Manalyze report for c8fb97c042a67667e43b29e1f41a34b2911096078ab0f45c3eb669cc10e87295

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-29 01:31:55
TLS Callbacks	2 callback(s) detected.

Plugin Output

Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot NtQuerySystemInformation` `Can access the registry: RegCloseKey RegOpenKeyExW RegQueryValueExW` `Uses Windows's Native API: NtGetNextThread NtQueryInformationThread NtQuerySystemInformation` `Uses functions commonly found in keyloggers: CallNextHookEx GetAsyncKeyState` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Manipulates other processes: ReadProcessMemory`
Suspicious	VirusTotal score: 1/71 (Scanned on 2026-10-29 01:51:18)	`Microsoft: Trojan:Win32/Wacatac.C!ml`

Hashes

MD5	`e9a9a8d5c707db6254e4a6afdd58d9b1` 🔍
SHA1	`2bb2dca5dd6e636b3b9316bad6ab8824dc6a882b` 🔍
SHA256	`c8fb97c042a67667e43b29e1f41a34b2911096078ab0f45c3eb669cc10e87295` 🔍
SHA3	`632b1ada4f949233ed78ae35d1163b213e5dbacf7b87693206e9d2c7900b3e81` 🔍
SSDeep	`3072:4r3dNfy6oq9ltmVAwHhzWDgqLlDELD0JbmrYg+VnnIRJcw:45NK6d2VnHrqLGqmZs` 🔍
Imports Hash	`7b3638eb91eeaeee313a68ca7bd3ce41` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`9`
TimeDateStamp	2026-Oct-29 01:31:55
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`2.0`
SizeOfCode	`0x1a400`
SizeOfInitializedData	`0x9600`
SizeOfUninitializedData	`0x154000`
AddressOfEntryPoint	`0x00001269 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x1c000`
ImageBase	`0x61a00000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x17e000`
SizeOfHeaders	`0x400`
Checksum	`0x2b820`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d50a6f40aa01e153940662f279dec8d4 🔍`
SHA1	`dad9522c40a5b3ec823fd4f352682ba8660f37e6 🔍`
SHA256	`f47e73d36616c1b59600057d085d0c4ee44825782d6f7b1685dd6c80463d227e 🔍`
SHA3	`2a4c9cea1d1430cf71c6ac08f0d717f5436685ead61748b0576289533d1a9e6c 🔍`
VirtualSize	`0x1a280`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1a400`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.24673`

.data

MD5	`85dc8e925dd82649ca985733d00a0ec7 🔍`
SHA1	`7f09fb13495839b66c77a09b133f01d0985860bf 🔍`
SHA256	`019ef628f1c751cd78bfa17aed92f0d32ed41e3ed6157c73898b3a9e426103fa 🔍`
SHA3	`a959b7154fe604d604efae9f742ea4aa9d58616250650875db2797f43be2623b 🔍`
VirtualSize	`0x420`
VirtualAddress	`0x1c000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1a800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.93377`

.rdata

MD5	`f9be1962a9921e0ba5ba812cb3e728e8 🔍`
SHA1	`1ed84ba882703bb7209523e255073e055be3ac7f 🔍`
SHA256	`6a97262ddc204be33545b7ed4645a8a6a96fb0aa5bf1bde66d259549287e0714 🔍`
SHA3	`52dc78c618aba47a440caff46e85dce686507ed5a6e951b57323b8748aa5a0f1 🔍`
VirtualSize	`0x399c`
VirtualAddress	`0x1d000`
SizeOfRawData	`0x3a00`
PointerToRawData	`0x1ae00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.13829`

.eh_fram

MD5	`d580bca4eecf0120df4a3285ab40877d 🔍`
SHA1	`ccd4f2dc042b2e6a3648173ad2712f3e5e6508ec 🔍`
SHA256	`058127281ce7944c4cd84f40c82da6a241418ddfe36e4feab9a89be8d4ccbb94 🔍`
SHA3	`3652c65de5a67f993be2c2cde9819b9877c2a9ed7fc06e317503ac5307b3c970 🔍`
VirtualSize	`0x292c`
VirtualAddress	`0x21000`
SizeOfRawData	`0x2a00`
PointerToRawData	`0x1e800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.14041`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x153e28`
VirtualAddress	`0x24000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`c3a5d572cc0c1065dc8941f0a3f8bc6d 🔍`
SHA1	`f0d6c2681d3fe53508713e3d4e536b081f6213da 🔍`
SHA256	`adc4ecb2945622c94fbba52090c5ede4ba301c97a6d0970f396cc763ce27d04b 🔍`
SHA3	`7033bc1b04852d6faaeab2d1c6f3cccc1126a7e787a8d89b7e8fee67d1155608 🔍`
VirtualSize	`0xa4`
VirtualAddress	`0x178000`
SizeOfRawData	`0x200`
PointerToRawData	`0x21200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.93967`

.idata

MD5	`d2e0d2a61cc22462ce99afc5b229754c 🔍`
SHA1	`89f6542333a7f49920f45c45f635217a6ac388e0 🔍`
SHA256	`c210c88c49fb6938db435cc33678642eae183b07196574f9e3f3ea645435b00f 🔍`
SHA3	`512f8d8505caaf6a5dc0297b011f0b43fd3def4edd85be0aa4de47cbbde0dcf5 🔍`
VirtualSize	`0x1544`
VirtualAddress	`0x179000`
SizeOfRawData	`0x1600`
PointerToRawData	`0x21400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.40428`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x8`
VirtualAddress	`0x17b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x22a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`641030753d5e5e9b5cc03de54fa72e21 🔍`
SHA1	`0cf9156418135e1a3c334b5421da1bb7d73f9014 🔍`
SHA256	`14f61104cbb6a1857fc7f8762eddcc5bf6781bc40a0c05d9357d847f08e72421 🔍`
SHA3	`c0b62a3693556a7103b386aaf30420106dff30a6dbb206189ee4284751861c7e 🔍`
VirtualSize	`0x10c8`
VirtualAddress	`0x17c000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x22c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.54461`

Imports

ADVAPI32.dll	`GetUserNameW` `RegCloseKey` `RegOpenKeyExW` `RegQueryValueExW`
GDI32.dll	`CreateCompatibleDC` `CreateDIBSection` `CreateFontW` `CreateSolidBrush` `DeleteDC` `DeleteObject` `GdiFlush` `SelectObject` `SetBkMode` `SetTextColor`
IMM32.DLL	`ImmDisableIME`
KERNEL32.dll	`AcquireSRWLockExclusive` `AcquireSRWLockShared` `AddVectoredExceptionHandler` `AllocConsole` `CloseHandle` `CreateDirectoryW` `CreateEventW` `CreateFileW` `CreateMutexW` `CreateThread` `CreateToolhelp32Snapshot` `CreateWaitableTimerExW` `DeleteCriticalSection` `DeleteFileW` `DisableThreadLibraryCalls` `EnterCriticalSection` `FileTimeToSystemTime` `FindClose` `FindFirstFileW` `FindNextFileW` `FlushInstructionCache` `FreeLibrary` `GetCPInfo` `GetComputerNameW` `GetConsoleWindow` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetCurrentThreadStackLimits` `GetEnvironmentVariableW` `GetLastError` `GetLocalTime` `GetLogicalProcessorInformationEx` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleExW` `GetModuleHandleW` `GetNativeSystemInfo` `GetPriorityClass` `GetPrivateProfileIntW` `GetProcAddress` `GetProcessAffinityMask` `GetProcessHandleCount` `GetProcessTimes` `GetThreadContext` `GetThreadId` `GetThreadTimes` `GetTickCount64` `GlobalMemoryStatusEx` `InitializeCriticalSection` `K32EnumProcessModules` `K32GetModuleBaseNameA` `K32GetModuleFileNameExW` `K32GetModuleInformation` `K32GetProcessMemoryInfo` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `LocalFree` `MoveFileExW` `MultiByteToWideChar` `OpenThread` `QueryPerformanceCounter` `QueryPerformanceFrequency` `QueryThreadCycleTime` `ReadFile` `ReadProcessMemory` `ReleaseSRWLockExclusive` `ReleaseSRWLockShared` `RemoveDirectoryW` `ResumeThread` `SetConsoleCtrlHandler` `SetConsoleTitleW` `SetEvent` `SetThreadPriority` `SetWaitableTimer` `Sleep` `SuspendThread` `TerminateProcess` `Thread32First` `Thread32Next` `TlsGetValue` `VirtualAlloc` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WideCharToMultiByte` `WriteFile`
msvcrt.dll	`__lc_codepage` `__p__iob` `__p___mb_cur_max` `_amsg_exit` `_errno` `_initterm` `_lock` `_unlock` `_wcsicmp` `_wcsnicmp` `_wfopen` `abort` `calloc` `fclose` `fprintf` `fputc` `fputwc` `fread` `free` `fseek` `fwprintf` `fwrite` `localeconv` `malloc` `memcmp` `memcpy` `memmove` `memset` `qsort` `realloc` `strchr` `strcmp` `strcspn` `strerror` `strlen` `strncmp` `strrchr` `strstr` `vfprintf` `wcscat` `wcscmp` `wcscpy` `wcslen` `wcsrchr`
NTDLL.dll	`LdrRegisterDllNotification` `NtGetNextThread` `NtQueryInformationThread` `NtQuerySystemInformation`
ole32.dll	`CoCreateInstance` `CoInitializeEx` `CoUninitialize`
USER32.dll	`CallNextHookEx` `DeleteMenu` `DrawTextW` `EnumDisplaySettingsW` `FillRect` `GetAsyncKeyState` `GetClientRect` `GetSystemMenu` `GetWindowLongW` `GetWindowRect` `MessageBeep` `MessageBoxW` `SetDlgItemTextW` `SetWindowsHookExW` `UnhookWindowsHookEx`
VERSION.dll	`GetFileVersionInfoSizeW` `GetFileVersionInfoW` `VerQueryValueW`

Delayed Imports

s2prof_fix

Ordinal	`1`
Address	`0x6b20`

s2prof_live_writes

Ordinal	`2`
Address	`0x6b10`

s2prof_renderer_starting

Ordinal	`3`
Address	`0x6ae0`

s2prof_wait_ready

Ordinal	`4`
Address	`0x6a50`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x61b7b000`
EndAddressOfRawData	`0x61b7b004`
AddressOfIndex	`0x61b7742c`
AddressOfCallbacks	`0x61a20988`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x61A10AA8` `0x61A10B38`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.