ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2012-Jun-28 06:35:26
Detected languages French - France

Plugin Output

Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h)
UPX -> www.upx.sourceforge.net
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
The PE only has 9 import(s).
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Can take screenshots:
  • BitBlt
  • GetDC
Info The PE's resources present abnormal characteristics. Resource 105 is possibly compressed or encrypted.
Resource 106 is possibly compressed or encrypted.
Resource 107 is possibly compressed or encrypted.
Resource 108 is possibly compressed or encrypted.
Resource 111 is possibly compressed or encrypted.
Resource 112 is possibly compressed or encrypted.
Malicious VirusTotal score: 45/68 (Scanned on 2026-09-24 18:02:45) ALYac: Gen:Variant.Application.Keygen.34
APEX: Malicious
AhnLab-V3: HackTool/Win32.Keygen.R103295
Antiy-AVL: RiskWare/Win32.KeyGen
Arcabit: Trojan.Application.Keygen.34
BitDefender: Gen:Variant.Application.Keygen.34
Bkav: W32.Common.D6D2DF11
CAT-QuickHeal: Hacktool.Keygen
CTX: exe.hacktool.keygen
ClamAV: Win.Tool.Genkryptik-9939783-0
CrowdStrike: win/grayware_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/Keygen.HA potentially unsafe application
Elastic: malicious (moderate confidence)
Emsisoft: Gen:Variant.Application.Keygen.34 (B)
Fortinet: Riskware/Generic_PUA_JE
GData: Gen:Variant.Application.Keygen.34
Google: Detected
Ikarus: PUA.Keygen
K7AntiVirus: Unwanted-Program ( 005d476e1 )
K7GW: Unwanted-Program ( 005d476e1 )
Lionic: Hacktool.Win32.Keygen.3!c
Malwarebytes: CrackTool.Agent
McAfeeD: ti!AC2D47DC2D33
MicroWorld-eScan: Gen:Variant.Application.Keygen.34
Microsoft: HackTool:Win32/Keygen
Rising: HackTool.Keygen!1.FD29 (CLOUD)
SUPERAntiSpyware: Hack.Tool/Gen-Keygen
Sangfor: Hacktool.Win32.Keygen.Vp6d
SentinelOne: Static AI - Suspicious PE
Skyhigh: GenericRXAU-LU!EC7D194B3767
Sophos: Generic Reputation PUA (PUA)
Symantec: PUA.Keygen
Trapmine: malicious.high.ml.score
TrellixENS: GenericRXAA-AA!1AF76EF88579
TrendMicro: PUA.Win32.KeyGen.CSAH
TrendMicro-HouseCall: PUA.Win32.KeyGen.CSAH
VIPRE: Gen:Variant.Application.Keygen.34
Varist: W32/Keygen.I.gen!Eldorado
Webroot: W32.Malware.Gen
Xcitium: ApplicUnsaf@#v87mpj5uaevh
Yandex: Trojan.Igent.bVa4PV.8
tehtris: Generic.Malware

Hashes

MD5 1af76ef8857935eb1d8e46dc9cfe3729 🔍
SHA1 73d330be08cb9986defe3175b8116d4a22bf279c 🔍
SHA256 ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21 🔍
SHA3 7f1f98586be78bc272bdb764d50abd85a310ac85db9193f514191bb227cdbfa0 🔍
SSDeep 1536:dYXmTrBviuTlhRFZD4eU8DcHaEDo7Ly6Sy6BxBnQbvM3fnouy8I5:dYXYrhhp1ZDLtGto3g2KPoutI 🔍
Imports Hash c7aaeea671e489e6c9e04d34e80606c1 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2012-Jun-28 06:35:26
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 10.0
SizeOfCode 0x14000
SizeOfInitializedData 0x2000
SizeOfUninitializedData 0x8b000
AddressOfEntryPoint 0x0009E900 (Section: UPX1)
BaseOfCode 0x8c000
BaseOfData 0xa0000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0xa2000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8b000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 0757fecf9d9b3fc90b004e8c1f54f014 🔍
SHA1 da8d2c4205fd6bb3efa63f433b375d72d445cda6 🔍
SHA256 1c1550f3ad04fc62427b8276edd3c8ee55d4064d664d9f9b195b653e072624fb 🔍
SHA3 b5bb4ea7219d602716124584ea3df3b9b1417997a8c248f56aee6f20e56460f0 🔍
VirtualSize 0x14000
VirtualAddress 0x8c000
SizeOfRawData 0x13600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.98592

.rsrc

MD5 8a4a31ab5e52ff45451c26f97c392763 🔍
SHA1 55577f7e4cf7fd3745f4fefa7d88eb8089633199 🔍
SHA256 9dbbaf8eba21bfd01169bddf07f71ef347089e1949db04e61ea79cf381d01a04 🔍
SHA3 62788fc5c76263c598fc04c85152f6cdd98abe57b9d0418b773a1613eb4f1591 🔍
VirtualSize 0x2000
VirtualAddress 0xa0000
SizeOfRawData 0x1a00
PointerToRawData 0x13a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.52231

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
GDI32.dll BitBlt
USER32.dll GetDC
WINMM.dll waveOutOpen

Delayed Imports

105

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x105a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9508
MD5 ca2abe40c4f507acb8e6314df37144a8 🔍
SHA1 e4cb88e3f4c81551abac2e5338bbd67e9c71fb8b 🔍
SHA256 ad4500bba0a49d3e82dd1ccc09870e2d07be50c33438d8d9102f0ff9d08cbb9e 🔍
SHA3 a83cabf85759c60c6a2eed22fc21ca643932a24da91ac2f76dbab4e0d0bb4cde 🔍

106

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x105a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95685
MD5 56fbeb98287ce469603802190966cb66 🔍
SHA1 c35e15c663b19d6d701301eff105643ca74694f8 🔍
SHA256 3da71f3b615e1588988074f7714485e41d151ed2aeda3b9d7662595e02f64488 🔍
SHA3 a2548dd6b62d81e30036fe7460cc48d2386f9a79827ff2b40b61dc58f791cc59 🔍

107

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x105a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96272
MD5 7ef458b5e13a68affcbe6e35f0f34fa8 🔍
SHA1 d6a0600c4f4d63b286365524647dcbe166c54bfc 🔍
SHA256 f409eb7dbf26e0e23ed970f62e45853fefcef254eccce32ed44ecb95e908a9bd 🔍
SHA3 003361e3ab91eba18fa2c5faafb1501e44d651862a8b2b16df4d44e0ef3f60f8 🔍

108

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x105a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95681
MD5 1e958798666328dc1ea8a3892a4af5b2 🔍
SHA1 e74e4417217ba78e2d10a2041115854b518b9aea 🔍
SHA256 d0c945b497f6f5e7c7e3a829755de0ee340aa12c30362ef69c61c0ef05c4626d 🔍
SHA3 f6035fda8393a33c4866830dd93faa211b344703a70f744e0c42915fe0fc4b2a 🔍

111

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x108
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.17446
MD5 09ef0ac6676723386a8e1a5cfa997772 🔍
SHA1 0021898340f3145fb460490a80bd81ed90295f2f 🔍
SHA256 7399a51365d5727675150b9a5b5dce21fc0d53c0e58e854714135f3545574420 🔍
SHA3 c45662fb118a7ec957ccbcd329e6f4b3d34756b5e580a154f7aaedc685ef77ac 🔍

112

Type RT_BITMAP
Language French - France
Codepage UNKNOWN
Size 0x108
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.20615
MD5 6b0f685ee7c5ac6a082e9f7eea1894f9 🔍
SHA1 eabaea0a92825a04f3a68f99c4dd86c109e5289b 🔍
SHA256 e5697cc8d83dbac39dc9ceb91fb5088cff7a7fb737e532279922d70d1699e297 🔍
SHA3 05044c2393a4726eca95ae7eb82eb922e6ec821c4a4ab85da515832c101fb027 🔍

1

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.12903
MD5 dd73cda96ef55266b18f36ac956a5b4b 🔍
SHA1 9f0f2d748ff98d2cde08deb39c901f1361d8619c 🔍
SHA256 7221b64aa005742666bc79b8be1af1379ec1b488f72666e1ff0a6a95469b367e 🔍
SHA3 54072969bc082f965d0c6b32231bce1ca7b34d26456660a02ce5179b0e43bdd2 🔍

2

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.85183
MD5 3d13fe51178218fe89925c8ace6a21ce 🔍
SHA1 ff10ed586129be4824f1180299a69dfd37fc13af 🔍
SHA256 2d4d66b8d9f7e6a6c6e420c7a86598b392f5df84dc0d44c850158aaf4cb8e894 🔍
SHA3 97f567c8675ea8b0db00021dbe34f285c28f7e25fa050091bc15bf7fb9854dc0 🔍

101

Type RT_DIALOG
Language French - France
Codepage UNKNOWN
Size 0x228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

103

Type RT_GROUP_ICON
Language French - France
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.21059
Detected Filetype Icon file
MD5 86561693760b088960969f3b7654507a 🔍
SHA1 82368be1644244e0fd66f1d737b3d45d26b2218f 🔍
SHA256 b1a9ff73f6a9d486c67f409a629924792ca40aa8966d45e48239863f63629fd0 🔍
SHA3 206e8d2db4680b7736ddcf7885984ca26fa1a66e72ec9073e8052ba82ea94408 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xc84b23f0
Unmarked objects 0
C objects (VS2010 SP1 build 40219) 66
19 (8034) 2
175 (VS2010 SP1 build 40219) 27
Unmarked objects (#2) 1
C objects (VS2008 SP1 build 30729) 1
Imports (VS2008 SP1 build 30729) 7
Total imports 115
C++ objects (VS2010 SP1 build 40219) 21
ASM objects (VS2010 SP1 build 40219) 18
Resource objects (VS2010 SP1 build 40219) 1
Linker (VS2010 SP1 build 40219) 1

Errors

[*] Warning: Ignored an invalid IMAGE_RESOURCE_DATA_ENTRY [*] Warning: Section UPX0 has a size of 0! [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory. [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Bitmap is malformed! [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory. [*] Warning: Resource is empty! [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 101 is bigger than the PE. Not trying to load it in memory.
Leave a comment

No comments yet.