c28fe13421189718e6a67128b37fb8006fe45eb3aed000696b21da16301a39dd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-May-26 19:09:03

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .xdata
Unusual section name found: .C<&
The PE only has 3 import(s).
Info The PE is digitally signed. Signer: voices38
Issuer: voices38
Malicious VirusTotal score: 13/69 (Scanned on 2026-07-15 17:02:37) Antiy-AVL: Trojan/Win32.Ravartar
Bkav: W32.Malware.4F4CB6AD
CrowdStrike: win/malicious_confidence_70% (D)
Cynet: Malicious (score: 100)
Elastic: malicious (moderate confidence)
Fortinet: W32/PossibleThreat
Google: Detected
Gridinsoft: Malware.Win64.Gen.cl
K7GW: Riskware ( 006e2ce81 )
TrellixENS: Artemis!3DAE5E50ED9D
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101FO26ZT
Webroot: W32.Malware.Gen
alibabacloud: Trojan:Win/Ravartar.Gen

Hashes

MD5 3dae5e50ed9d4b085e27e4298fa01d14
SHA1 94cf5963194c6617f2a844d13d893fa256ee2bbd
SHA256 c28fe13421189718e6a67128b37fb8006fe45eb3aed000696b21da16301a39dd
SHA3 3a050cb03aacec7c9c8016bb19c324fade8711e3c788fbda061f53b1fd888a0c
SSDeep 98304:FnZSZ/yUEqdDVqh/R1vlImJrByu16nmjcZM6vxuau6vI0WP:FnZU6W0hpxmmJMmjceSuaDvZWP
Imports Hash 94032798abbebf36aa837112a84e94e7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2026-May-26 19:09:03
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x33200
SizeOfInitializedData 0x10a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001500 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x3b400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x498000
SizeOfHeaders 0x400
Checksum 0x497f0f
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f20b5ba0cae16c800fed8b586ee630a6
SHA1 9cedc26c7f4b27893b72182c881b145f34f70913
SHA256 4a6dd89eeb185a2b1054c3f0e92aae41ba452c559883a7e60fbc06595928af2a
SHA3 1758ee514b3ee91a8b3e7c08e668feb8a9abc967f854da47c02657ea875eb956
VirtualSize 0x33040
VirtualAddress 0x1000
SizeOfRawData 0x33200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 2.25335

.data

MD5 5e89d6ef67640dc72a485634438f993a
SHA1 f685cf721c65c8b8755984bb3c5844b54e2faa4f
SHA256 c754837a53ec33b066743490459249e5a8913c3b751d7842a52190e87300499f
SHA3 ab02fdf371274ab45a304df34629934246d15d7f4869d19cf31a5404f829d5f2
VirtualSize 0x10000
VirtualAddress 0x35000
SizeOfRawData 0x10000
PointerToRawData 0x33600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.02074

.rdata

MD5 c0f198d52c3c4bcbef088e84548eb042
SHA1 6fd68ac7e810fcd9bf02929f466a51c8e63ac8df
SHA256 e420ac0f835140664dc7e8dcc1666f0585e0f72260f93ac7120a45e73973d76c
SHA3 0bff5c19241f29743d060f95cf3df2b4128ddb4bc12e7d4fe3aec377e9cd5057
VirtualSize 0x30
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x43600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.607779

.pdata

MD5 fa71358b50826490ddf0886d043840ac
SHA1 0ffbe8a25f3b08492633b96ccc3153f5eb8adcb4
SHA256 db7bb65b3d1a0386a0d4c40a95613f02ef5201f7dea74351d405861b16b171aa
SHA3 36b436a56e3e9a6638ed931e777164d852939193bb25033cedd00dc3e1217671
VirtualSize 0x18
VirtualAddress 0x46000
SizeOfRawData 0x200
PointerToRawData 0x43800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.483985

.xdata

MD5 bfedd79b8d8ac737b2ca31f621c1856a
SHA1 398de5c4de6ebced85658ba87ab0918198650e6f
SHA256 434297d0d838aaaef7a7b939a06d26377c6329d35139c043d384dd244888675e
SHA3 d254280c112813ffd9c987049c811b3c38afab89eaa58b5de4e1a28f650c05b9
VirtualSize 0x10
VirtualAddress 0x47000
SizeOfRawData 0x200
PointerToRawData 0x43a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.190489

.edata

MD5 e499ddcbbb719dbf0bd3d12079aac4a0
SHA1 5383fdd55a3db5d4b2625d1de3625d4bae655847
SHA256 9ef7646c2f2bd893a71573aaa6bcb35a1812c11b9f3605ca949a99c2a7d2ee4a
SHA3 fe26dbc4bfa266f94afcf825d4d5b789aa1893343c0149785d01063ceba18188
VirtualSize 0x4f
VirtualAddress 0x48000
SizeOfRawData 0x200
PointerToRawData 0x43c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.915836

.idata

MD5 14613016ca8aa3d2d1a1342cf1822fdb
SHA1 b97e80d4856da21bdd1cd21ebbe4005ce27f301f
SHA256 12e16439363eaed4c37aa1289160ed35447833a65f8f8317bd5cd3e259afe0ae
SHA3 122720be024acb52516cf3437970598aa00d2c01016bcc6cf3cfecf025639288
VirtualSize 0xe8
VirtualAddress 0x49000
SizeOfRawData 0x200
PointerToRawData 0x43e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.74222

.C<&

MD5 cd978e35bb64171d1664411a8fc6199f
SHA1 e51e5cec57df7ccdeb379cf62cd10d46ae78fcee
SHA256 53f767cdaa66ed43c40684d91e38a2193505ec3e97d5cb6219d53a5a602291ef
SHA3 e445f01ed28184c2c51a280f99deda9fff50eafd4b3202ec6544091548eea112
VirtualSize 0x44cebc
VirtualAddress 0x4a000
SizeOfRawData 0x44d000
PointerToRawData 0x44000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.49312

.reloc

MD5 017fd6ccd4409b4c8718b1dea439f049
SHA1 c3fca6967b7c656d72387183917f04948fcbe6f7
SHA256 c86c8868736713e728f409c68dabc0788c77e0876a2ce3c5ea239a2c6d72a83a
SHA3 9654040266097a0faf8b31d64fae24adac7f082729c0ce518e01ef36c93fbcca
VirtualSize 0x78
VirtualAddress 0x497000
SizeOfRawData 0x200
PointerToRawData 0x491000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.23539

Imports

KERNEL32.dll ExitProcess
VirtualProtect
USER32.dll MessageBoxA

Delayed Imports

CreateInterface

Ordinal 1
Address 0x1000

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.