b1ce138f5546e860f42e0260e8fe1d562df7d8a16bd9bf38abefb04aa0d24a86
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2022-Mar-05 14:29:39 |
| TLS Callbacks | 1 callback(s) detected. |
| Comments | Automotive Diagnostics Software |
| CompanyName | RenOLink |
| FileDescription | RenOLink |
| FileVersion | 1.99.0.0 |
| InternalName | RenOLink.exe |
| LegalCopyright | Gabriel Gafu (gabigafu@hotmail.com) |
| LegalTrademarks | |
| OriginalFilename | RenOLink.exe |
| ProductName | RenOLink |
| ProductVersion | 1.99.0.0 |
| Assembly Version | 1.99.0.0 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Suspicious | The PE is packed with Enigma Protector |
Unusual section name found: \x10UPLE\x0c/J
Section \x10UPLE\x0c/J is both writable and executable. Unusual section name found: Unusual section name found: .enigma1 Section .enigma1 is both writable and executable. Unusual section name found: .enigma2 Section .enigma2 is both writable and executable. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 42/72 (Scanned on 2025-04-24 10:33:10) |
ALYac:
Gen:Trojan.Heur.GM.0000164080
APEX: Malicious AVG: Win32:Malware-gen Antiy-AVL: Trojan/MSIL.Agent Arcabit: Trojan.Heur.GM.D280F0 Avast: Win32:Malware-gen BitDefender: Gen:Trojan.Heur.GM.0000164080 Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.17452421638f8325 CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Emsisoft: Gen:Trojan.Heur.GM.0000164080 (B) Fortinet: W32/PossibleThreat GData: Gen:Trojan.Heur.GM.0000164080 Google: Detected Gridinsoft: Trojan.Win32.Downloader.ns Ikarus: Trojan.MSIL.Agent Kingsoft: malware.kb.b.848 Lionic: Trojan.Win32.VBKrypt.lwdw Malwarebytes: Malware.AI.190847018 MaxSecure: Trojan.Malware.9177172.susgen McAfee: Artemis!838D0FA9E39F McAfeeD: ti!B1CE138F5546 MicroWorld-eScan: Gen:Trojan.Heur.GM.0000164080 Paloalto: generic.ml Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Generic.vc Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrendMicro-HouseCall: TROJ_GEN.R002H09CO25 VBA32: Trojan.Packed.Enigma VIPRE: Gen:Trojan.Heur.GM.0000164080 Varist: W32/ABTrojan.DTWJ-7257 Webroot: W32.Adware.Gen alibabacloud: Trojan tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 2022-Mar-05 14:29:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0xc200 |
| SizeOfInitializedData | 0x23de00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0024E00A (Section: ) |
| BaseOfCode | 0x23c000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x29a000 |
| SizeOfHeaders | 0x2000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x200000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
\x10UPLE\x0c/J
.text
.rsrc
Section_4
.reloc
.enigma1
.enigma2
Imports
| kernel32.dll |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle |
|---|---|
| user32.dll |
GetKeyboardType
LoadStringA MessageBoxA CharNextA |
| advapi32.dll |
RegQueryValueExA
RegOpenKeyExA RegCloseKey |
| oleaut32.dll |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
| kernel32.dll (#2) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle |
| advapi32.dll (#2) |
RegQueryValueExA
RegOpenKeyExA RegCloseKey |
| kernel32.dll (#3) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle |
| user32.dll (#2) |
GetKeyboardType
LoadStringA MessageBoxA CharNextA |
| kernel32.dll (#4) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle |
| kernel32.dll (#5) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle |
| ole32.dll |
CreateStreamOnHGlobal
CoUninitialize CoInitialize |
| oleaut32.dll (#2) |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
| oleaut32.dll (#3) |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
| ntdll.dll |
RtlInitUnicodeString
RtlFreeUnicodeString RtlFormatCurrentUserKeyPath RtlDosPathNameToNtPathName_U |
| SHFolder.dll |
SHGetFolderPathW
SHGetFolderPathA |
| ntdll.dll (#2) |
RtlInitUnicodeString
RtlFreeUnicodeString RtlFormatCurrentUserKeyPath RtlDosPathNameToNtPathName_U |
| shlwapi.dll |
PathMatchSpecW
|
| ntdll.dll (#3) |
RtlInitUnicodeString
RtlFreeUnicodeString RtlFormatCurrentUserKeyPath RtlDosPathNameToNtPathName_U |
Delayed Imports
1
2
3
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.99.0.0 |
| ProductVersion | 1.99.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | Automotive Diagnostics Software |
| CompanyName | RenOLink |
| FileDescription | RenOLink |
| FileVersion (#2) | 1.99.0.0 |
| InternalName | RenOLink.exe |
| LegalCopyright | Gabriel Gafu (gabigafu@hotmail.com) |
| LegalTrademarks | |
| OriginalFilename | RenOLink.exe |
| ProductName | RenOLink |
| ProductVersion (#2) | 1.99.0.0 |
| Assembly Version | 1.99.0.0 |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x652018 |
|---|---|
| EndAddressOfRawData | 0x652040 |
| AddressOfIndex | 0x652040 |
| AddressOfCallbacks | 0x652044 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x00689128
|
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.