c843d4883560d1411b01938caeb09ca4a41461b5f3455f2198c5d58d83a00ad0

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Apr-12 21:14:38
Detected languages English - United States

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .j/4
Unusual section name found: ./HO
Unusual section name found: .(n_
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • ShellExecuteW
Malicious VirusTotal score: 44/70 (Scanned on 2026-07-17 02:05:19) ALYac: Trojan.GenericKD.79912571
APEX: Malicious
AVG: Win64:Evo-gen [Trj]
Alibaba: Trojan:Win32/VMProtect.4f75a6a4
Antiy-AVL: Trojan[Packed]/Win32.VMProtect
Arcabit: Trojan.Generic.D4C35E7B
Avast: Win64:Evo-gen [Trj]
Avira: TR/W64.Evo
BitDefender: Trojan.GenericKD.79912571
Bkav: W32.Malware.55B12FB1
CTX: exe.trojan.vmprotect
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win32/Packed.VMProtect.ACX trojan
Elastic: malicious (high confidence)
Emsisoft: Trojan.GenericKD.79912571 (B)
F-Secure: Trojan.TR/W64.Evo
Fortinet: W32/PossibleThreat
GData: Trojan.GenericKD.79912571
Google: Detected
Gridinsoft: Trojan.Heur!.02212023
Ikarus: Trojan.Win32.VMProtect
K7AntiVirus: Riskware ( 005cdde21 )
K7GW: Riskware ( 005cdde21 )
Kingsoft: Win32.Troj.kepavll.v
Lionic: Trojan.Win32.VMProtect.4!c
Malwarebytes: Malware.Heuristic.2108
MaxSecure: Trojan.Malware.684974288.susgen
McAfeeD: Real Protect-LS!5B1D28C52B67
MicroWorld-eScan: Trojan.GenericKD.79912571
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Malicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!5B1D28C52B67
TrendMicro: Trojan.Win32.ZYX.USBLFH26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFH26
VIPRE: Trojan.GenericKD.79912571
Varist: W64/ABTrojan.KDFA-7142
ViRobot: Trojan.Win.Z.Vmprotect.2887680
alibabacloud: VirTool:Win/Wacatac.B9nj

Hashes

MD5 5b1d28c52b679797c0be348ad62aead6
SHA1 9e0191d65bb4af8910109c555d72377e66fa94e6
SHA256 c843d4883560d1411b01938caeb09ca4a41461b5f3455f2198c5d58d83a00ad0
SHA3 7248034d4b26205d2e3fa93c3abbda9a9be7fb7848148d8062fd267ab859a00e
SSDeep 49152:U0dc5Rc+HxZzoq7QKZfZGSf1S+b++tQrJRR159z7dXmtXH3bLK82gyHZ78xss:XCIMlD731S+bcnh6bapNQz
Imports Hash a14110dd43a44d33b51c1e984df4b83f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Apr-12 21:14:38
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x69a00
SizeOfInitializedData 0x1ca00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000004B20A9 (Section: .(n_)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x511000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x6987e
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x17570
VirtualAddress 0x6b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x5e0
VirtualAddress 0x83000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x4668
VirtualAddress 0x84000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.j/4

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1c56fc
VirtualAddress 0x89000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

./HO

MD5 79194cfc716d6cbc62d6dcbedfec436a
SHA1 eb903fd4b789f66bde07de3fa2b2e4216d4d22f8
SHA256 9ca0691c1a5ffa592f9a51984db7cd28aacd131d9d72014ebd07bacf38eff298
SHA3 35557a2229dc1e2ac1bbb99a516f4aa2a7f0f0e45de473a9f6264118fe11356f
VirtualSize 0xda0
VirtualAddress 0x24f000
SizeOfRawData 0xe00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.272861

.(n_

MD5 50a0bcb84a3c6ddd60ac9867b34bdb97
SHA1 1d112bc3d1f98e54e10a38583335e3abe00315cd
SHA256 97cb7a708767dd045e43e30690e1ec5c92808acbe9e5d5f07a2121fc708e83f6
SHA3 6dfa955e1b65552006c32824e552716d60285145de542dd9c78d7954c4fa9ca6
VirtualSize 0x2bfb3c
VirtualAddress 0x250000
SizeOfRawData 0x2bfc00
PointerToRawData 0x1200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.98585

.rsrc

MD5 f3ce34a147f90a45fd500b35bd0dd6d3
SHA1 dd1e5ddca49a748c3e907f79cf03fe88b3a0c824
SHA256 284c365f4335ecdb9f21c44d8e85071740c40b11471c9db399b77336ba1ca214
SHA3 6637947af470cee30168c0a39ea2ee1ecfb73ec87c5afab992f1cad6b3fb12dd
VirtualSize 0x1d5
VirtualAddress 0x510000
SizeOfRawData 0x200
PointerToRawData 0x2c0e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
KERNEL32.dll QueryPerformanceCounter
USER32.dll PostQuitMessage
GDI32.dll CreateRectRgn
SHELL32.dll ShellExecuteW
D3DCOMPILER_47.dll D3DCompile
dwmapi.dll DwmGetColorizationColor
IMM32.dll ImmSetCompositionWindow
MSVCP140.dll _Cnd_do_broadcast_at_thread_exit
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __current_exception_context
api-ms-win-crt-stdio-l1-1-0.dll ftell
api-ms-win-crt-utility-l1-1-0.dll rand
api-ms-win-crt-heap-l1-1-0.dll _callnewh
api-ms-win-crt-convert-l1-1-0.dll atof
api-ms-win-crt-string-l1-1-0.dll wcscpy_s
api-ms-win-crt-runtime-l1-1-0.dll _cexit
api-ms-win-crt-math-l1-1-0.dll atan2f
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
KERNEL32.dll (#2) QueryPerformanceCounter
KERNEL32.dll (#3) QueryPerformanceCounter

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140083040

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .j/4 has a size of 0!
Leave a comment

No comments yet.