a67b72b2020318b17fa18381a846ebffb25aa38a5c2463a3cb51d21d25061be8

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-12 12:28:21
Detected languages English - United States
Debug artifacts C:\Users\v aloo\Desktop\ctxbuild\ctx.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Malicious The PE contains functions mostly used by malware. Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • CallNextHookEx
  • MapVirtualKeyW
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Info The PE is digitally signed. Signer: \xE7\xA6\x8F\xE5\xBB\xBA\xE5\x85\xAD\xE5\xA3\xAC\xE7\xBD\x91\xE5\xAE\x89\xE8\x82\xA1\xE4\xBB\xBD\xE6\x9C\x89\xE9\x99\x90\xE5\x85\xAC\xE5\x8F\xB8
Issuer: Thawte Code Signing CA - G2
Malicious VirusTotal score: 21/60 (Scanned on 2026-08-18 06:19:30) AhnLab-V3: Trojan/Win.Generic.R789290
Alibaba: Trojan:Win64/GenKryptik.f17a25ed
Antiy-AVL: Trojan/Win32.Convagent
Avira: TR/W64.MalwareX
ESET-NOD32: Win64/GenKryptik_AGen.DJX trojan
Elastic: Windows.Generic.MalCert
F-Secure: Trojan.TR/W64.MalwareX
Fortinet: W64/Kryptik.EIY!tr
GData: Win64.Trojan.Agent.P3AMAK
Google: Detected
Gridinsoft: Trojan.Win64.Agent.sd!c
K7AntiVirus: Trojan ( 006d9f181 )
K7GW: Trojan ( 006d9f181 )
McAfeeD: Trojan:Win/GenericY.HWB
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Sophos: Mal/Generic-S
Symantec: Trojan.Gen.MBT
Tencent: Win32.Trojan.FalseSign.Iflw
TrellixENS: Artemis!CC950E04A4E0
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101HE26ZC

Hashes

MD5 cc950e04a4e0d818f0f6338007fcc84e 🔍
SHA1 9c241e65992fe83985579228feabbb7d932341c4 🔍
SHA256 a67b72b2020318b17fa18381a846ebffb25aa38a5c2463a3cb51d21d25061be8 🔍
SHA3 4c584286ff181a840b8c31d27662448bf2519785300d91c5ba4991d6382aa69f 🔍
SSDeep 12288:HRtCR6h4hkjmPU9YFlk1qgPPpJbBTl1c/FxPKmINbcmcOCMSG8VSAo:HRtuS1TaDjIcOCMSG8Zo 🔍
Imports Hash b29ef007fe4605c3954f4098109f59f0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-12 12:28:21
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x82400
SizeOfInitializedData 0xb5e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000007FCB0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x13d000
SizeOfHeaders 0x400
Checksum 0xb3390
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 9e2cea3f1888826b2bb63f95805b955e 🔍
SHA1 8b569ce2d4d725e98d6a25e64e8450b0f0fd9172 🔍
SHA256 921a6ce1bc1163c89832869664acb7d455cdd9d734adc6a920edb6516e78997a 🔍
SHA3 41ee3c17da0b1b21fb8ac8de14e79e77021c357130603df0ca1dcdfb85eecdf7 🔍
VirtualSize 0x82361
VirtualAddress 0x1000
SizeOfRawData 0x82400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51531

.rdata

MD5 b7879009863c1b5d81b1f07f6148a18a 🔍
SHA1 6c7ec0200e17573760c678f42e60fb058f6b4f25 🔍
SHA256 39dcd04256039c0d448a87ffd33f0808a2d91c79c40a014e9f4d1dc42544149f 🔍
SHA3 e51116f2a3b68ad379f38188d9a67e8a297508712f9ba3cea7455c3dde31563f 🔍
VirtualSize 0x1d3d2
VirtualAddress 0x84000
SizeOfRawData 0x1d400
PointerToRawData 0x82800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.34834

.data

MD5 6a41f347664cc2ff15de2ae0cf211f89 🔍
SHA1 7da3611c10a090c0934ce819b281a8952bbd7b47 🔍
SHA256 e799daaf92a82dbaf1444a835851d8131ce3f3a4e26759817e6d5df55e35f488 🔍
SHA3 bc4da24eb152bfa1a0f4bc865bcc115034c951f4ea4c6d664d3427b1d7b5e0dc 🔍
VirtualSize 0x93b18
VirtualAddress 0xa2000
SizeOfRawData 0x1000
PointerToRawData 0x9fc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.21845

.pdata

MD5 18f690d45d68b8ce0bfc44fc06113749 🔍
SHA1 8c922088749c1669d14d24c08bb9529a0e84302c 🔍
SHA256 d56d3bb435c7453225e897e185bcdbbb6d9edba67b41e6083b5702e304f55d7f 🔍
SHA3 39d5aef2357f0fc4c7923235a7f2fbf82914f10d706556d76c47ce94c8d76e8d 🔍
VirtualSize 0x4698
VirtualAddress 0x136000
SizeOfRawData 0x4800
PointerToRawData 0xa0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.78982

.rsrc

MD5 c5a05d70c7505bdd10287419e4aa05d6 🔍
SHA1 4e92e5d0d17d36020c92c3b723853b5d603fd2c0 🔍
SHA256 8d893155a3c63f28b6fdceb0982d3c991a6b566e684c5a299062177ef6833986 🔍
SHA3 56deddfe530ab74310f0ad3afe215eccd7274340fa419d98ac374ed81132af0d 🔍
VirtualSize 0x1e0
VirtualAddress 0x13b000
SizeOfRawData 0x200
PointerToRawData 0xa5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.72473

.reloc

MD5 8b0a77146288bfa67f1703fd7b066785 🔍
SHA1 527e8e96b4b44f2f87c1f22e973d99b7dc2dcad9 🔍
SHA256 1a1bb9e04d69735b1a1f2380ef79727a645da6c43067edc782568bd847175b46 🔍
SHA3 2bf1fb4a603ddb8b7152ef7a12badcb43f82e7c6ca984fe0f7562e006652f1b2 🔍
VirtualSize 0x20c
VirtualAddress 0x13c000
SizeOfRawData 0x400
PointerToRawData 0xa5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.39648

Imports

KERNEL32.dll GetCurrentProcess
GetModuleHandleExW
VirtualAlloc
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
Sleep
GetModuleHandleExA
GetTickCount64
DisableThreadLibraryCalls
GetCurrentThread
CreateThread
SetUnhandledExceptionFilter
GetTickCount
VirtualQuery
VirtualProtect
GetModuleHandleA
MultiByteToWideChar
GetFileAttributesA
QueryPerformanceFrequency
EnterCriticalSection
WideCharToMultiByte
QueryPerformanceCounter
FormatMessageA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
GetModuleFileNameA
GetLocaleInfoEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
CloseHandle
GetLastError
LocalFree
USER32.dll GetKeyNameTextA
GetAsyncKeyState
GetSystemMetrics
CallNextHookEx
GetCursorPos
MapVirtualKeyW
MSVCP140.dll ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
dbghelp.dll SymCleanup
SymFromAddr
SymInitialize
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
WINMM.dll PlaySoundW
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memmove
__std_terminate
strrchr
__C_specific_handler
memcmp
__std_exception_copy
memcpy
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memset
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0.dll _get_stream_buffer_pointers
_fseeki64
fread
__stdio_common_vswprintf_s
fsetpos
ungetc
setvbuf
fgetpos
__stdio_common_vfprintf
__stdio_common_vswprintf
fwrite
fflush
__acrt_iob_func
fgetc
__stdio_common_vsprintf_s
fclose
fputc
api-ms-win-crt-math-l1-1-0.dll sqrtf
acos
atan
atan2
cosf
atan2f
sqrt
fmodf
roundf
sin
fmod
sinf
powf
fmaxf
fmin
ceilf
cos
fminf
fmax
api-ms-win-crt-heap-l1-1-0.dll free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0.dll toupper
isdigit
strlen
towlower
wcsncpy_s
wcslen
tolower
api-ms-win-crt-convert-l1-1-0.dll mbstowcs_s
mbstowcs
strtol
api-ms-win-crt-runtime-l1-1-0.dll _beginthreadex
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
abort
_errno
api-ms-win-crt-utility-l1-1-0.dll rand
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0.dll ___lc_codepage_func

Delayed Imports

NextHook

Ordinal 1
Address 0x6d970

val33BA7ABAD2AFCAE4EB50BBE29AD3C98EC9CC67458BD8305989cortex

Ordinal 2
Address 0x4f40

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Aug-12 12:28:21
Version 0.0
SizeofData 65
AddressOfRawData 0x96398
PointerToRawData 0x94b98
Referenced File C:\Users\v aloo\Desktop\ctxbuild\ctx.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Aug-12 12:28:21
Version 0.0
SizeofData 20
AddressOfRawData 0x963dc
PointerToRawData 0x94bdc

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-12 12:28:21
Version 0.0
SizeofData 868
AddressOfRawData 0x963f0
PointerToRawData 0x94bf0

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Aug-12 12:28:21
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x180096780
EndAddressOfRawData 0x1800968b4
AddressOfIndex 0x1800a2f58
AddressOfCallbacks 0x180084878
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1800a2140

RICH Header

XOR Key 0x59501833
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 18
ASM objects (35721) 4
C objects (35721) 8
C++ objects (35721) 30
Imports (35721) 6
Imports (33145) 13
Total imports 273
C++ objects (LTCG) (36248) 5
ASM objects (36248) 2
Exports (36248) 1
Resource objects (36248) 1
Linker (36248) 1

Errors

Leave a comment

No comments yet.