c41188e4415567a1465712a6c85331a6

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Apr-07 14:06:00

Plugin Output

Suspicious The PE is possibly packed. Section .text is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Malicious VirusTotal score: 18/69 (Scanned on 2021-04-07 18:30:05) Elastic: malicious (high confidence)
FireEye: Generic.mg.c41188e4415567a1
McAfee: Artemis!C41188E44155
Cylance: Unsafe
Sangfor: Trojan.Win32.Save.a
Cybereason: malicious.017e28
ESET-NOD32: a variant of Win64/Bazar.BG
APEX: Malicious
Avast: FileRepMalware
Kaspersky: UDS:DangerousObject.Multi.Generic
Paloalto: generic.ml
McAfee-GW-Edition: Artemis!Trojan
ZoneAlarm: UDS:DangerousObject.Multi.Generic
Microsoft: Trojan:Win32/Wacatac.B!ml
Cynet: Malicious (score: 100)
SentinelOne: Static AI - Malicious PE
AVG: FileRepMalware
CrowdStrike: win/malicious_confidence_60% (W)

Hashes

MD5 c41188e4415567a1465712a6c85331a6
SHA1 2cbf699017e281693a517ff3c9e78f34e4126d6c
SHA256 efb6ef1dffa3bc6f3b7796be4f5681b9da6a243b09029c2381b4009bf6b6eb3d
SHA3 676d3f9a9251723a8651c59f540271b1fa9ee9441eb9e0392ce5b47107d4b5eb
SSDeep 1536:XvamWLz+HfTEea2+NgarZ63GO+SHsyuiIoNbrmqrOke34T5a+94jogCBuyav0P:XvamTIeH4tZ6WOztuYrHNeota+GjZBM
Imports Hash 1d966ce243704108b9d093af3ed6228f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xc8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2021-Apr-07 14:06:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x17400
SizeOfInitializedData 0x1200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000015C48 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1d000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7ced6608984a3722bb2f786e68423596
SHA1 6c7c3e058289e138d59d9e5346c5b4e754202f7a
SHA256 cff364af71a9b1c307322fba72463810f5aa27617fd0088d4b1cf512a83e2330
SHA3 a9afebaaa7c0302c0180609f4fa36fa61440808ac27b9d06d5b725fc77f6483c
VirtualSize 0x172b0
VirtualAddress 0x1000
SizeOfRawData 0x17200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.69137

.rdata

MD5 0a68431b5982b7bd4b6389a786a67952
SHA1 7be27eaf8e0bbde3a8e495750f3bfa38fa9f8755
SHA256 ce371713513de0fc20cc39fd1b6d71cc5fa0ba5895bb675f7c772797d0462f4e
SHA3 103b814fe63b8f93d168794188faec5bc12ac7f4f84dbfa2746e3d618572923e
VirtualSize 0x9b0
VirtualAddress 0x19000
SizeOfRawData 0xa00
PointerToRawData 0x17600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.12246

.pdata

MD5 ed371d007b9ace1628ad4d633b48b2cb
SHA1 a769ec6872f0b358bd2c69d272ed92681d54ada4
SHA256 a6fa2ae215422e741b61c1188f5cd49ef4676f1300e4f75bd7b34d0692343c78
SHA3 0a3248cf827e7ae1cefd644cd8e164759037c5e1fe46f23dec81855c59692795
VirtualSize 0x27c
VirtualAddress 0x1a000
SizeOfRawData 0x400
PointerToRawData 0x18000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.37151

.CRT

MD5 dfa81f12667727e86fcafa9128ce1174
SHA1 7e816b7000789a9624f671b19b92b5d039a35254
SHA256 8af7223f097dd1a9d92aacea00d43f01bc695f69587920497a952c0a73b89990
SHA3 5b662aba8d80ce5eea923598c8520d99236af45893a9f9ffa9da172d323bca89
VirtualSize 0x8
VirtualAddress 0x1b000
SizeOfRawData 0x200
PointerToRawData 0x18400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.0980042

.reloc

MD5 1ae5b0ee2177b97fe3368f64d03a741f
SHA1 331e947f024ba673286d5c418f80b3eb11a4316e
SHA256 a2c5615f1fc40a724308bb79d550ed8d25c0b37a03fd4ea75c6b51dca200d587
SHA3 b4d75b10cf08ed06b54d8dd7ee53e75f2929f2e496f2024803c0aeeb0f6442d7
VirtualSize 0xc
VirtualAddress 0x1c000
SizeOfRawData 0x200
PointerToRawData 0x18600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

KERNEL32.dll CreateFileA
DeleteFileA
CloseHandle
GetLastError
MoveFileA
WriteFile
ExitProcess
GetSystemTime
GlobalAlloc
GetTimeFormatA
GetCommandLineA
VirtualAlloc
VirtualProtect
USER32.dll MessageBoxA
SetWindowTextA
SetCursorPos
GetWindowTextA
OpenClipboard

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Apr-07 14:06:00
Version 0.0
SizeofData 268
AddressOfRawData 0x19458
PointerToRawData 0x17a58

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2021-Apr-07 14:06:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xb54f900d
Unmarked objects 0
Imports (26715) 5
Total imports 19
C++ objects (VS2017 v15.7.5 compiler 26433) 9
Linker (VS2017 v15.7.5 compiler 26433) 1

Errors

<-- -->