b34bf631c79616a56840243b51c387e9

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-Jan-03 19:04:34
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
Suspicious The PE is possibly packed. Unusual section name found: .EMP0
Unusual section name found: .data2
Section .data2 is both writable and executable.
Unusual section name found: .EMP
Section .EMP is both writable and executable.
Unusual section name found: .data3
Section .data3 is both writable and executable.
Unusual section name found: .EMP1
Unusual section name found: .xdata0
Unusual section name found: .link0
Unusual section name found: .bss0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Malicious VirusTotal score: 16/64 (Scanned on 2022-01-15 06:44:53) Lionic: Riskware.Win32.Generic.1!c
Zillya: Tool.Crack.Win64.272
Sangfor: Riskware.Win32.Uwamson.A
CrowdStrike: win/malicious_confidence_80% (D)
ESET-NOD32: a variant of Win64/HackTool.Crack.Q potentially unsafe
APEX: Malicious
McAfee-GW-Edition: BehavesLike.Win64.Drixed.th
FireEye: Generic.mg.b34bf631c79616a5
Jiangmin: Trojan.Agent.ddzp
Microsoft: Program:Win32/Uwamson.A!ml
Gridinsoft: Trojan.Heur!.030120A2
Cynet: Malicious (score: 100)
McAfee: Artemis!B34BF631C796
Cylance: Unsafe
SentinelOne: Static AI - Suspicious PE
Fortinet: Malicious_Behavior.SB

Hashes

MD5 b34bf631c79616a56840243b51c387e9
SHA1 770274ab7c150ae9bb41b4108b8629e1b90e53df
SHA256 ff3d7e7cd6deabaaf8879e8a721edd3846187b8cc16bfff2ddc7f9a8f06f0207
SHA3 28cf5f66fd8cba94599b2baf0a2684345d3423539ee0429f2f590ed8da00cef0
SSDeep 98304:Hs/8wGhMqRMEC8E2HhbIJ/Oxyc/bOk85KnPPfXOJ+XEs4N3fw4+u:HW8r+MCJ2HhbYIycSkKqXE/bN
Imports Hash fc7124d57387852c0a6a634e9130bf57

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 14
TimeDateStamp 2022-Jan-03 19:04:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xe00
SizeOfInitializedData 0x1200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001334 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x13000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x5bd000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 52d6d933264220eda5a1c8fefc054d6f
SHA1 ede1d0b8abe3c8014d7cd09fb71758d1b462acc3
SHA256 fcc14da8f8f847dbc6127ac88c10255c1216b7eb4eb895a32d9a357da314dacd
SHA3 90339f6c466fd03e5adabccfb2a81c0188925fd1b3d7d765f413e48d5eea34c2
VirtualSize 0x1000
VirtualAddress 0x1000
SizeOfRawData 0xe00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.34675

.rdata

MD5 efb26df81e4ea03366bdc6486a375e40
SHA1 edfd75823a72977c71ccdd4553ba2134e7cf513e
SHA256 877b5614001972f4888acff3a61362b4e4b07b68282f223ae561232c7da9dddb
SHA3 67f2c281c31216b9c89e76ae468dbd608fb4f4d199b4e12d23b7dbe603f4334e
VirtualSize 0x1000
VirtualAddress 0x2000
SizeOfRawData 0xc00
PointerToRawData 0x1200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.61596

.data

MD5 3e54b380c18e9fb1c3756c3724029e08
SHA1 0f1996f23c3d9f0eade51a4d288298e0aaaf665d
SHA256 cca157ab973ce99579d97517d68d2d036aae50034b86982cd5e09b6fc86d84f6
SHA3 2716a15b313e463c0d4321c714502b1627f69b525da6ab6aa9d1f64cdb8b92d5
VirtualSize 0x1000
VirtualAddress 0x3000
SizeOfRawData 0x200
PointerToRawData 0x1e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.449786

.pdata

MD5 62c34f4a4314693cdbe791e660e7d2f3
SHA1 24bba83977f957abdd452c8e60be8f7700df7a05
SHA256 693e250160fec66bb334af5e7ac1b96cf0cba1406fede9713fbbdef75b2941b0
SHA3 34f8778788bc67c2f7261a24d53f270b2f2e3d89e7976a8d95077aee9467b32d
VirtualSize 0x1000
VirtualAddress 0x4000
SizeOfRawData 0x200
PointerToRawData 0x2000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.94608

.EMP0

MD5 5a78467bf87ec2ff261fd2a88b884dd9
SHA1 617b1d953adbffa223d0fe8402367021a4320041
SHA256 c85384e76aa1e23d540c2e44ce8db7661850f4927239257ec431922b68a8a512
SHA3 09b2859acbd198a21be20941de3bb832943effe050b1e6b4fdf0c6744476b957
VirtualSize 0x1000
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x2200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.33736

.data2

MD5 5952c45bafcf261dcae5714d30649dfe
SHA1 49359e387fc7b8fba985ee1703c539dad18adf55
SHA256 0137ec165f55305774989cac55f1b9d75fbc1a72765ecb73c0f79c8cd7ac9185
SHA3 13c40d948bbf3f2ba98652f753cd111dcdb07286b767b5d4df8213439e32d1c2
VirtualSize 0x17000
VirtualAddress 0x6000
SizeOfRawData 0x17000
PointerToRawData 0x2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.38382

.EMP

MD5 61ae7b85a18404cc5ac43074e67f155c
SHA1 b9692368fdb552636b1262049fc231a3c599ef2c
SHA256 a56562bd8fed31b6058ee4142b527fa0d95e370e8affc77aa23322be160237b9
SHA3 a8bc0bc1a2a8353ea25d2e7e45c900801ff65d6c842bd21d9c06f0e200004048
VirtualSize 0x33000
VirtualAddress 0x1d000
SizeOfRawData 0x33000
PointerToRawData 0x19400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.08105

.data3

MD5 d570a4f0ef6700899eda2e761a864d42
SHA1 8cefb35af7f046ca40991c4afcacf2847aa792ec
SHA256 8159649067af8bfb4a095cc319630d3860a259ab15e78b0c7702bf9687198152
SHA3 430cd4618da67842be313b6738777a60e0a9e946e4f15a600b7d7dac97339758
VirtualSize 0x99000
VirtualAddress 0x50000
SizeOfRawData 0x99000
PointerToRawData 0x4c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.08788

.EMP1

MD5 8d4124fdf0067013f3735421978345d3
SHA1 bd70549aa60b375bd689aa3c9d4216107515f7a6
SHA256 4ed7ab4e8fdaad641d4fcc3914eb6f46882917c3fb5d19c0dee5b5cb3fe3c550
SHA3 88524eda2871ae18236306eaaf74f182ef8b674016424916d40311e13df5ca58
VirtualSize 0x1d5754
VirtualAddress 0xe9000
SizeOfRawData 0x1d5800
PointerToRawData 0xe5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.53803

.xdata0

MD5 a5bf9d6df1b20b64904ba05c8da5fb14
SHA1 2c1d3276a61505d304fff0e24850264f6b594d02
SHA256 dffc2cd8a2203e5433e731ffba02b13647ca89e650b638338481f4722d92c633
SHA3 3c40d7fc0646c373ae5386a949d6750b8b3359bd721b17c1cbc1720c2ef22f00
VirtualSize 0xfd5b4
VirtualAddress 0x2bf000
SizeOfRawData 0xfd600
PointerToRawData 0x2bac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 6.84647

.link0

MD5 0f87b9f6c69816f47098cbaec3c3f224
SHA1 0a9acb7fdc5ef9caff5ac8ec4efcbe0f23efa66b
SHA256 4631432f0577fe2d2f64f5507b0d0757dd876492322c0dd5aa32401dfabb0f75
SHA3 2f3583d6b80132ee78f4e9d33bbb4ed93ff55b22e1988fb0f649a1a8b23c29cb
VirtualSize 0x100224
VirtualAddress 0x3bd000
SizeOfRawData 0x100400
PointerToRawData 0x3b8200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 6.81903

.bss0

MD5 4b28bb32e111ed6bdc10dfc78b2de032
SHA1 67d4ccf449ada9718df4dc772d3369463842c534
SHA256 512f30805706a3493bd7a310f439c51a7189e52244b3ef8235595537bda69660
SHA3 447f755bfa3b3f7e7bd1a099a298596c290c6bbc80919c0baa49b8ce34b2f17b
VirtualSize 0xfc254
VirtualAddress 0x4be000
SizeOfRawData 0xfc400
PointerToRawData 0x4b8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 6.81771

.reloc

MD5 f2d249f93aeefff9ab9afc4bea44b46f
SHA1 102ec2bc6e583154109bc5279001e53228757942
SHA256 54a5169a7c68886826c0acabe2a8972b7e8e570ef256021bb7523d192a77cfa9
SHA3 8f26fc4adc0e148378f8a577664a887a3526b8eefe938885dbdf115ccfbe3d0a
VirtualSize 0x288
VirtualAddress 0x5bb000
SizeOfRawData 0x400
PointerToRawData 0x5b4a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.94399

.rsrc

MD5 8a8f316bece15d128562f1f6594b5fd9
SHA1 1ce83e737ee9f90ce9d29a26a153d3b8332780b4
SHA256 7cc415a1288ad04577b9fca4b0a085b66d663702d992ee37d2889d8034c13c04
SHA3 173f154040c8a211f1e1125814f47b54f395cdb36848ca2f73f5d3a2b630b275
VirtualSize 0xe9
VirtualAddress 0x5bc000
SizeOfRawData 0x200
PointerToRawData 0x5b4e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.5313

Imports

KERNEL32.dll IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsProcessorFeaturePresent
LoadLibraryA
UnhandledExceptionFilter
GetProcAddress
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Delayed Imports

EMP

Ordinal 1
Address 0x1010

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8858
MD5 f7ad1eab748bc07570a57ec87787cf90
SHA1 0b1608da9fef218386e825db575c65616826d9f4
SHA256 d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04
SHA3 6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a

Version Info

TLS Callbacks

Load Configuration

Size 0x130
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x13003010

RICH Header

Errors

<-- -->