Manalyze report for ca1be01ff08a4c2114e138e14374a441ff4ca68687ab732249a80c23aa81e717

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Jul-24 05:07:18
Detected languages	English - United States

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: System32\drivers\etc\hosts`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to RC5 or RC6` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: FindWindowW CreateToolhelp32Snapshot` `Code injection capabilities: OpenProcess WriteProcessMemory VirtualAlloc` `Code injection capabilities (process hollowing): ResumeThread WriteProcessMemory SetThreadContext` `Possibly launches other programs: CreateProcessW` `Uses Microsoft's cryptographic API: CryptStringToBinaryA` `Can create temporary files: CreateFileW GetTempPathW` `Uses functions commonly found in keyloggers: GetAsyncKeyState CallNextHookEx` `Memory manipulation functions often used by packers: VirtualProtect VirtualProtectEx VirtualAlloc` `Has Internet access capabilities: WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Manipulates other processes: Process32FirstW Process32NextW OpenProcess WriteProcessMemory` `Interacts with the certificate store: CertAddCertificateContextToStore CertOpenStore`
Suspicious	The PE is possibly a dropper.	`Resource 1001 is possibly compressed or encrypted.` `Resource 1002 is possibly compressed or encrypted.` `Resources amount for 98.256% of the executable.`
Malicious	VirusTotal score: 20/70 (Scanned on 2026-10-03 17:45:29)	`APEX: Malicious` `Bkav: W32.Malware.56D66A71` `CTX: exe.trojan.artemis` `CrowdStrike: win/malicious_confidence_70% (D)` `Cylance: Unsafe` `Cynet: Malicious (score: 100)` `DeepInstinct: MALICIOUS` `Elastic: malicious (high confidence)` `Fortinet: W32/PossibleThreat` `Gridinsoft: Trojan.Heur!.02016423` `Lionic: Trojan.Win32.Generic.4!c` `Malwarebytes: Trojan.Crypt` `McAfeeD: ti!CA1BE01FF08A` `Paloalto: generic.ml` `SentinelOne: Static AI - Suspicious PE` `Skyhigh: Artemis` `Symantec: ML.Attribute.HighConfidence` `Trapmine: malicious.moderate.ml.score` `TrellixENS: Artemis!BCF2B0437D68` `TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101GT26ZT`

Hashes

MD5	`bcf2b0437d68efe2cfa6f2f75e4efef7` 🔍
SHA1	`f74114203ced3d86d4e0f3ebb4495bd2eedb77ca` 🔍
SHA256	`ca1be01ff08a4c2114e138e14374a441ff4ca68687ab732249a80c23aa81e717` 🔍
SHA3	`35f28dc833b5766aeaa0e0ec47b83d572bb05adbdaa2f879806b38549287486a` 🔍
SSDeep	`393216:GVn7fwRX6DGwqtwNFv8h10S/o5X8+EUgfb2Gl5s8OvLG1wk3qOcYPfYYis4nWVE:GlwRX6DGwqtICpo5sZzDpjsrG1w+gYP` 🔍
Imports Hash	`a56ac4795e17db1bebd7bedd9bcd450c` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Jul-24 05:07:18
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x48e00`
SizeOfInitializedData	`0x1712400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000242C0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x175f000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`302bbe2506fa129f1c72980bc825aa6d 🔍`
SHA1	`1421485e8bc13f4d43a8643d7416fd6785102ea6 🔍`
SHA256	`312c5dd95e0cd437585cba09fe56a3cc0605118d5d489a94e804a02c03e9c859 🔍`
SHA3	`986c1d78732a96c1a15319a5451702e2c43305632851bb7b1d3d011dfa0c95cc 🔍`
VirtualSize	`0x48c2c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x48e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.55053`

.rdata

MD5	`de47482df7e0893f47a89b6bd87ad69d 🔍`
SHA1	`a71a8280c69579db6b9c053cfc4bd04bcdc54d85 🔍`
SHA256	`93d0d7ccf7395f05b43c5a4b934284bcc2e29ef7581e3b0260e37e943d62a631 🔍`
SHA3	`a25132d39ea8b5b4e08d68b28aee9f5940e1876aa366bb07ed6bdf241c554dc4 🔍`
VirtualSize	`0x18620`
VirtualAddress	`0x4a000`
SizeOfRawData	`0x18800`
PointerToRawData	`0x49200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.27291`

.data

MD5	`7169f88520615644f07b1eeb6c68d1f7 🔍`
SHA1	`a9833a0600c80387cfa23b426e1240337b1591c0 🔍`
SHA256	`600100e7fef6a7dd0965c2691e9fd88fe8b46296d4aa63329d2839d5dd459f70 🔍`
SHA3	`765a991ed9b5c440b2ed9bd28bec1134fc25e4db8f6b601726570e2af5d3ca34 🔍`
VirtualSize	`0x3284`
VirtualAddress	`0x63000`
SizeOfRawData	`0x1a00`
PointerToRawData	`0x61a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.30534`

.pdata

MD5	`2d868bf162e8316930b1de3490a00968 🔍`
SHA1	`892812378c74b644ea7f74178aebdc9a285ee3f9 🔍`
SHA256	`b8a4b4d6c56516f44ef8260056cd6e1ad8c0d20d7c926ab80c1107826f6842f6 🔍`
SHA3	`609d9383c3d3dd73b4c33c764c521d2f0c3b1c70889c7d3ea8068ae1dafab80e 🔍`
VirtualSize	`0x3e58`
VirtualAddress	`0x67000`
SizeOfRawData	`0x4000`
PointerToRawData	`0x63400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.58678`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x6b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x67400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`7e5704b3ac97f0349e901e7e65b26c96 🔍`
SHA1	`f94029cc5a94f7067e177696d8f515e4a6de53c4 🔍`
SHA256	`7311ac1946e410f65dc7ab90433d3308074b7b6c43ea5e4b7f0812c0822c753c 🔍`
SHA3	`910747e68584f27c3f9f8f5c3bce075d762594a2e9bd6332ed1d91ba63e63919 🔍`
VirtualSize	`0x16f18c8`
VirtualAddress	`0x6c000`
SizeOfRawData	`0x16f1a00`
PointerToRawData	`0x67600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99996`

.reloc

MD5	`d8070438767fba7acfeff6079d95a946 🔍`
SHA1	`1b1858d601171a2e949ea90559ab6467543e600d 🔍`
SHA256	`c614b51917929a584d458816faeae9b2e1e640f2746f3e7ef1dc506449ced701 🔍`
SHA3	`127d92ea8bb17c69b21292d0f1ef11d6ea68f44897556c4ee5f6e1aa23d868e7 🔍`
VirtualSize	`0xa1c`
VirtualAddress	`0x175e000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x1759000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.06817`

Imports

USER32.dll	`GetMessageW` `TranslateMessage` `DispatchMessageW` `PostMessageW` `GetAsyncKeyState` `GetCursorPos` `ScreenToClient` `SetWindowLongPtrW` `FindWindowW` `SetWindowsHookExW` `CallNextHookEx`
CRYPT32.dll	`CertFreeCertificateContext` `CertCloseStore` `CertFindCertificateInStore` `CryptStringToBinaryA` `CertAddCertificateContextToStore` `CertOpenStore` `CertCreateCertificateContext`
WINHTTP.dll	`WinHttpReceiveResponse` `WinHttpSendRequest` `WinHttpOpenRequest` `WinHttpQueryDataAvailable` `WinHttpReadData` `WinHttpConnect` `WinHttpCloseHandle` `WinHttpOpen` `WinHttpQueryHeaders`
bcrypt.dll	`BCryptCreateHash` `BCryptHashData` `BCryptFinishHash` `BCryptDestroyHash` `BCryptCloseAlgorithmProvider` `BCryptOpenAlgorithmProvider`
KERNEL32.dll	`IsValidLocale` `GetLocaleInfoW` `GetUserDefaultLCID` `EnumSystemLocalesW` `GetFileType` `FlushFileBuffers` `GetConsoleOutputCP` `ReadFile` `GetFileSizeEx` `LCMapStringW` `CompareStringW` `UnhandledExceptionFilter` `IsDebuggerPresent` `GetCommandLineW` `GetCommandLineA` `WriteFile` `SetEndOfFile` `WriteConsoleW` `HeapSize` `CreateFileW` `SetStdHandle` `GetProcessHeap` `AddVectoredExceptionHandler` `Sleep` `GetModuleFileNameW` `SetConsoleCtrlHandler` `SetConsoleOutputCP` `GetStdHandle` `GetEnvironmentVariableW` `GetConsoleMode` `SetConsoleMode` `GetConsoleScreenBufferInfo` `SetConsoleTextAttribute` `SetConsoleTitleW` `GetLastError` `GetModuleHandleW` `SetFilePointerEx` `LockResource` `SizeofResource` `FindResourceW` `DeleteFileW` `SetFileAttributesW` `GetTempPathW` `CloseHandle` `GetCurrentProcessId` `MoveFileExW` `CreateToolhelp32Snapshot` `Process32FirstW` `Process32NextW` `TerminateProcess` `GetExitCodeProcess` `CreateProcessW` `OpenProcess` `QueryFullProcessImageNameW` `GetCurrentProcess` `GetCurrentThreadId` `OpenThread` `SuspendThread` `ResumeThread` `GetProcessMitigationPolicy` `SetProcessMitigationPolicy` `GetProcAddress` `LoadLibraryExW` `K32GetModuleInformation` `Thread32First` `Thread32Next` `GetTempFileNameW` `WaitForSingleObject` `VirtualProtect` `GetProcessId` `GetModuleHandleA` `VirtualProtectEx` `WriteProcessMemory` `CreateThread` `HeapCreate` `HeapAlloc` `HeapReAlloc` `HeapFree` `GetThreadContext` `SetThreadContext` `FlushInstructionCache` `GetSystemInfo` `VirtualAlloc` `VirtualFree` `VirtualQuery` `RaiseException` `LoadResource` `ReadConsoleW` `IsProcessorFeaturePresent` `GetModuleHandleExW` `FreeLibrary` `ExitProcess` `FlsFree` `FlsSetValue` `FlsGetValue` `FlsAlloc` `SetLastError` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `GetOEMCP` `GetACP` `IsValidCodePage` `LocalFree` `FormatMessageA` `GetLocaleInfoEx` `CreateDirectoryW` `FindClose` `FindFirstFileW` `FindFirstFileExW` `FindNextFileW` `GetFileAttributesW` `GetFileAttributesExW` `SetFileInformationByHandle` `CreateFile2` `AreFileApisANSI` `GetFileInformationByHandleEx` `MultiByteToWideChar` `WideCharToMultiByte` `QueryPerformanceCounter` `QueryPerformanceFrequency` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `EncodePointer` `DecodePointer` `LCMapStringEx` `GetStringTypeW` `GetCPInfo` `SetUnhandledExceptionFilter` `GetStartupInfoW` `GetSystemTimeAsFileTime` `InitializeSListHead`
IPHLPAPI.DLL	`GetExtendedTcpTable`
WS2_32.dll	`closesocket` `connect` `ioctlsocket` `htonl` `htons` `ntohs` `select` `socket` `WSAStartup` `WSAGetLastError`
ntdll.dll	`RtlLookupFunctionEntry` `RtlUnwindEx` `RtlCaptureContext` `RtlVirtualUnwind` `RtlUnwind` `RtlPcToFileHeader`

Delayed Imports

1001

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x16f0df6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99996`
MD5	`a25d8b1370c1b440cd583cac98378df3 🔍`
SHA1	`82f0b1c056cc90690f79a7ab9dfe8c77d59a2379 🔍`
SHA256	`6bc95ee8289ee3767b43059af0069d036ed1f8a4988c99227e0b64f1d6391c56 🔍`
SHA3	`4d0a6a0c3802b97ef4fca0390884a14ea4b268692ea7870d19011e8fa3aa015d 🔍`

1002

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4d5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.86153`
MD5	`f09e1b7a7c6cc38914ffef3c3bff8092 🔍`
SHA1	`0f8180e5186c0e7b8a25fab59758e6e824f0819d 🔍`
SHA256	`a52be7b308022253d7a58e9c880915f5460e27d98c0b6a481d658a3578a19772 🔍`
SHA3	`8c345017dfa08db7295c2c1c6c95540f5912da59778888ab717b4db44c1541de 🔍`

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x526`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.12712`
MD5	`33e0626adbeb849d05f016e0f14eaefe 🔍`
SHA1	`ac81877c439b5b810febbb1f56253856b675cf5c 🔍`
SHA256	`73b8edb25ef58fb131435fb80700aea4dca0200791c0ef71252734953e6c832d 🔍`
SHA3	`d7ef6d6517591d72fff9e489b4f9144f159d9420b01e9886ded1acbad7963878 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Jul-24 05:07:18
Version	`0.0`
SizeofData	`940`
AddressOfRawData	`0x5b524`
PointerToRawData	`0x5a724`

TLS Callbacks

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140063380`

RICH Header

XOR Key	`0x2c86def6`
Unmarked objects	`0`
C++ objects (35215)	`173`
C objects (35215)	`18`
ASM objects (35215)	`7`
ASM objects (35721)	`10`
C objects (35721)	`16`
C++ objects (35721)	`83`
Imports (35215)	`17`
Total imports	`210`
C objects (36248)	`4`
C++ objects (36248)	`11`
Resource objects (36248)	`1`
151	`1`
Linker (36248)	`1`

Errors

Leave a comment

No comments yet.