| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Aug-08 06:33:11 |
| Suspicious | The PE is possibly packed. |
Unusual section name found:
Unusual section name found: Unusual section name found: Section is both writable and executable. The PE only has 3 import(s). |
| Suspicious | The file contains overlay data. |
133144 bytes of data starting at offset 0x18328.
The overlay data has an entropy of 7.99884 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 53/69 (Scanned on 2021-05-12 08:09:08) |
Bkav:
W32.AIDetect.malware1
Elastic: malicious (high confidence) MicroWorld-eScan: Gen:Trojan.Heur.PT.omZ@bSEA3vk CAT-QuickHeal: Trojanransom.Darkside ALYac: Trojan.Ransom.Filecoder Cylance: Unsafe VIPRE: Trojan.Win32.Generic!BT Sangfor: Trojan.Win32.Save.a K7AntiVirus: Trojan ( 005696151 ) Alibaba: Ransom:Win32/generic.ali2000010 K7GW: Trojan ( 005696151 ) Cybereason: malicious.c67fb7 Cyren: W32/Trojan.UJXE-8785 Symantec: Trojan Horse ESET-NOD32: Win32/Filecoder.DarkSide.A APEX: Malicious Paloalto: generic.ml Kaspersky: Trojan-Ransom.Win32.Darkside.b BitDefender: Gen:Trojan.Heur.PT.omZ@bSEA3vk NANO-Antivirus: Trojan.Win32.Encoder.hsqsoj Tencent: Win32.Trojan.Agent.Swun Ad-Aware: Gen:Trojan.Heur.PT.omZ@bSEA3vk Sophos: ML/PE-A + Mal/EncPk-ANL Comodo: Packed.Win32.MNSP.Gen@2697wr DrWeb: Trojan.Encoder.32386 Zillya: Trojan.Obsidium.Win32.802 TrendMicro: Ransom.Win32.DARKSIDE.FAIQ McAfee-GW-Edition: BehavesLike.Win32.Generic.dc FireEye: Generic.mg.c81dae5c67fb72a2 Emsisoft: Gen:Trojan.Heur.PT.omZ@bSEA3vk (B) Ikarus: Trojan.Win32.Obsidium GData: Gen:Trojan.Heur.PT.omZ@bSEA3vk Webroot: W32.Trojan.Gen Avira: HEUR/AGEN.1128017 ViRobot: Trojan.Win32.S.DarkSide.232256 Microsoft: Trojan:MSIL/Cryptor Cynet: Malicious (score: 100) AhnLab-V3: Trojan/Win.Ransomlock.C4465498 Acronis: suspicious McAfee: Generic-FAWW!C81DAE5C67FB MAX: malware (ai score=100) VBA32: TrojanRansom.Agent Malwarebytes: Ransom.DarkSide TrendMicro-HouseCall: Ransom.Win32.DARKSIDE.FAIQ Rising: Ransom.DarkSide!8.11F84 (CLOUD) Yandex: Trojan.Obsidium!eyTqKn+WhnM SentinelOne: Static AI - Malicious PE eGambit: Unsafe.AI_Score_98% Fortinet: W32/Packed.OBSIDIUM.BV!tr BitDefenderTheta: AI:Packer.A420046E1E AVG: Win32:Trojan-gen Avast: Win32:Trojan-gen CrowdStrike: win/malicious_confidence_100% (W) |
| e_magic | MZ |
|---|---|
| e_cblp | 0xda6a |
| e_cp | 0xc6f |
| e_crlc | 0x87f6 |
| e_cparhdr | 0x673e |
| e_minalloc | 0xea4d |
| e_maxalloc | 0x3156 |
| e_ss | 0xe28b |
| e_sp | 0x8f02 |
| e_csum | 0x2fc0 |
| e_ip | 0xa1da |
| e_cs | 0xbe32 |
| e_ovno | 0xb017 |
| e_oemid | 0x3730 |
| e_oeminfo | 0x72fd |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2020-Aug-08 06:33:11 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x4c00 |
| SizeOfInitializedData | 0x5600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000F000 (Section: ) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x6000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x27000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x3b867 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetModuleHandleA
|
|---|---|
| user32.dll |
GetMenu
|
| advapi32.dll |
RegisterEventSourceW
|