| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2018-Feb-01 20:18:00 |
| Detected languages |
English - United States
|
| FileDescription | Run As Administrator |
| CompanyName | n1kobg.blogspot.com |
| LegalTrademarks | n1kobg⢠|
| LegalCopyright | © 2019 n1kobg |
| Comments | Run As Administrator |
| Info | Matching compiler(s): | MASM/TASM - sig2(h) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. |
Resource AA038496EBB6CD40BDB4C397AAC42D4C446F106F is possibly compressed or encrypted.
Resources amount for 76.4078% of the executable. |
| Info | The PE is digitally signed. |
Signer: n1kobg
Issuer: n1kobg |
| Malicious | VirusTotal score: 51/72 (Scanned on 2025-07-29 06:43:55) |
ALYac:
Trojan.Generic.38328978
APEX: Malicious AVG: Win32:Malware-gen AhnLab-V3: Malware/Gen.Generic.C3144418 Alibaba: TrojanDropper:Win32/Dapato.64a6e802 Arcabit: Trojan.Generic.D248DA92 Avast: Win32:Malware-gen BitDefender: Trojan.Generic.38328978 Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.171483479498794f CTX: exe.trojan.dapato ClamAV: Win.Ransomware.Lockbit-9951835-0 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: a variant of Generik.DUKAQXY Elastic: malicious (high confidence) Emsisoft: Trojan.Generic.38328978 (B) Fortinet: W32/Dapato.PNFH!tr GData: Trojan.Generic.38328978 Google: Detected Gridinsoft: Trojan.Win32.CoinMiner.vb!s1 Ikarus: Trojan.SuspectCRC K7AntiVirus: Trojan ( 0055b8641 ) K7GW: Trojan ( 0055b8641 ) Kaspersky: Trojan-Dropper.Win32.Dapato.pnfh Kingsoft: malware.kb.a.999 Lionic: Trojan.Win32.Dapato.b!c Malwarebytes: Generic.Malware.AI.DDS MaxSecure: Trojan.Malware.1728101.susgen McAfeeD: ti!ADF3060CFEBA MicroWorld-eScan: Trojan.Generic.38328978 Microsoft: Trojan:Win32/Kepavll!rfn NANO-Antivirus: Trojan.Win32.Dapato.jrnqfq Paloalto: generic.ml Panda: Trj/CI.A Rising: Dropper.Dapato!8.2A2 (CLOUD) Sangfor: Trojan.Win32.Save.a Skyhigh: Artemis!Trojan Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.14364b06 Trapmine: malicious.moderate.ml.score TrellixENS: Artemis!5DB410A95668 VBA32: TrojanDropper.Dapato VIPRE: Trojan.Generic.38328978 Varist: W32/ABTrojan.YPMP-8545 Xcitium: Malware@#3t8keumuupyoh Zoner: Trojan.Win32.73853 alibabacloud: Trojan[dropper]:Win/Kepavll.Gen huorong: Trojan/Generic!F5C4E02B920CE789 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2018-Feb-01 20:18:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x10800 |
| SizeOfInitializedData | 0x4d400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: .code) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x12000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x61000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x602be |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MSVCRT.dll |
memset
wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc |
|---|---|
| KERNEL32.dll |
GetModuleHandleW
HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject |
| USER32.DLL |
CharUpperW
CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos |
| GDI32.DLL |
GetStockObject
|
| COMCTL32.DLL |
InitCommonControlsEx
|
| SHELL32.DLL |
ShellExecuteExW
SHGetFolderLocation SHGetPathFromIDListW |
| WINMM.DLL |
timeBeginPeriod
|
| OLE32.DLL |
CoInitialize
CoTaskMemFree |
| SHLWAPI.DLL |
PathAddBackslashW
PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags |
VS_FF_DEBUG
VS_FF_PRERELEASE
VS_FF_PRIVATEBUILD
|
| FileOs |
VOS_DOS
VOS_DOS_WINDOWS16
VOS_DOS_WINDOWS32
VOS_OS232
VOS_OS232_PM32
VOS_WINCE
VOS__PM32
VOS__WINDOWS16
|
| FileType |
VFT_APP
|
| Language | English - United States |
| FileDescription | Run As Administrator |
| CompanyName | n1kobg.blogspot.com |
| LegalTrademarks | n1kobg⢠|
| LegalCopyright | © 2019 n1kobg |
| Comments | Run As Administrator |
| Resource LangID | UNKNOWN |
|---|
No comments yet.