Manalyze report for b74ea81d887099b1059995ce17fad93a7176505a6309fa13d164d4e64fb2eda1

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	1970-Jan-01 00:00:00
TLS Callbacks	2 callback(s) detected.

Plugin Output

Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryW`
Malicious	VirusTotal score: 3/71 (Scanned on 2026-09-08 11:09:41)	`APEX: Malicious` `Kaspersky: VHO:Trojan.Win32.Injuke.gen` `Microsoft: Trojan:Win32/Wacatac.B!ml`

Hashes

MD5	`3dfd41235afb22e3e13320962df2035d` 🔍
SHA1	`cfea98ff3dd6d3cc41816269cb5eb66ef1c925e3` 🔍
SHA256	`b74ea81d887099b1059995ce17fad93a7176505a6309fa13d164d4e64fb2eda1` 🔍
SHA3	`cecf16d78b532d6f7b7bb38bde20a071686ba2210c38621a4fcaea293a5689ec` 🔍
SSDeep	`12288:0lDgQK1AHIOPmF9G6fpioxCH6mflLHW2kchh9UORRZ2kw/AUwZPBBgHGHJSCjBO:0l5i9zfUey6E22rn9UOLZCAftGgOWEg` 🔍
Imports Hash	`beff2b01468a2ec811086796ccc886a2` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`9`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x30c00`
SizeOfInitializedData	`0xfde00`
SizeOfUninitializedData	`0xc00`
AddressOfEntryPoint	`0x0000000000001420 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x135000`
SizeOfHeaders	`0x400`
Checksum	`0x1356dc`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`7940bb3f2de63e8ecaa64fe2b4ce3763 🔍`
SHA1	`8b9a9b747127c9a8bfef02341d535d0f89ff093b 🔍`
SHA256	`108d7988b4a0f400302ec6a216c6ddb9d794d4bc6842cb8c6f4c942d582f739c 🔍`
SHA3	`88e2810027e59ee9b8e20d64f2ddc343c4ce9da5f181732d5ac6314f47eaac9c 🔍`
VirtualSize	`0x30b00`
VirtualAddress	`0x1000`
SizeOfRawData	`0x30c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.17589`

.data

MD5	`22f4384e090dfa437cf50417d82ccb01 🔍`
SHA1	`64ff6645951ef81599c13cb1683c6c4ec9e5bbef 🔍`
SHA256	`1fdb3b90470e31345a56a8b9f059822deb52053007dbdee295dbd29a31eaf58a 🔍`
SHA3	`8686b543ca8af7d8c8d995228e33c6ef5b4b51a1d4a42594ec29c988171276f5 🔍`
VirtualSize	`0x390`
VirtualAddress	`0x32000`
SizeOfRawData	`0x400`
PointerToRawData	`0x31000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.26104`

.rdata

MD5	`48cb34ce6e9760740a99a3374c4dd26e 🔍`
SHA1	`8ba11be6e6db710f8ac9a00858ebc8a7727a9194 🔍`
SHA256	`a17ef01abb55639a3fe8d6c3b8978f78d419233238fbaf06bb69a9970662314b 🔍`
SHA3	`5889e8f997cbb8ac440f0c334655a5569583a52b57419187dd0487906bd890fb 🔍`
VirtualSize	`0xf5d98`
VirtualAddress	`0x33000`
SizeOfRawData	`0xf5e00`
PointerToRawData	`0x31400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.194`

.pdata

MD5	`2e35264552d6c991d78b97f868f0c50d 🔍`
SHA1	`926d0beca526d07a91bf47f81ca600d4cacb3829 🔍`
SHA256	`a0ffeba303f4f0482e5f040195c17a95b96afb16304e9720c9d3d469f43291c3 🔍`
SHA3	`1631de4fad0e83ae3e0fa69a94beed09469ea668b8c182da34ff5dbd15f3eb29 🔍`
VirtualSize	`0x31c8`
VirtualAddress	`0x129000`
SizeOfRawData	`0x3200`
PointerToRawData	`0x127200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.51339`

.xdata

MD5	`923147d0fb57886014c6ebb1b3bf85a3 🔍`
SHA1	`41cb4449b4e6093a19032a99585aa3b2fa5b0c12 🔍`
SHA256	`6a21babd664749e441d5be753770d3d412bf2389ff24c03e1e7a19a751a235b0 🔍`
SHA3	`2599811b88be32f4d24a2d16e488e52e052c0f2aeb3feb271c6d8b34011ad971 🔍`
VirtualSize	`0x2a9c`
VirtualAddress	`0x12d000`
SizeOfRawData	`0x2c00`
PointerToRawData	`0x12a400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.29078`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0xb80`
VirtualAddress	`0x130000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`8066c24e19d707c3db9f34bdee8553da 🔍`
SHA1	`7edb201bcca25173b1a2623cf921b3e4362f29e0 🔍`
SHA256	`07fcd041d57fb5a2c36658fb7fe731c02e74d68213c75ba1959a29f0c1ce38db 🔍`
SHA3	`6d21c91c2e33fec5f30889c399d1878719675ef3604da4377e070d6b1307b26d 🔍`
VirtualSize	`0x10b8`
VirtualAddress	`0x131000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x12d000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.94058`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x20`
VirtualAddress	`0x133000`
SizeOfRawData	`0x200`
PointerToRawData	`0x12e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`0479288974470ea703d0be38bf20c931 🔍`
SHA1	`f3df52fa49fb0676de84a875c5df6bfa748e1b21 🔍`
SHA256	`cc20a0a9aa4fab6c2554cea80a47d4d0c8ea3dc63fa377446018112349ae95b5 🔍`
SHA3	`f8650cfb7c8625043b856c3ba407e8975096540d8b481e1b55115d97c3975166 🔍`
VirtualSize	`0x9d8`
VirtualAddress	`0x134000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x12e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.40397`

Imports

GDI32.dll	`CreateFontW` `CreateSolidBrush` `DeleteObject` `SetBkColor` `SetTextColor`
KERNEL32.dll	`CloseHandle` `CreateEventA` `DeleteCriticalSection` `EnterCriticalSection` `FormatMessageA` `GetCPInfo` `GetCurrentThreadId` `GetLastError` `GetLocalTime` `GetModuleHandleA` `GetProcAddress` `GetStartupInfoW` `GetSystemTimeAsFileTime` `GetTickCount` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryW` `LocalFree` `MultiByteToWideChar` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetEvent` `SetUnhandledExceptionFilter` `Sleep` `TlsGetValue` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WaitForSingleObject` `WideCharToMultiByte`
msvcrt.dll	`fwprintf` `__C_specific_handler` `___lc_codepage_func` `___mb_cur_max_func` `__iob_func` `__set_app_type` `__setusermatherr` `__wgetmainargs` `__winitenv` `_amsg_exit` `_cexit` `_commode` `_errno` `_fmode` `_initterm` `_wcmdln` `abort` `atexit` `calloc` `exit` `fflush` `fprintf` `fputc` `fputs` `fputwc` `free` `fwrite` `getenv` `localeconv` `malloc` `memchr` `memcmp` `memcpy` `memmove` `memset` `realloc` `setvbuf` `signal` `strchr` `strcmp` `strerror` `strlen` `strncmp` `strtoul` `towlower` `vfprintf` `wcschr` `wcslen` `_read`
USER32.dll	`CallWindowProcW` `CreateWindowExW` `DefWindowProcW` `DestroyWindow` `DispatchMessageW` `EnableWindow` `FillRect` `GetClientRect` `GetMessageW` `GetWindowTextLengthW` `GetWindowTextW` `IsWindowEnabled` `KillTimer` `LoadCursorW` `LoadIconW` `MoveWindow` `PostQuitMessage` `RegisterClassExW` `SendMessageW` `SetFocus` `SetTimer` `SetWindowLongPtrW` `SetWindowTextW` `ShowWindow` `TranslateMessage` `UpdateWindow`

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData	`0x140133000`
EndAddressOfRawData	`0x140133018`
AddressOfIndex	`0x14013007c`
AddressOfCallbacks	`0x140128d70`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x000000014000DA60` `0x000000014000DA40`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.