a5d71a2ff928cd7b3875d6e942f728d3

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Aug-26 11:25:03

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 18773937 bytes of data starting at offset 0x51a00.
The overlay data has an entropy of 7.99562 and is possibly compressed or encrypted.
Overlay data amounts for 98.2503% of the executable.
Malicious VirusTotal score: 18/72 (Scanned on 2024-10-02 09:03:40) ALYac: Gen:Variant.Tedy.649381
APEX: Malicious
Arcabit: Trojan.Tedy.D9E8A5
BitDefender: Gen:Variant.Tedy.649381
Bkav: W64.AIDetectMalware
CTX: exe.unknown.tedy
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
Elastic: malicious (moderate confidence)
Emsisoft: Gen:Variant.Tedy.649381 (B)
FireEye: Gen:Variant.Tedy.649381
Fortinet: PossibleThreat.PALLAS.H
GData: Gen:Variant.Tedy.649381
MicroWorld-eScan: Gen:Variant.Tedy.649381
SentinelOne: Static AI - Suspicious PE
VIPRE: Gen:Variant.Tedy.649381
Zillya: Trojan.Agent.Win32.3991781

Hashes

MD5 a5d71a2ff928cd7b3875d6e942f728d3
SHA1 93c29c51c636512a21af5c1553caef72e4e794ef
SHA256 3319e9fd2c3a50d8e41c753d58769480eaf1dde78b16f0e5c61da0d1d457ed2c
SHA3 ae362acf390fdd53d2eb9f45d43b036601ed96e859385565f725aa682fce85ed
SSDeep 393216:goeYKg1DddcLxT61+TtIigeJ+1DdAETf0VFGhg5bCo+m:Hec1JmxO1QtIbS+1JAEMghMo
Imports Hash 72c4e339b7af8ab1ed2eb3821c98713a

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2024-Aug-26 11:25:03
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2a000
SizeOfInitializedData 0x27600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000CDB0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x59000
SizeOfHeaders 0x400
Checksum 0x1243b87
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a6c3b829cc8eaabb1a474c227e90407f
SHA1 2d9a342b9cea10af36a9defffc2a2fd763e338be
SHA256 2d2aed2a4e4a06095da38cac58f069e2793f70b601d123d5080c7b0a842e6912
SHA3 e271d55ddffba9ea27c0acf2bee52f1c104ec093a27c25004d04f49b4b038670
VirtualSize 0x29f00
VirtualAddress 0x1000
SizeOfRawData 0x2a000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48749

.rdata

MD5 34567fea68bdddbbf1e8f422a6badd94
SHA1 a4d9e82b0f91d2ef5e96ffdfc7a78c328b123717
SHA256 d919d4a5e4814109cfd71bf80a6c7d104f78e14bb47289f28fbe70cbc5a57a3d
SHA3 c35024ea9ca054785e3fd77104c9309548eebf9206bb8f41a1a2bc479d068b39
VirtualSize 0x12a50
VirtualAddress 0x2b000
SizeOfRawData 0x12c00
PointerToRawData 0x2a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.75279

.data

MD5 dba0caeecab624a0ccc0d577241601d1
SHA1 069fd3959f91e690643115a296bf21044144de01
SHA256 17a374764a97598eeb35b9f9e96bad505b780b2a64a325822e5c002f7fdc1966
SHA3 6f4a62f5b3771451f1409b76e8ad2c44d754c804580f1209eff1f5a96fb6decd
VirtualSize 0x53f8
VirtualAddress 0x3e000
SizeOfRawData 0xe00
PointerToRawData 0x3d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.83922

.pdata

MD5 181312260a85d10a1454ba38901c499b
SHA1 09c2a6d5404bc19e11f7eddad07a164b42b01ee6
SHA256 1a30254e43a7ba40891fc6b0ee5b2ad8c4d9bc37d1564c8415aeb003f9d2c2fb
SHA3 70340f806ff22530f3adcad7f2c5373ab755d223eacad05b030cb24389878acb
VirtualSize 0x2250
VirtualAddress 0x44000
SizeOfRawData 0x2400
PointerToRawData 0x3de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.29035

.rsrc

MD5 0bc6f238fcd50cf559383761bbed838c
SHA1 e8a6bbf485bb01876c232003cf7b6808606d39ae
SHA256 f63999502d2628c2469358f408eb51507f4623091a118cb7603a12783f3f74b7
SHA3 bc0e1f56f8fb174115a69abcebd6a236119675583e917792b59473b8028579b4
VirtualSize 0x10e34
VirtualAddress 0x47000
SizeOfRawData 0x11000
PointerToRawData 0x40200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.48507

.reloc

MD5 816c68eeb419ee2c08656c31c06a0fff
SHA1 d73caf6099972c4407ac22954a7454e922084dc0
SHA256 b6f0828ba5501d261d26c59b0f79c32c6638d04e3c645417a5fa7e400a5016af
SHA3 62d280821f21ecb72eb7058070711484d2bae903b66ceb7cdbbf8f2b3bde274a
VirtualSize 0x764
VirtualAddress 0x58000
SizeOfRawData 0x800
PointerToRawData 0x51200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.28095

Imports

USER32.dll CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.3686
MD5 9558de7449d02e81ab3bae532fa3ac87
SHA1 f74d30ea19cc19883d1fae63f0a492c274bab12c
SHA256 9ea399c1a7feb37432465884b283912242863f7d4040f79ce1798270b186c2c8
SHA3 f12aac13e178870fba4d56196dfe316f784f0fb9d45272a74e548f94d48421c1

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.98048
Detected Filetype Icon file
MD5 38388dda6548693f4d42f2241a4218d7
SHA1 78bedd12a20f97e31e58742381f3d0ca1edb4715
SHA256 cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba
SHA3 9ace1e9f008d60580379cdfdcd4119706c82d52d2e5fdb9e5745fa00864cc1a8

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Aug-26 11:25:03
Version 0.0
SizeofData 796
AddressOfRawData 0x3a474
PointerToRawData 0x39874

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003e040
GuardCFCheckFunctionPointer 5368886432
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xf463705a
Unmarked objects 0
ASM objects (30795) 7
C++ objects (30795) 180
C objects (30795) 10
253 (33731) 3
ASM objects (33731) 9
C objects (33731) 17
C++ objects (33731) 40
Imports (30795) 11
Total imports 155
C objects (33813) 25
Linker (33813) 1

Errors

<-- -->