ab639d365b794c5f8e84f87f3f3db870e0e5cd5b57f64c48308a44999ff73f52

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00

Plugin Output

Suspicious PEiD Signature: HQR data file
Info Interesting strings found in the binary: Contains domain names:
  • .eq.github.com
  • .hash.net
  • GoneopensyncStat.com
  • eq.github.com
  • github.com
  • golang.org
  • https://go.dev
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Malicious VirusTotal score: 5/71 (Scanned on 2026-09-25 22:48:41) Bkav: W32.Malware.F8386390
CrowdStrike: win/malicious_confidence_60% (D)
Microsoft: Trojan:Win32/Wacatac.C!ml
Sangfor: Trojan.Win32.Save.a
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 72e60ad683a76711926abffe107336a4 🔍
SHA1 2bf709887a1a4dc5f3699bc994a390f08cfc15e2 🔍
SHA256 ab639d365b794c5f8e84f87f3f3db870e0e5cd5b57f64c48308a44999ff73f52 🔍
SHA3 7f8ceb71af40cbdd67baac2327d8de16ef3f8c3624afe1fcbc9c462d5c98f308 🔍
SSDeep 49152:d9VFmI0R6j/pdMsifNy19JuEGtXmWwVgzAILmZuzc15LBLFZhFICiDwKeK9KtdD:d5jDmjm1dILl6r46dNEN 🔍
Imports Hash d42595b695fc008ef2c56aabd8efd68e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x60e800
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x2c3600
SizeOfInitializedData 0x4ec00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000077C80 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 1.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0x66a000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 72e493213b4cb175534768880ac0a84f 🔍
SHA1 230877e9672a5e289a151cb8e5b173942ac8e255 🔍
SHA256 a59c5a19228fabf7fe5fbc699b5f3123c2906809963b662bc7be7242a5be6bbb 🔍
SHA3 20dadd0efa15a6336c6911c312332111517adf34a09887ef451ac17529b2ccc9 🔍
VirtualSize 0x2c34f1
VirtualAddress 0x1000
SizeOfRawData 0x2c3600
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.20283

.rdata

MD5 4a700aa648ee8b5c81795b7f203024f1 🔍
SHA1 73681ca7a7964de1b1fa0926b000a67f4bfd7c0d 🔍
SHA256 333185c8f58351ddf5345dc1e4dab75b66b5e661f4a87260122cd7c6afcb59c3 🔍
SHA3 13d0be73bc908d96ed108b7e130a2039e3ca04362ada273491873e9071b6b203 🔍
VirtualSize 0x2dd668
VirtualAddress 0x2c5000
SizeOfRawData 0x2dd800
PointerToRawData 0x2c3c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.532

.data

MD5 af3cb15cb533f9267a7357c936b39ab8 🔍
SHA1 cbf0f561a185533ec923414db3ec2b0e666d2ae6 🔍
SHA256 3fb0424b8beb64d6dc865c3d302e970909e99d591b69f8059b1efb8743841703 🔍
SHA3 08a1512968984551d180382292be97374d49e9663652e232cb939909b0df5f66 🔍
VirtualSize 0xa4970
VirtualAddress 0x5a3000
SizeOfRawData 0x4ec00
PointerToRawData 0x5a1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.13399

.pdata

MD5 d6defc77c998ca33b7e1179174a9eae5 🔍
SHA1 1168291d49e86f94fccc3917e5f6e84014ed2a74 🔍
SHA256 46ca79c90e868c227f5f840288b15e45a858fafbd8943e827d799f7ac0084115 🔍
SHA3 a1cc0dd812520986484d5056c8a72b76b60771ba0d750b27531e1547268c937d 🔍
VirtualSize 0x104ac
VirtualAddress 0x648000
SizeOfRawData 0x10600
PointerToRawData 0x5f0000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.51426

.xdata

MD5 0137d59d2d52ba8be102900e742600a5 🔍
SHA1 8c75caa6c5bbd530b5e7b22da12325e771fd7337 🔍
SHA256 ccf9800ab76c784f9a0ffd20d0115470c456ef28f5417bdb2148b2ddbc83b9c5 🔍
SHA3 f3cc8ca194c6f6958d8fab3b74126c795ff0a8db3470274f0f078a5c81df384e 🔍
VirtualSize 0xb4
VirtualAddress 0x659000
SizeOfRawData 0x200
PointerToRawData 0x600600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78321

.idata

MD5 290a42569baea64b74130b88886ad214 🔍
SHA1 229423b08af57922855f098c3151f957fbba7a24 🔍
SHA256 17afd56cb4e20b7030d2d7213392729b8604abafe5d1fcfa21f78258364a763c 🔍
SHA3 3b3a56690b27c9e5ec20ceb052e0351c41591fd91b9fa69968f9ea3a7e8f7e37 🔍
VirtualSize 0x53e
VirtualAddress 0x65a000
SizeOfRawData 0x600
PointerToRawData 0x600800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.927

.reloc

MD5 df64950c087908e21c74d3818253215b 🔍
SHA1 85417f8a2bb88520aac7f5db8822b86b6e185229 🔍
SHA256 7dee513cdbdb3fc6fa30e4d01d3a8d4663128ed2e59e22a61678aac14afacc87 🔍
SHA3 c274879031705e6404d91a6d6c03ac89b05d92d63c3d867096b342bc64a871fd 🔍
VirtualSize 0xd920
VirtualAddress 0x65b000
SizeOfRawData 0xda00
PointerToRawData 0x600e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.42546

.symtab

MD5 07b5472d347d42780469fb2654b7fc54 🔍
SHA1 943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍
SHA256 3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍
SHA3 a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍
VirtualSize 0x4
VirtualAddress 0x669000
SizeOfRawData 0x200
PointerToRawData 0x60e800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0203931

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.