ca8e91bc6ff3f6a6275ad7268462e0ba

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Nov-30 14:55:07
ProductName MeGaHeRTZ LoaDeR
ProductVersion
CompanyName MeGaHeRTZ TeaM
FileDescription MeGaHeRTZ LoaDeR
FileVersion
InternalName Loader
LegalCopyright MeGaHeRTZ TeaM
OriginalFilename Loader.exe

Plugin Output

Suspicious PEiD Signature: ASPack v2.12
PolyEnE 0.01+ by Lennart Hedlund
Suspicious The PE is possibly packed. Unusual section name found: Hey
Section Hey is both writable and executable.
Unusual section name found: you!!
Section you!! is both writable and executable.
Unusual section name found: PLeaSe
Unusual section name found: SToP!
Unusual section name found: FuCK
Unusual section name found: STuPiD
Section STuPiD is both writable and executable.
Unusual section name found: Guy!
Section Guy! is both writable and executable.
The PE only has 3 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Malicious VirusTotal score: 28/66 (Scanned on 2018-01-02 03:38:49) Bkav: W32.HfsAutoB.3168
MicroWorld-eScan: Trojan.Generic.22768510
McAfee: RDN/Generic.grp
Cylance: Unsafe
K7GW: Riskware ( 0040eff71 )
K7AntiVirus: Riskware ( 0040eff71 )
TrendMicro: TROJ_GEN.R002C0OLQ17
Symantec: Trojan.Gen.2
TrendMicro-HouseCall: TROJ_GEN.R002C0OLQ17
Paloalto: generic.ml
BitDefender: Trojan.Generic.22768510
ViRobot: Trojan.Win32.Z.Agent.81920.BZM
Tencent: Suspicious.Heuristic.Gen.b.0
Sophos: Mal/Behav-023
F-Secure: Trojan.Generic.22768510
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.Sdbot.mc
Emsisoft: Trojan.Generic.22768510 (B)
SentinelOne: static engine - malicious
Webroot: W32.Malware.Gen
Endgame: malicious (high confidence)
Arcabit: Trojan.Generic.D15B6B7E
AegisLab: Troj.Gen!c
GData: Trojan.Generic.22768510
ALYac: Trojan.Generic.22768510
Fortinet: PossibleThreat
Panda: Trj/Agent.AMR
CrowdStrike: malicious_confidence_90% (W)

Hashes

MD5 ca8e91bc6ff3f6a6275ad7268462e0ba
SHA1 c582a284a334747a2d23533f3045b2ec30d37320
SHA256 1dc37bcd0529f47040181f7cddbcc4cef2fa4a44ade1dc08e655f22f1fa04a7d
SHA3 38f8821f486c9ff993f34ef21b044aee8c12b0a10b8805b82448de10ceeb8c17
SSDeep 1536:0PZI8LsNDlo8C0sYJ05ZwMXmSVdqQ3CIWEdJxjUYiIToiRrw:q2V3sYCLwMnqQScto
Imports Hash 5a498eee87e4d89512a84502f500181f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2017-Nov-30 14:55:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x16c00
SizeOfInitializedData 0xd000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x27001 (Section: STuPiD)
BaseOfCode 0x1000
BaseOfData 0x19000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x32000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics (EMPTY)
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

Hey

MD5 de4854981af05cfdaaf89da001c0ad69
SHA1 79779573837330cac1856ee5fb1b278819b93b08
SHA256 5cf0c69adfada206654a308605ff3ddda64dee154354f3b1d4f2434eaa419f8e
SHA3 9b0fcf8e9efeac8c18e1bd39cc8a24c35280df15ae6b3f04417443dd91650d80
VirtualSize 0x10000
VirtualAddress 0x1000
SizeOfRawData 0x3a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.9862

you!!

MD5 166bc23c566737f95863d3e7ef3efd67
SHA1 f9235491ae2e4227b1406c7cad9f95a71c28e86c
SHA256 66708ded88f978b61218251f9de572db4be6c867486d061138ba4aadffcaa8d5
SHA3 4615dc046502e9f60c2ee5791d243c39470a3f4e542ab279b693297eb53d1d7b
VirtualSize 0x8000
VirtualAddress 0x11000
SizeOfRawData 0x4800
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.93871

PLeaSe

MD5 cf670745c6c0806633aa5ec0f783f9ad
SHA1 2ceb6ee35ed8c3e16da44222c06be04ee02cfae8
SHA256 52c7173b8f33b7f80368dfffa7dff67146c7dcbc151cb5b9108cd33a5f90b406
SHA3 dcee88474d92fb8a7935aae23cd247268ebfb87684b6857ea767668df815a3f1
VirtualSize 0x1000
VirtualAddress 0x19000
SizeOfRawData 0x800
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.67738

SToP!

MD5 079e66b04ad930c635e9e08b5311da21
SHA1 888669f3b052a24cbd236cc08cd129d8b2bfae67
SHA256 fcbd702fc3bd1cb8f873a8d736c270c0d6eaf7ad9d979bae394521da1fbcf64b
SHA3 2a0e7ed09976c1e3d6fadb51e447ceab24b28f49b43f6bcb2a6d31930f0c7bf5
VirtualSize 0x4000
VirtualAddress 0x1a000
SizeOfRawData 0x1200
PointerToRawData 0x8e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.90624

FuCK

MD5 2275094c9d98ef5366353c9932ec59b8
SHA1 e7f7ee9b55750fee21ce63a580bb6ea3b3d3e468
SHA256 ecf84caedd959a7af40f5dea44b3bd33321428c2e2f65a6065784aeda3803374
SHA3 5c5e9b93b7c7b6cad4d64ca0784d5a490508077a092bec068bafa4b202c95a6f
VirtualSize 0x9000
VirtualAddress 0x1e000
SizeOfRawData 0x200
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.28477

STuPiD

MD5 980da8f5945551b04af66c93fe4d77e0
SHA1 92d51d2013c90cd8e92f84b069b8a5d6d4be9068
SHA256 07ad551acdcac73a61a47bf67fab9577b9cb71587d21efbfcc59808487ece34f
SHA3 3e53f42ac97bbdabd0c301fb7ebf23022d742d522fbd506ac25df8aa3f9753ee
VirtualSize 0xa000
VirtualAddress 0x27000
SizeOfRawData 0x9e00
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.79271

Guy!

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470
VirtualSize 0x1000
VirtualAddress 0x31000
SizeOfRawData 0
PointerToRawData 0x14000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

Imports

kernel32.dll GetProcAddress
GetModuleHandleA
LoadLibraryA

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x6275
Entropy 7.95828
Detected Filetype PNG graphic file
MD5 5f6d7cb732fd9c99c190fa9aa4ce2f1e
SHA1 dba43f902dd2fe25d35ba3b6d6d1d9b3263550da
SHA256 c1e81b32d8e4ed98ddc45670941dd61d207cf7b97f736d1f9ccba22ca8d7c32a
SHA3 326ed89b952dcd81084198d89bfcbb0306d5300ab599aa4ee7c225a4e73cb426

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
Entropy 1.48439
MD5 a4728af480311356e1ad322c4b4d2901
SHA1 eb896686608953a2fccfacb4437e5d441b526cf3
SHA256 fdc7ab5503ce1765a875a8da6af6b458db054549e1b1a9510fd3fdbecffdd16a
SHA3 7ac4c542ddf45bbb6a841e7cb3457ac0bb8f1ecb80d4822019b8ee5f30a4312c

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x22
Entropy 2.13339
Detected Filetype Icon file
MD5 7c2537fb37d9e809420f92d310e08a33
SHA1 9bebe9fecdd5efc84be65d02a4cb35d72c921a32
SHA256 7c73e356c1584a455a18bec7ffc0dc074376cb72c3d32bb1ce7fe9459d31c688
SHA3 70e3294d98f13d23459625f81befda29fa835762059400045155fc72454514de

1 (#3)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2ac
Entropy 3.20589
MD5 e7b6d7de0f099daf4c89393401fe6644
SHA1 49531b8aec5bf2ec5c81c9cc6068b4d35c9278ea
SHA256 a0ced1fb0c2c264feca048f87ed50a8f8b929f0dbaeff806abe5259994b9a322
SHA3 02b5728f3c5e9b0a3195a5639fa78da3544994eb08eaf06758fe094fbab00123

1 (#4)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x26e
Entropy 4.90535
MD5 6035424b1073837927a0b2618014c09f
SHA1 2f7472da3064bcb94d980132c3d0b8abf9f397ed
SHA256 7068ec0aa7ff8b1df8a22517ec625235766735f7ca938e1aa5ad34e1066b6332
SHA3 20a24eed9015f46e9ab83337d863eff1ba3153c242a2f094aa825fa4e98091f8

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags VS_FF_DEBUG
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
ProductName MeGaHeRTZ LoaDeR
ProductVersion (#2)
CompanyName MeGaHeRTZ TeaM
FileDescription MeGaHeRTZ LoaDeR
FileVersion (#2)
InternalName Loader
LegalCopyright MeGaHeRTZ TeaM
OriginalFilename Loader.exe
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section Guy! has a size of 0! [*] Warning: Section Guy! has a size of 0!