c9b13a4c396a013caaeec9d97d9d6116
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Aug-23 03:54:50 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to RC5 or RC6 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .didata |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource SRC is possibly compressed or encrypted. |
| Malicious | The file contains overlay data. |
13372734 bytes of data starting at offset 0x92800.
The file contains a Zip Compressed Archive after the PE data. Overlay data amounts for 95.7055% of the executable. |
| Malicious | VirusTotal score: 48/71 (Scanned on 2026-02-15 12:00:52) |
ALYac:
Dropped:Application.HackTool.BBA
APEX: Malicious AVG: Win64:Malware-gen Alibaba: HackTool:Win64/ToolX.5189ec3a Arcabit: Application.HackTool.BBA Avast: Win64:Malware-gen Avira: TR/Redcap.gjreo BitDefender: Dropped:Application.HackTool.BBA Bkav: W64.AIDetectMalware CAT-QuickHeal: Trojan.Agent CTX: exe.trojan.softfire ClamAV: Win.Exploit.Exploitx-10036090-0 CrowdStrike: win/malicious_confidence_60% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.MulDrop24.3955 ESET-NOD32: BAT/Softfire.K trojan Elastic: malicious (moderate confidence) Emsisoft: Dropped:Application.HackTool.BBA (B) F-Secure: Trojan.TR/Redcap.gjreo GData: Dropped:Application.HackTool.BBA Gridinsoft: Ransom.Win64.Sabsik.oa!s1 Ikarus: Trojan.BAT.Softfire Jiangmin: Backdoor.Gulpix.tc K7AntiVirus: Trojan ( 005d60511 ) K7GW: Trojan ( 005d60511 ) Lionic: Trojan.Win32.Softfire.4!c Malwarebytes: HackTool.ActivationBypass MaxSecure: Trojan.Malware.338148470.susgen McAfeeD: ti!43C0C0319F07 MicroWorld-eScan: Dropped:Application.HackTool.BBA Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Rising: Trojan.Softfire/BAT!8.19846 (CLOUD) Sangfor: Trojan.Win32.Save.a Skyhigh: BehavesLike.Win64.Dropper.tc Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.10c07b6e TrellixENS: Artemis!C9B13A4C396A TrendMicro: Trojan.Win64.WACATAC.USBLKB25 TrendMicro-HouseCall: Trojan.Win64.WACATAC.USBLKB25 VIPRE: Dropped:Application.HackTool.BBA Varist: W64/ABApplication.XUTM-8707 Webroot: W32.Malware.gen Zillya: Trojan.Obfus.BAT.3 alibabacloud: HackTool:Win/Wacatac.B9nj |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 2021-Aug-23 03:54:50 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 8.2 |
| SizeOfCode | 0x5cc00 |
| SizeOfInitializedData | 0x35800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000005D1A0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 5.2 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xa3000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.pdata
.rsrc
Imports
| oleaut32.dll |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
|---|---|
| advapi32.dll |
RegQueryValueExW
RegOpenKeyExW RegCloseKey |
| user32.dll |
MessageBoxA
CharNextW LoadStringW |
| kernel32.dll |
Sleep
VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess SwitchToThread GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle |
| kernel32.dll (#2) |
Sleep
VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess SwitchToThread GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle |
| user32.dll (#2) |
MessageBoxA
CharNextW LoadStringW |
| kernel32.dll (#3) |
Sleep
VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess SwitchToThread GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle |
| SHFolder.dll |
SHGetFolderPathW
|
| kernel32.dll (#4) |
Sleep
VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess SwitchToThread GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle |
| oleaut32.dll (#2) |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
| msvcrt.dll |
memcpy
|
| kernel32.dll (delay-loaded) |
Sleep
VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess SwitchToThread GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | kernel32.dll |
| ModuleHandle | 0x78060 |
| DelayImportAddressTable | 0x78078 |
| DelayImportNameTable | 0x780a8 |
| BoundDelayImportTable | 0x780d8 |
| UnloadDelayImportTable | 0x780f8 |
| TimeStamp | 1970-Jan-01 00:00:00 |
dbkFCallWrapperAddr
| Ordinal | 1 |
|---|---|
| Address | 0x70d68 |
__dbk_fcall_wrapper
| Ordinal | 2 |
|---|---|
| Address | 0xe370 |
TMethodImplementationIntercept
| Ordinal | 3 |
|---|---|
| Address | 0x3c910 |
1
4089
4090
4091
4092
4093
4094
4095
4096
OPT
PLATFORMTARGETS
SRC
MAINICON
1 (#2)
String Table contents
| Windows Server 2008 |
| Windows 7 |
| Windows Server 2008 R2 |
| Windows 2000 |
| Windows XP |
| Windows Server 2003 |
| Windows Server 2003 R2 |
| Windows Server 2012 |
| Windows 8 |
| cmdln |
| MYFILES |
| Error loading resources. |
| Could not create process. |
| Quick Batch File Compiler Runtime Module Version 5.x |
| Copyright (C) 2004-2021 Abyss Media Company, https://www.abyssmedia.com |
| Cannot assign a %s to a %s |
| Cannot create file "%s". %s |
| Cannot open file "%s". %s |
| Invalid file name - %s |
| %s.Seek not implemented |
| Stream write error |
| The specified file was not found |
| Argument out of range |
| Item not found |
| Duplicates not allowed |
| %s (Version %d.%d, Build %d, %5:s) |
| %s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s) |
| 32-bit Edition |
| 64-bit Edition |
| Windows |
| Windows Vista |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| May |
| June |
| July |
| August |
| September |
| October |
| Exception in safecall method |
| Object lock not owned |
| Monitor support function not initialized |
| Feature not implemented |
| Method called on disposed object |
| %s (%s, line %d) |
| Abstract Error |
| Access violation at address %p in module '%s'. %s of address %p |
| System Error. Code: %d. |
| %s%s |
| A call to an OS function failed |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Jun |
| Variant or safe array index out of bounds |
| Variant or safe array is locked |
| Invalid variant type conversion |
| Invalid variant operation |
| Invalid NULL variant operation |
| Invalid variant operation (%s%.8x) |
| %s |
| Could not convert variant of type (%s) into type (%s) |
| Overflow while converting variant of type (%s) into type (%s) |
| Variant overflow |
| Invalid argument |
| Invalid variant type |
| Operation not supported |
| Unexpected variant error |
| External exception %x |
| Assertion failed |
| Interface not supported |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Access violation |
| Stack overflow |
| Control-C hit |
| Privileged instruction |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| Variant method calls not supported |
| Read |
| Write |
| Error creating variant or safe array |
| '%d.%d' is not a valid timestamp |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| Too many open files |
| File access denied |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
| Division by zero |
| Range check error |
| Integer overflow |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
Version Info
TLS Callbacks
| StartAddressOfRawData | 0x47a000 |
|---|---|
| EndAddressOfRawData | 0x47a1a0 |
| AddressOfIndex | 0x460414 |
| AddressOfCallbacks | 0x47b020 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
[*] Warning: Section .tls has a size of 0!