b1bcfe3c5f901771afba23087cc50e94a36e4b90c5cf0bc1a83f692b41f423a9
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jun-09 15:57:32 |
| Detected languages |
English - United States
Spanish - Mexico |
Plugin Output
| Suspicious | The PE is possibly packed. |
Unusual section name found: .:go
Unusual section name found: .IZY Unusual section name found: .vzq |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 51/71 (Scanned on 2026-10-19 03:35:40) |
ALYac:
Trojan.GenericKD.80631190
APEX: Malicious AVG: Win64:Evo-gen [Trj] AhnLab-V3: Trojan/Win.Generic.R792691 Alibaba: Packed:Win32/VMProtect.e4a1f88c Arcabit: Trojan.Generic.D4CE5596 Avast: Win64:Evo-gen [Trj] Avira: TR/W64.Evo BitDefender: Trojan.GenericKD.80631190 Bkav: W32.Malware.9F66B799 CTX: exe.trojan.vmprotect CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win32/Packed.VMProtect.ACT trojan Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.80631190 (B) F-Secure: Trojan.TR/W64.Evo Fortinet: W32/PossibleThreat GData: Trojan.GenericKD.80631190 Google: Detected Gridinsoft: Trojan.Heur!.02292023 Ikarus: Trojan.Win32.VMProtect K7AntiVirus: Riskware ( 005cde091 ) K7GW: Riskware ( 005cde091 ) Kaspersky: Trojan.Win64.Agent.smgosg Lionic: Trojan.Win32.VMProtect.4!c Malwarebytes: Trojan.Crypt MaxSecure: Trojan.Malware.692078550.susgen McAfeeD: Real Protect-LS!185D48B4C50D MicroWorld-eScan: Trojan.GenericKD.80631190 Microsoft: Trojan:Win32/Kepavll!rfn Paloalto: generic.ml Panda: Trj/PhxGD.A Rising: Trojan.Kryptik@AI.88 (RDML:HwGaUQi46/V/YHrzi8/lGg) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win64.Dropper.wc Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Win64.Trojan.Agent.Zolw TrellixENS: Artemis!185D48B4C50D TrendMicro: Trojan.Win32.ZYX.USBLGK26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLGK26 VIPRE: Trojan.GenericKD.80631190 Varist: W64/ABTrojan.NFMC-4560 ViRobot: Trojan.Win.Z.Wacatac.7850496 Zillya: Trojan.VMProtect.Win32.154841 alibabacloud: VirTool:Win/Wacatac.B9nj tehtris: Generic.Malware |
Hashes
| MD5 | 185d48b4c50d12c66c05ec2a1c6c376d 🔍 |
|---|---|
| SHA1 | 0820124646d3618575edacfda63847761988bd35 🔍 |
| SHA256 | b1bcfe3c5f901771afba23087cc50e94a36e4b90c5cf0bc1a83f692b41f423a9 🔍 |
| SHA3 | b69d7c95eb73f2828061f90300cf70e344f9c8412838b9dca7dd78cf7d08576b 🔍 |
| SSDeep | 196608:NH3BQXMBDjTPiT3m8jlk4M+W7gp/EyRqgF0H5b/zn8twJGS/D:NH3BqMB7PiTFjah+/2g+Rn84bD 🔍 |
| Imports Hash | a28e51c8205d42205f7b4d957b453e3a 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Jun-09 15:57:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1e600 |
| SizeOfInitializedData | 0x1d200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000008AE259 (Section: .vzq) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xf9b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1e51c |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xa112 |
| VirtualAddress | 0x20000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x1168 |
| VirtualAddress | 0x2b000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.pdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xe94 |
| VirtualAddress | 0x2d000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.:go
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x7efc9a |
| VirtualAddress | 0x2e000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.IZY
| MD5 | 52c98ffb1712d458f21ee0e6026dd4f8 🔍 |
|---|---|
| SHA1 | 838ddd72c97174d4a381eccf462f44aa6c0d342f 🔍 |
| SHA256 | 60f0e0f78e8d9ea5602efde5eb51ca2569dfa0cee0ed0223e6917235259a58cd 🔍 |
| SHA3 | 41e3c7b1fb5c1a8bd89781d88733849dc6e1379a25ac82eb333c2764e6629fda 🔍 |
| VirtualSize | 0xd48 |
| VirtualAddress | 0x81e000 |
| SizeOfRawData | 0xe00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.293919 |
.vzq
| MD5 | 9da77d07e5989a491d620d7b4fdd1acc 🔍 |
|---|---|
| SHA1 | 8392363aaee80f3c139716adf6413c23803633dd 🔍 |
| SHA256 | 2e9f2817335e7435c3589d2712866e573d72e905f54c7e672c070afe79755c8b 🔍 |
| SHA3 | 545011e8d3087cbf41e6697eae9481640950ba05081eb994c84456fee0da3c46 🔍 |
| VirtualSize | 0x76aad0 |
| VirtualAddress | 0x81f000 |
| SizeOfRawData | 0x76ac00 |
| PointerToRawData | 0x1200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
|
| Entropy | 7.94633 |
.rsrc
| MD5 | 1e65ce6c68c6fd0a6909ad3e691ef460 🔍 |
|---|---|
| SHA1 | ebe5941b6ef712d2a93dba1adf33a4c9a231b2a8 🔍 |
| SHA256 | fbca63e5b4a1fa2c22f9b1ba71aa955f249a6405db2f4672a73f8d9d85c01fab 🔍 |
| SHA3 | 45e3a76697290d68eec25f45ebff36774d61ecc93171092c9ebe0edb3e7f6e19 🔍 |
| VirtualSize | 0x10ab0 |
| VirtualAddress | 0xf8a000 |
| SizeOfRawData | 0x10c00 |
| PointerToRawData | 0x76be00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.52704 |
Imports
| KERNEL32.dll |
InitializeCriticalSectionEx
|
|---|---|
| USER32.dll |
ShowWindow
|
| ADVAPI32.dll |
RegSetValueExW
|
| SHELL32.dll |
ShellExecuteA
|
| MSVCP140.dll |
?good@ios_base@std@@QEBA_NXZ
|
| WINHTTP.dll |
WinHttpQueryHeaders
|
| SHLWAPI.dll |
PathFileExistsA
|
| ntdll.dll |
RtlCaptureContext
|
| urlmon.dll |
URLDownloadToFileA
|
| VCRUNTIME140.dll |
__C_specific_handler
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_cexit
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__p__commode
|
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
|
| api-ms-win-crt-time-l1-1-0.dll |
_time64
|
| api-ms-win-crt-environment-l1-1-0.dll |
getenv
|
| api-ms-win-crt-string-l1-1-0.dll |
_wcsicmp
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| KERNEL32.dll (#2) |
InitializeCriticalSectionEx
|
| USER32.dll (#2) |
ShowWindow
|
| KERNEL32.dll (#3) |
InitializeCriticalSectionEx
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | Spanish - Mexico |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.52266 |
| MD5 | 6da3e4b3aa0b2873c03bb97d64ad8ebb 🔍 |
| SHA1 | 464f2a6fcbe80cd445728630ee657fa0bef3b36a 🔍 |
| SHA256 | 5c0b5cd377c5a9ff638081589adf7374f571d7124331079f90dfcb32b025dc58 🔍 |
| SHA3 | bfc331a8f763fa829e1808249bfe190361cc6bb75fcb9c9747970adac8634ce2 🔍 |
102
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Spanish - Mexico |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.98048 |
| Detected Filetype | Icon file |
| MD5 | 38388dda6548693f4d42f2241a4218d7 🔍 |
| SHA1 | 78bedd12a20f97e31e58742381f3d0ca1edb4715 🔍 |
| SHA256 | cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba 🔍 |
| SHA3 | 9ace1e9f008d60580379cdfdcd4119706c82d52d2e5fdb9e5745fa00864cc1a8 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x188 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.89623 |
| MD5 | b8e76ddb52d0eb41e972599ff3ca431b 🔍 |
| SHA1 | fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍 |
| SHA256 | 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍 |
| SHA3 | 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍 |
Version Info
TLS Callbacks
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14002b580 |
RICH Header
Errors
[!] Error: Could not read the exported DLL name.
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .pdata has a size of 0!
[*] Warning: Section .:go has a size of 0!
Leave a comment
No comments yet.