c701444da19a0c590007e6b4cfa314b2

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Jul-30 08:52:08

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Suspicious The PE is possibly a dropper. Resource 3193C7F1D798469D95E04174D4F0921F is possibly compressed or encrypted.
Resources amount for 93.3082% of the executable.
Malicious VirusTotal score: 19/70 (Scanned on 2021-05-10 19:05:56) FireEye: Generic.mg.c701444da19a0c59
McAfee: Artemis!C701444DA19A
Zillya: Trojan.Generic.Win32.922194
Alibaba: TrojanDropper:BAT/Tiggre.b1fa0dad
Cybereason: malicious.8fabd8
Symantec: Trojan.Gen.2
ESET-NOD32: BAT/TrojanDropper.Agent.NFY
APEX: Malicious
Rising: Dropper.Agent!8.2F (CLOUD)
Sophos: ML/PE-A
McAfee-GW-Edition: BehavesLike.Win64.Trojan.tc
Ikarus: Trojan.Win32.Tiggre
Antiy-AVL: Trojan/Generic.ASMalwS.2BB2C00
AegisLab: Trojan.Win32.Cryrar.tqFl
Cynet: Malicious (score: 100)
Fortinet: PossibleThreat.PALLASNET.H
AVG: FileRepMalware
Avast: FileRepMalware
CrowdStrike: win/malicious_confidence_60% (W)

Hashes

MD5 c701444da19a0c590007e6b4cfa314b2
SHA1 56b0cdd8fabd878032e34316fe2d48676f880899
SHA256 c0df9e4b8a084b0d866a4727b528b1fa03095e4878cce47ef8171d9f67d2a013
SHA3 8af1e31cb4cc5bee80aea5f0a026f396bde7e13772d2b144b07494c5439e817b
SSDeep 49152:ydTLNd1DvWf3Mlby+O00YNwmx5scpWvrTa:0H1Dv8clU00YNr5lpETa
Imports Hash f326f88ca83c9aacaa44acfb8884f1d4

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2019-Jul-30 08:52:08
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x16a00
SizeOfInitializedData 0x1ae000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .code)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x1c9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.code

MD5 42ab9e47d545bb8e67879e2bfccd6c99
SHA1 b0209ad178187257ecfeaa66e2f60e0dc12e2696
SHA256 04210bb325d040d408230eea0cde4df9a179a4ab1644371e68d1aa3f540a043e
SHA3 9f2bc8e10e913b83c0d80a9f0a56aba92dd4a77099bb96de424bbd425991f5d7
VirtualSize 0x5b79
VirtualAddress 0x1000
SizeOfRawData 0x5c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.50779

.text

MD5 2c6e6fd73b4dfdcb8a681323f3794101
SHA1 0eeb5cef23b55b665701de59d651c280a833e8e0
SHA256 156d80623c12ccde2e5c52b8c4a0b3ecae5052013353e5308656a9b7cbc2b0c4
SHA3 12df90b240eaa2963d2bd516d051944b8b2e6da429423b6a5623271f256c948b
VirtualSize 0x10d25
VirtualAddress 0x7000
SizeOfRawData 0x10e00
PointerToRawData 0x6000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.35314

.rdata

MD5 036b59841f0db6bc166c3957048d4cb2
SHA1 e02f0de5e56b1d9e7c5c8cca8a05108527a2faeb
SHA256 f4552f5a52efc037658f86c1bbc8377fa40e22ddd3e16809922d4e1453452c55
SHA3 ba6b094bd16262f91fe5533fea58af6e63af4fb61857923f15c3c054c6da95ea
VirtualSize 0x4b9d
VirtualAddress 0x18000
SizeOfRawData 0x4c00
PointerToRawData 0x16e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.68531

.pdata

MD5 f4573e699a92abb90d6cc9d80f9214c4
SHA1 f14a7598eaa7a8c020505f893809d9a5a42d7ff3
SHA256 8a2feca8fb1425517666fa715484a5bf35981b026d30ce5e3289ee3506e11d6e
SHA3 5195db6f0f5a83e6d405d5d170d0c19e243514496dcc4f51dfdb9f32708f3c52
VirtualSize 0x1140
VirtualAddress 0x1d000
SizeOfRawData 0x1200
PointerToRawData 0x1ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.00396

.data

MD5 8edfe3b4c4c44d229207692f7bf68c92
SHA1 988ea45743f2a8e35c13f9a19dcb3b2b9a28dd72
SHA256 bfcbb6e042600f007ec0fbcf067c5bc8ae000c9cb66ac9de5a9c9afff10a51a4
SHA3 094c05a265c5546c66018f7287b6e989dd6e35807ce1728924234585ee432681
VirtualSize 0x23b8
VirtualAddress 0x1f000
SizeOfRawData 0x1600
PointerToRawData 0x1cc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.38781

.rsrc

MD5 02d77d4057cb97bd6c6fc20176ca01e4
SHA1 bfe71440935359f1a37af211584be2c3e297eb05
SHA256 0d015bee40d40ed6d2d8bda001488fa2d68a1e1920792e4f940ddb6ef1180dff
SHA3 dbfda7d9132c1d2547cf0c9136df59183c33f181f5453da8e1f0125af5e5f594
VirtualSize 0x1a6b40
VirtualAddress 0x22000
SizeOfRawData 0x1a6c00
PointerToRawData 0x1e200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99989

Imports

msvcrt.dll memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
KERNEL32.dll GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetShortPathNameW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
SHELL32.DLL ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
WINMM.DLL timeBeginPeriod
OLE32.DLL CoInitialize
CoTaskMemFree
SHLWAPI.DLL PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
USER32.DLL CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
DestroyWindow
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
GetSystemMetrics
CreateWindowExW
SetWindowLongPtrW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
GDI32.DLL GetStockObject
COMCTL32.DLL InitCommonControlsEx

Delayed Imports

3193C7F1D798469D95E04174D4F0921F

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1a669a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9999
MD5 a7e92f70191fcddf0e028ef5ac4ea118
SHA1 ec16c39284abe867a4934456e96152920332cd69
SHA256 c09d5a609f3a030090c69aaa31edb5a159793a849f99627338dcbbd293ff1488
SHA3 f3585e2945ff01deeabb4f39bb9c47f1522d49a3201c0389e12f25ff596c4e69

9BD73E2890EC1233EE30C2EA866A25AD

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23593
MD5 7bb55e591962edd967c9a3039407256c
SHA1 e84642313805d66ef70fdada202992d040a1c2cc
SHA256 8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91
SHA3 116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91

C45954E13BDCAA15ECEEBA1218CC8454D9D1D3B9

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4183
MD5 4eba108d9c4ce6f5267c313ed1080912
SHA1 266c7da2038c8c26caa1efe7d6a7710cd01129ca
SHA256 8b172651452e5340d7dc2904d6e28aad9ab328812b835c9d0001b12e10a79a2f
SHA3 043a15acf39295d1f5b5466fbb15ce0e35c501a1197b2603a645066594625be0

F70D7ECA90

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA3 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7

1

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x267
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.90544
MD5 4e2ee33c354e5aff254814592a935dd3
SHA1 059023c6baf2e13e5b77a51b8348b551e92c72d5
SHA256 e740f847bcb93ac2af26fa0b6666dfdf74a32f167cb04608e558b8ea4568cdf7
SHA3 482ae796d6566ab40baace9acd3b17fe3ad863603d351ab89930e4992f9ccae5

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

<-- -->