aabf615ea0cecbf94f8392c1ceb71efb

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2022-Jun-20 14:15:25

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qEMu
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 17077121 bytes of data starting at offset 0x4de00.
The overlay data has an entropy of 7.99663 and is possibly compressed or encrypted.
Overlay data amounts for 98.1664% of the executable.
Malicious VirusTotal score: 9/67 (Scanned on 2022-06-21 15:14:34) Malwarebytes: Malware.AI.1427909923
Cyren: PYC/Disgrab.D.gen!Camelot
ESET-NOD32: Python/Spy.Agent.HJ
ClamAV: Win.Malware.Pyspy-9952299-0
Kaspersky: HEUR:Trojan-PSW.Multi.Disco.gen
Sophos: OSX/PWS-CMF
Microsoft: Trojan:Win32/Sabsik.FL.B!ml
Cylance: Unsafe
Fortinet: Python/Agent.HJ!tr

Hashes

MD5 aabf615ea0cecbf94f8392c1ceb71efb
SHA1 81bf9d9c4854dac471a888d091f0dffa106b8dce
SHA256 805cf2f92babf8a1584b0c2b15ed20c7aa1878f1e265e4b46e21e9bc491d5a33
SHA3 c6860ed82a6653ae7b51096a0515bd2428fee9a5902ed39eb6bba937c02f2d79
SSDeep 393216:S0XUiYcQn3pPyIL2Vmd6ml/m3pmMBkqQCwuns9BJHhTaK0qQqF:tYcQ3pPyIyVmdXKmkhZHs1FTQqF
Imports Hash 0bbecc8e9f9f17b0ea9cc3899b15e5cf

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2022-Jun-20 14:15:25
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x28800
SizeOfInitializedData 0x25200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000A330 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x63000
SizeOfHeaders 0x400
Checksum 0x109e0f5
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 9de5a5b75b4c2bc64a9886c1516931fe
SHA1 5350bc5dabc7d9553a0cae72af2570f71ef17236
SHA256 7d25111b38d5efcd260c085d16fe0a0968290f2dd4e363498e0bde0a1ab78060
SHA3 cbd1347f9c39bf5e73206b9ded092d6de3c479e55f3b0b6b5cbd69e566bc3100
VirtualSize 0x287b0
VirtualAddress 0x1000
SizeOfRawData 0x28800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.49744

.rdata

MD5 f9bb7c9a3f4cef8c5de0824adf848e7a
SHA1 bfef800460341b31fb5e5eb552693a3ea98e6706
SHA256 ce9f10d6718072f7189a3c3af25ebe7b96ce32b7ec67e2dde7faebb3485e1a76
SHA3 9ee1cb14d0d0be9cb797bafe4fdb4a017dd888543b3f2dd2d8afca8704f4d87f
VirtualSize 0x1246a
VirtualAddress 0x2a000
SizeOfRawData 0x12600
PointerToRawData 0x28c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.83276

.data

MD5 8b3d142aadac9bd559d6b1134c34f225
SHA1 3355c220caaf96b9ee4ec3b553981399667e4fb1
SHA256 dfb057adeb9c6af0213a1092874e3ac740bd9e4872d533ced59aa5e8074b1028
SHA3 f9920fd4bdae8a86d338369ce69e906440d892c8b6e107ed7a666ccee985a5f6
VirtualSize 0x103e8
VirtualAddress 0x3d000
SizeOfRawData 0xe00
PointerToRawData 0x3b200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.80634

.pdata

MD5 6f12d1ec98a11c579519be2a33e88b89
SHA1 bb5a337b0fddcc3d7a233e85c9c65b03f010c49a
SHA256 2e82ab3035397f2619d522f98dfe044bc41bedf10076973f38e9c18b033825ab
SHA3 ce616bbcd01cb790b84855549fa6ad1d3b04ef567a0b858fb4145ccde83e0772
VirtualSize 0x20c4
VirtualAddress 0x4e000
SizeOfRawData 0x2200
PointerToRawData 0x3c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.31421

_RDATA

MD5 5a7fd679b64cb6fbc5b2469ee1857352
SHA1 6801fe6e50a1795dabc4b16880f9d6243ea81f92
SHA256 b507d1a79efbe180168e69c17cab753d5501a0dfaf2f6d65abca7e9211be65bf
SHA3 7c7bdc30361e3d120093f967a3a232a693ea746110c3035389a0bf0195666771
VirtualSize 0x15c
VirtualAddress 0x51000
SizeOfRawData 0x200
PointerToRawData 0x3e200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.84113

.rsrc

MD5 44b17cce60a3d027269358d1141fcf02
SHA1 99072c2ba4620d9967b039e64723112197002b9f
SHA256 85afb382e80e329ebd0ee8cb2675b7e90ad756a2c9aba2264f775371d194aa74
SHA3 f6d3c9a223a58638947a108c0ec27c76200368b0a70eccae94e5bc617f08ae12
VirtualSize 0xf00c
VirtualAddress 0x52000
SizeOfRawData 0xf200
PointerToRawData 0x3e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.35626

.reloc

MD5 ae68658bb8725af8077dafa58fba03db
SHA1 2cc691343e6d36f085381f0aba87f3ca35621f13
SHA256 3ec34501da76d059bc6dc0a374b64ea8d40608d48983846a9892a46cf41b5b1c
SHA3 9b23f6b64054f1b8cec8588967d7299fc6df7e2dc4af9499fdd7e825d168f357
VirtualSize 0x754
VirtualAddress 0x62000
SizeOfRawData 0x800
PointerToRawData 0x4d600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.23056

Imports

KERNEL32.dll GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
GetStartupInfoW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x58d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.2934
MD5 eed4e03eb7fcf2cb0196cef07b533263
SHA1 e24fa421a0df034dec095a6c0712fe5ce6b72053
SHA256 ad0ebabce479e26defb27f5892de8a2e53312c2be88568e871462b628dc0b5b8
SHA3 9d305515facb2378971683baff2e1107a5bda857cee0be8664c4de072894501a

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-Jun-20 14:15:25
Version 0.0
SizeofData 772
AddressOfRawData 0x3956c
PointerToRawData 0x3816c

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003d000
GuardCFCheckFunctionPointer 5368882000
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x4940e2a1
Unmarked objects 0
ASM objects (29395) 7
C++ objects (29395) 189
C objects (29395) 10
253 (VS 2015-2022 runtime 30818) 3
C++ objects (VS 2015-2022 runtime 30818) 40
C objects (VS 2015-2022 runtime 30818) 17
ASM objects (VS 2015-2022 runtime 30818) 9
Imports (29395) 5
Total imports 117
C objects (31328) 20
Linker (31328) 1

Errors

<-- -->