b42bd1b909f55056dd95ba32655d405a
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Apr-01 05:06:41 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
C:\Users\DEV\Desktop\SNAILXV2\SNAILX\build\SNAILX.pdb
|
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Accesses the WMI:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 16/72 (Scanned on 2025-04-02 14:08:42) |
ALYac:
Gen:Variant.Lazy.672958
AhnLab-V3: Malware/Win.Generic.R697394 Arcabit: Trojan.Lazy.DA44BE BitDefender: Gen:Variant.Lazy.672958 CTX: exe.unknown.lazy CrowdStrike: win/malicious_confidence_70% (D) DeepInstinct: MALICIOUS Emsisoft: Gen:Variant.Lazy.672958 (B) FireEye: Gen:Variant.Lazy.672958 GData: Gen:Variant.Lazy.672958 Malwarebytes: Malware.AI.252379513 McAfee: Artemis!B42BD1B909F5 MicroWorld-eScan: Gen:Variant.Lazy.672958 Trapmine: suspicious.low.ml.score TrendMicro-HouseCall: TROJ_GEN.R002H09D125 VIPRE: Gen:Variant.Lazy.672958 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2025-Apr-01 05:06:41 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x341e00 |
| SizeOfInitializedData | 0x381a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000309BB8 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x6c6000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
Imports
| d3d9.dll |
Direct3DCreate9
|
|---|---|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute |
| WS2_32.dll |
getsockname
ioctlsocket ntohs select gethostbyname WSAStartup WSACleanup WSAGetLastError htonl getsockopt htons sendto recvfrom getpeername shutdown socket setsockopt connect closesocket send recv WSASetLastError getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr |
| CRYPT32.dll |
CertCloseStore
CertFindCertificateInStore CertFreeCertificateContext CertOpenSystemStoreW |
| KERNEL32.dll |
CompareStringW
FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateThread SetFilePointerEx GetConsoleOutputCP LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter HeapFree GetCurrentProcess SetProcessInformation OutputDebugStringA CreateMutexW InitializeCriticalSectionEx HeapSize SetProcessMitigationPolicy GetLastError GetCurrentThread DeleteFileA HeapReAlloc HeapAlloc DecodePointer HeapDestroy GetThreadContext DeleteCriticalSection ExitProcess GetProcessHeap IsDebuggerPresent CheckRemoteDebuggerPresent ReadFile CreatePipe PeekNamedPipe WaitForSingleObject Sleep CloseHandle CreateProcessW CreateDirectoryW GetModuleFileNameA SizeofResource TerminateProcess GetModuleFileNameW OpenProcess CreateToolhelp32Snapshot Process32NextW LockResource DeleteFileW Process32FirstW LoadResource FindResourceW SetFileAttributesA GetCurrentDirectoryW GetCurrentProcessId CopyFileW WideCharToMultiByte CreateDirectoryA GetSystemTime GetVolumeInformationW GetComputerNameW GlobalMemoryStatusEx WriteProcessMemory K32GetProcessMemoryInfo GetSystemInfo Module32FirstW VirtualProtectEx ReadProcessMemory Module32NextW VirtualQueryEx ReleaseMutex GetModuleHandleW CreateSemaphoreExW SetLastError ReleaseSemaphore GetModuleHandleExW GetCurrentThreadId FlushFileBuffers OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW DebugBreak GetStdHandle GetFileType WriteFile MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FormatMessageA RtlVirtualUnwind GetEnvironmentVariableW GetSystemTimeAsFileTime VirtualProtect VirtualFree GetACP InitializeCriticalSection GetExitCodeThread CreateSemaphoreA LoadLibraryW SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FreeLibraryWhenCallbackReturns RtlPcToFileHeader GetStringTypeW GetTickCount64 TryAcquireSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateFileW GetLocaleInfoEx LocalFree InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualQuery SetStdHandle SetEndOfFile GetFileSizeEx GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork InitOnceComplete InitOnceBeginInitialize RaiseException FormatMessageW RtlUnwind RtlUnwindEx GetCPInfo LCMapStringEx EncodePointer |
| USER32.dll |
CreateWindowExW
CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow DispatchMessageW PeekMessageW SetWindowTextA DestroyMenu TranslateMessage LoadIconW AppendMenuW DestroyWindow UpdateWindow SetForegroundWindow LoadImageW GetWindowRect DefWindowProcW MessageBoxW UnregisterClassW MessageBoxA GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos RegisterClassW PostMessageW GetProcessWindowStation GetUserObjectInformationW SetWindowPos PostQuitMessage |
| ADVAPI32.dll |
RegOpenKeyExA
RegCreateKeyExA CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey RegQueryValueExA RegSetValueExA |
| SHELL32.dll |
#680
ShellExecuteA Shell_NotifyIconW SHGetFolderPathA SHGetKnownFolderPath ShellExecuteW ShellExecuteExA |
| ole32.dll |
CoUninitialize
CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoTaskMemFree CoCreateInstance CoInitialize |
| OLEAUT32.dll |
VariantClear
SysAllocString SysFreeString |
| dxgi.dll |
CreateDXGIFactory
|
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| WININET.dll |
InternetReadFile
InternetCloseHandle InternetOpenA InternetOpenUrlA DeleteUrlCacheEntryA |
| WebView2Loader.dll (delay-loaded) |
CreateCoreWebView2EnvironmentWithOptions
|
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | WebView2Loader.dll |
| ModuleHandle | 0x5933e0 |
| DelayImportAddressTable | 0x5933d0 |
| DelayImportNameTable | 0x451ba0 |
| BoundDelayImportTable | 0x451be0 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
OPENSSL_Applink
| Ordinal | 1 |
|---|---|
| Address | 0x12acc0 |
102
103
1
101
1 (#2)
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Apr-01 05:06:41 |
| Version | 0.0 |
| SizeofData | 78 |
| AddressOfRawData | 0x430af0 |
| PointerToRawData | 0x42fcf0 |
| Referenced File | C:\Users\DEV\Desktop\SNAILXV2\SNAILX\build\SNAILX.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Apr-01 05:06:41 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x430b40 |
| PointerToRawData | 0x42fd40 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Apr-01 05:06:41 |
| Version | 0.0 |
| SizeofData | 1264 |
| AddressOfRawData | 0x430b54 |
| PointerToRawData | 0x42fd54 |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Apr-01 05:06:41 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
| StartAddressOfRawData | 0x140431090 |
|---|---|
| EndAddressOfRawData | 0x1404317cc |
| AddressOfIndex | 0x140595bb8 |
| AddressOfCallbacks | 0x140343af0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_16BYTES
|
| Callbacks |
0x00000001403097A0
0x0000000140309808 |
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140457340 |
RICH Header
| XOR Key | 0x282616e7 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (27412) | 14 |
| C++ objects (27412) | 195 |
| ASM objects (34321) | 12 |
| C objects (34321) | 19 |
| C++ objects (34321) | 115 |
| C objects (27412) | 24 |
| C objects (CVTCIL) (27412) | 2 |
| C objects (34123) | 744 |
| Unmarked objects (#2) | 35 |
| Imports (27412) | 29 |
| Total imports | 353 |
| C++ objects (LTCG) (34808) | 20 |
| Exports (34808) | 1 |
| Resource objects (34808) | 1 |
| 151 | 1 |
| Linker (34808) | 1 |