.5.1679
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
FileType VFT_APP
Language English - United States
FileDescription VxKex Setup and Maintenance Tool
FileVersion (#2) 1.1.5.1679
InternalName KexSetup
OriginalFilename KEXSETUP.EXE
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x3b5f899c
Unmarked objects 0
C objects (8047) 11
14 (7299) 5
Linker (8047) 2
Total imports 63
Imports (2179) 7
C objects (VS98 SP6 build 8804) 19
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

Leave a comment

No comments yet.