Manalyzer :: ac2192b740c57125067a29d2e0ea6d95b222543398188c5f67bbf01157622685

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2004-Apr-11 21:45:03

Plugin Output

Suspicious	The PE is packed with kkrunchy	`Unusual section name found: kkrunchy` `Section kkrunchy is both writable and executable.` `The PE only has 2 import(s).`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: LoadLibraryA GetProcAddress`
Malicious	VirusTotal score: 11/71 (Scanned on 2026-01-11 15:18:07)	`APEX: Malicious` `Bkav: W32.AIDetectMalware.CS` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `Elastic: malicious (high confidence)` `Malwarebytes: Malware.Heuristic.2043` `MaxSecure: Trojan.Malware.300983.susgen` `Paloalto: generic.ml` `SentinelOne: Static AI - Malicious PE` `ViRobot: Spyware.Pakes.97280`

Hashes

MD5	`0630f5f61bbd95dd28c2558c7092bc07`
SHA1	`29413afbc3a5b5fb03de428a546235559e3170b5`
SHA256	`ac2192b740c57125067a29d2e0ea6d95b222543398188c5f67bbf01157622685`
SHA3	`8402154fdacecbd61a6f514c3b713e397d61d41b42dafad2e68d1dde31aa092c`
SSDeep	`1536:1Y0Fv5UEX+k/uR61CxyT/k4ce044gWO9tCFkKE/K/plMCqisOARp6+RyhWLfh:dFv5UEC6WJje044dytCFlqK/7MCsOAx`
Imports Hash	`87bed5a7cba00c7e1f4015f1bdae2183`

DOS Header

e_magic	`MZ`
e_cblp	`0x6166`
e_cp	`0x6272`
e_crlc	`0x6172`
e_cparhdr	`0x7375`
e_minalloc	`0x6863`
e_maxalloc	`0x4550`
e_ss	`0`
e_sp	`0x14c`
e_csum	`0x1`
e_ip	`0xbc5f`
e_cs	`0x4079`
e_ovno	`0`
e_oemid	`0x10b`
e_oeminfo	`0xa07`
e_lfanew	`0xc`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`1`
TimeDateStamp	2004-Apr-11 21:45:03
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0x88`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`7.0`
SizeOfCode	`0x1e000`
SizeOfInitializedData	`0xd0a000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00017A0C (Section: kkrunchy)`
BaseOfCode	`0x1000`
BaseOfData	`0xc`
ImageBase	`0x7c0000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0xd87000`
SizeOfHeaders	`0x1000`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`5`

kkrunchy

MD5	`53ab9b8053139ca3eed6ffd73e30da8a`
SHA1	`59a27c580396f2922260f03780206291e21d4c84`
SHA256	`6a7c61dac981032eb5b6eab64068037c2f8b077ca686bdc8d5908ea02340724e`
SHA3	`690e275bd9776585030523e2b318cff705c2176401680196d644790fcaa8e561`
VirtualSize	`0xd85257`
VirtualAddress	`0x1000`
SizeOfRawData	`0x16c00`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.99741`

Imports

KERNEL32.DLL	`LoadLibraryA` `GetProcAddress`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.