ca8e91bc6ff3f6a6275ad7268462e0ba

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Nov-30 14:55:07
ProductName MeGaHeRTZ LoaDeR
ProductVersion
CompanyName MeGaHeRTZ TeaM
FileDescription MeGaHeRTZ LoaDeR
FileVersion
InternalName Loader
LegalCopyright MeGaHeRTZ TeaM
OriginalFilename Loader.exe

Plugin Output

Suspicious PEiD Signature: ASPack v2.12
PolyEnE 0.01+ by Lennart Hedlund
Suspicious The PE is possibly packed. Unusual section name found: Hey
Section Hey is both writable and executable.
Unusual section name found: you!!
Section you!! is both writable and executable.
Unusual section name found: PLeaSe
Unusual section name found: SToP!
Unusual section name found: FuCK
Unusual section name found: STuPiD
Section STuPiD is both writable and executable.
Unusual section name found: Guy!
Section Guy! is both writable and executable.
The PE only has 3 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Malicious VirusTotal score: 28/66 (Scanned on 2018-01-02 03:38:49) Bkav: W32.HfsAutoB.3168
MicroWorld-eScan: Trojan.Generic.22768510
McAfee: RDN/Generic.grp
Cylance: Unsafe
K7GW: Riskware ( 0040eff71 )
K7AntiVirus: Riskware ( 0040eff71 )
TrendMicro: TROJ_GEN.R002C0OLQ17
Symantec: Trojan.Gen.2
TrendMicro-HouseCall: TROJ_GEN.R002C0OLQ17
Paloalto: generic.ml
BitDefender: Trojan.Generic.22768510
ViRobot: Trojan.Win32.Z.Agent.81920.BZM
Tencent: Suspicious.Heuristic.Gen.b.0
Sophos: Mal/Behav-023
F-Secure: Trojan.Generic.22768510
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.Sdbot.mc
Emsisoft: Trojan.Generic.22768510 (B)
SentinelOne: static engine - malicious
Webroot: W32.Malware.Gen
Endgame: malicious (high confidence)
Arcabit: Trojan.Generic.D15B6B7E
AegisLab: Troj.Gen!c
GData: Trojan.Generic.22768510
ALYac: Trojan.Generic.22768510
Fortinet: PossibleThreat
Panda: Trj/Agent.AMR
CrowdStrike: malicious_confidence_90% (W)

Hashes

MD5 ca8e91bc6ff3f6a6275ad7268462e0ba
SHA1 c582a284a334747a2d23533f3045b2ec30d37320
SHA256 1dc37bcd0529f47040181f7cddbcc4cef2fa4a44ade1dc08e655f22f1fa04a7d
SHA3 1b344bf528e757dd2568fbd916ef7be74228fe87dd3137c67ee51bf787473148
SSDeep 1536:0PZI8LsNDlo8C0sYJ05ZwMXmSVdqQ3CIWEdJxjUYiIToiRrw:q2V3sYCLwMnqQScto
Imports Hash 5a498eee87e4d89512a84502f500181f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2017-Nov-30 14:55:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x16c00
SizeOfInitializedData 0xd000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00027001 (Section: STuPiD)
BaseOfCode 0x1000
BaseOfData 0x19000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x32000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

Hey

MD5 de4854981af05cfdaaf89da001c0ad69
SHA1 79779573837330cac1856ee5fb1b278819b93b08
SHA256 5cf0c69adfada206654a308605ff3ddda64dee154354f3b1d4f2434eaa419f8e
SHA3 e1611a7643888b78b1299abdea883275d515ffffc9de29df08d0548b93e20689
VirtualSize 0x10000
VirtualAddress 0x1000
SizeOfRawData 0x3a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.9862

you!!

MD5 166bc23c566737f95863d3e7ef3efd67
SHA1 f9235491ae2e4227b1406c7cad9f95a71c28e86c
SHA256 66708ded88f978b61218251f9de572db4be6c867486d061138ba4aadffcaa8d5
SHA3 253d1f82532d8687c0f463008c1e2f2571e68292d9731de877efe25a10b6b53b
VirtualSize 0x8000
VirtualAddress 0x11000
SizeOfRawData 0x4800
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.93871

PLeaSe

MD5 cf670745c6c0806633aa5ec0f783f9ad
SHA1 2ceb6ee35ed8c3e16da44222c06be04ee02cfae8
SHA256 52c7173b8f33b7f80368dfffa7dff67146c7dcbc151cb5b9108cd33a5f90b406
SHA3 c4bc30fc3a79f8b177990a54418e3fed1bf8a4427ad7801b54ec4943b9a79dca
VirtualSize 0x1000
VirtualAddress 0x19000
SizeOfRawData 0x800
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.67738

SToP!

MD5 079e66b04ad930c635e9e08b5311da21
SHA1 888669f3b052a24cbd236cc08cd129d8b2bfae67
SHA256 fcbd702fc3bd1cb8f873a8d736c270c0d6eaf7ad9d979bae394521da1fbcf64b
SHA3 ab55cc350d57fe9a3ad561a543392edfc20ba6929a1cd85b6e1f827cfb4d9167
VirtualSize 0x4000
VirtualAddress 0x1a000
SizeOfRawData 0x1200
PointerToRawData 0x8e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.90624

FuCK

MD5 2275094c9d98ef5366353c9932ec59b8
SHA1 e7f7ee9b55750fee21ce63a580bb6ea3b3d3e468
SHA256 ecf84caedd959a7af40f5dea44b3bd33321428c2e2f65a6065784aeda3803374
SHA3 aa299e5f6bc329ac24a7d393fef7bb0493c03718df95ee54290193ec00ca15ae
VirtualSize 0x9000
VirtualAddress 0x1e000
SizeOfRawData 0x200
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.28477

STuPiD

MD5 980da8f5945551b04af66c93fe4d77e0
SHA1 92d51d2013c90cd8e92f84b069b8a5d6d4be9068
SHA256 07ad551acdcac73a61a47bf67fab9577b9cb71587d21efbfcc59808487ece34f
SHA3 8a61705d8235a60af43e5408947fe9db5c8778d21f00cc6c6cb5c53a9be205ae
VirtualSize 0xa000
VirtualAddress 0x27000
SizeOfRawData 0x9e00
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.79271

Guy!

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1000
VirtualAddress 0x31000
SizeOfRawData 0
PointerToRawData 0x14000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Imports

kernel32.dll GetProcAddress
GetModuleHandleA
LoadLibraryA

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x6275
TimeDateStamp 2017-Nov-30 14:55:07
Entropy 7.95828
Detected Filetype PNG graphic file
MD5 5f6d7cb732fd9c99c190fa9aa4ce2f1e
SHA1 dba43f902dd2fe25d35ba3b6d6d1d9b3263550da
SHA256 c1e81b32d8e4ed98ddc45670941dd61d207cf7b97f736d1f9ccba22ca8d7c32a
SHA3 e54b234e0880475c3f236eb8b1b3040efdf474fe03b95d068eae731e02703f09

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 2017-Nov-30 14:55:07
Entropy 1.48439
MD5 a4728af480311356e1ad322c4b4d2901
SHA1 eb896686608953a2fccfacb4437e5d441b526cf3
SHA256 fdc7ab5503ce1765a875a8da6af6b458db054549e1b1a9510fd3fdbecffdd16a
SHA3 61ba06105528de10d124955ba37e4cd7462eb321e6f0ef14d612b42b695555e0

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x22
TimeDateStamp 2017-Nov-30 14:55:07
Entropy 2.13339
Detected Filetype Icon file
MD5 7c2537fb37d9e809420f92d310e08a33
SHA1 9bebe9fecdd5efc84be65d02a4cb35d72c921a32
SHA256 7c73e356c1584a455a18bec7ffc0dc074376cb72c3d32bb1ce7fe9459d31c688
SHA3 0627722343aeddfcaaa9b62ad8c38c2d869e83b126489fb2dfd308fefa59a7b4

1 (#3)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2ac
TimeDateStamp 2017-Nov-30 14:55:07
Entropy 3.20589
MD5 e7b6d7de0f099daf4c89393401fe6644
SHA1 49531b8aec5bf2ec5c81c9cc6068b4d35c9278ea
SHA256 a0ced1fb0c2c264feca048f87ed50a8f8b929f0dbaeff806abe5259994b9a322
SHA3 8170520e65b6fd8d0741a071938bfefbfaec706874e93ae19ccf33f98cbe387a

1 (#4)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x26e
TimeDateStamp 2017-Nov-30 14:55:07
Entropy 4.90535
MD5 6035424b1073837927a0b2618014c09f
SHA1 2f7472da3064bcb94d980132c3d0b8abf9f397ed
SHA256 7068ec0aa7ff8b1df8a22517ec625235766735f7ca938e1aa5ad34e1066b6332
SHA3 de245fb8ea86830ad8ddd26a451d7b762e174f1707e77482fda4854396b947ab

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags VS_FF_DEBUG
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
ProductName MeGaHeRTZ LoaDeR
ProductVersion (#2)
CompanyName MeGaHeRTZ TeaM
FileDescription MeGaHeRTZ LoaDeR
FileVersion (#2)
InternalName Loader
LegalCopyright MeGaHeRTZ TeaM
OriginalFilename Loader.exe
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section Guy! has a size of 0!
<-- -->