Manalyzer :: aa7ede16191dff7567c725f7a27c7634bef4e2d7a2c48c2e6403b304b35a4a0d

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2022-Apr-28 16:57:51

Plugin Output

Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryW` `Possibly launches other programs: CreateProcessW` `Enumerates local disk drives: GetDriveTypeW`
Malicious	VirusTotal score: 32/70 (Scanned on 2026-09-08 09:41:30)	`ALYac: Trojan.Agent.GQHC` `Antiy-AVL: Trojan/Win64.Agent` `Arcabit: Trojan.Agent.GQHC` `BitDefender: Trojan.Agent.GQHC` `CAT-QuickHeal: Trojan.Elk` `CTX: dll.trojan.generic` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `ESET-NOD32: Win64/Agent.ELK trojan` `Emsisoft: Trojan.Agent.GQHC (B)` `GData: Trojan.Agent.GQHC` `Google: Detected` `Gridinsoft: Trojan.Win64.Agent.cl` `K7AntiVirus: Trojan ( 005dfb821 )` `K7GW: Trojan ( 005dfb821 )` `Malwarebytes: Malware.AI.3541964409` `MicroWorld-eScan: Trojan.Agent.GQHC` `Rising: Trojan.Agent!8.B1E (CLOUD)` `Sangfor: Trojan.Win32.Agent.Vogj` `Skyhigh: BehavesLike.Win64.Infected.mm` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `Tencent: Malware.Win32.Gencirc.11e2c982` `TrellixENS: Artemis!F67DC105BF23` `TrendMicro: Trojan.Win32.ZYX.USBLEF26` `TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLEF26` `VIPRE: Trojan.Agent.GQHC` `Varist: W64/ABTrojan.UTYJ-6563` `Xcitium: Malware@#666w74ef4xhv` `Yandex: Trojan.Igent.b4GdML.7` `alibabacloud: Trojan:Win/Agent.EEJ`

Hashes

MD5	`f67dc105bf2304f506370790123c55d2` 🔍
SHA1	`b27d89801065a92a3da8b94a6efb38ce30df95ec` 🔍
SHA256	`aa7ede16191dff7567c725f7a27c7634bef4e2d7a2c48c2e6403b304b35a4a0d` 🔍
SHA3	`468196d3d0316c5bbd6750b999ca7ff895c7e44f55605ebf69f1fbf4f91bc160` 🔍
SSDeep	`384:RFP14rfHYb9CfQgC3PoZnfSQyFLK0GLjpDmYwWJh9a89IM1B1eN4PCA9O80OFOh:RFPcYb9EPCQnqQRjQYRN6N` 🔍
Imports Hash	`7891b90c290e6528525cdd954119062c` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2022-Apr-28 16:57:51
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x4400`
SizeOfInitializedData	`0x2800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000001000 (Section: .code)`
BaseOfCode	`0x1000`
ImageBase	`0x180000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xb000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.code

MD5	`9399d53dbf6bc9e9e1fa5300a680fad9 🔍`
SHA1	`9d99045f5648dfb8daaae6fba3a428ae290bfc75 🔍`
SHA256	`1baff1607730626e1db3a12aef225c6e95bba5743ca471b76e6f3b8b23f005fc 🔍`
SHA3	`bfd9a748e8a1732c0bf5babc4f3e39b4cf79381963c6bd0cb6e136a9a21aa225 🔍`
VirtualSize	`0xf9c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.49127`

.text

MD5	`d687fc68d5a407834f4739f17f83ee06 🔍`
SHA1	`a0e061b21ef01f94a3e2df3b97a4c20a1bd74ebe 🔍`
SHA256	`963a9135b3da8073fe0fb11b4f83af24011fdaf40c6d1a60707b6b1a7518d096 🔍`
SHA3	`2058c55306fe09a94676008964a3235049c5e2ad740e02031150dd9975572a73 🔍`
VirtualSize	`0x33fe`
VirtualAddress	`0x2000`
SizeOfRawData	`0x3400`
PointerToRawData	`0x1400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.1096`

.rdata

MD5	`9bc9595355abc5f48dd74dfcdf91ba03 🔍`
SHA1	`5f7f7289bec062ffd574d54c60710873ecfa21b3 🔍`
SHA256	`490d796908009a50dfb1e3827ceee0e38163709f35f2721c5a0710ae6fb00a5e 🔍`
SHA3	`2ed74ff368e4bd3a3cedfc90ddebaf62d0cec3a5a7829c2421106350e25a6151 🔍`
VirtualSize	`0x609`
VirtualAddress	`0x6000`
SizeOfRawData	`0x800`
PointerToRawData	`0x4800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.07144`

.pdata

MD5	`9580a9c06c35d07a57f77fb460ca8e75 🔍`
SHA1	`27352a2b18d283cfd27d35d8f57d7c84c7213eba 🔍`
SHA256	`15c8637e15b5ccda94c9bb86f2850fb0b9892c9f3cb6f881fc43d39da65a286c 🔍`
SHA3	`aaf5154561416513e1120ab2e10d1201695956eaa3d31bd82a488ebaedd61a2d 🔍`
VirtualSize	`0x414`
VirtualAddress	`0x7000`
SizeOfRawData	`0x600`
PointerToRawData	`0x5000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.15163`

.data

MD5	`8e939cf2cafe26ea4e269bc71ad00671 🔍`
SHA1	`4b6b405c3e4ca512eaa14408bd67288c48101fd6 🔍`
SHA256	`68fe89ea45fa9a8e115b639d5af51658597dc2e786eb910557a463c9f1d4a87a 🔍`
SHA3	`97d9fd5e5980f5623d4ebceb896f59b68c13f61441c116a6cdcada23b79d3496 🔍`
VirtualSize	`0x17a8`
VirtualAddress	`0x8000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x5600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.98763`

.reloc

MD5	`a13191283ea9d20ef77e6dfa3506f20b 🔍`
SHA1	`3690c66b82343a84733715bc1be6b133d8d0dd74 🔍`
SHA256	`06335ac5137ae0d3d50f0a76457650d0955e7638fb0d28419d53cb3ecafff7fd 🔍`
SHA3	`be3418d839c9d55c66599f2e266903a8777f32f4396e6a2034f7364dfe5b0ab3 🔍`
VirtualSize	`0xc`
VirtualAddress	`0xa000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

msvcrt.dll	`memset` `wcsstr` `wcscmp` `memmove` `memcpy` `strlen` `strcpy` `wcsncpy` `wcslen` `wcscat` `malloc` `free`
KERNEL32.dll	`HeapCreate` `HeapDestroy` `DisableThreadLibraryCalls` `GetModuleHandleW` `GetProcAddress` `VirtualProtect` `OpenEventW` `CreateFileMappingW` `MapViewOfFile` `WaitForSingleObject` `SetEvent` `CreateProcessW` `CloseHandle` `GetSystemDirectoryW` `UnregisterWait` `EnterCriticalSection` `LeaveCriticalSection` `HeapFree` `TlsFree` `DeleteCriticalSection` `TlsAlloc` `InitializeCriticalSection` `TlsGetValue` `HeapAlloc` `GetCurrentProcess` `GetCurrentThread` `DuplicateHandle` `RegisterWaitForSingleObject` `TlsSetValue` `CreateThread` `GetModuleFileNameW` `MultiByteToWideChar` `WideCharToMultiByte` `FreeLibrary` `LoadLibraryW` `GetDriveTypeW` `FindFirstFileW` `FindClose` `GetFileAttributesW` `HeapReAlloc`
USER32.DLL	`CharLowerW`

Delayed Imports

AlphaBlend

Ordinal	`1`
Address	`0x10e2`

DllInitialize

Ordinal	`2`
Address	`0x19f3`

GradientFill

Ordinal	`3`
Address	`0x1350`

TransparentBlt

Ordinal	`4`
Address	`0x14b4`

vSetDdrawflag

Ordinal	`5`
Address	`0x10f8`

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.