cb9518e0f9fb8b53ef3adc3df2cd71e23b50398fe175b1d5440477d180f1da8b

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-May-12 17:40:52
Detected languages English - United States

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .;8D
Unusual section name found: .l{}
Unusual section name found: .P?Q
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Uses Microsoft's cryptographic API:
  • CryptGetHashParam
 Has Internet access capabilities:
  • WinHttpConnect
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 48/68 (Scanned on 2026-08-14 11:07:37) ALYac: Gen:Variant.Barys.512030
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Packed/Win.MalwareX-gen.R720980
Alibaba: Trojan:Win32/VMProtect.01b79dc6
Antiy-AVL: Trojan[Packed]/Win32.VMProtect
Arcabit: Trojan.Barys.D7D01E
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Gen:Variant.Barys.512030
Bkav: W32.Malware.F11F94C
CTX: exe.trojan.vmprotect
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
ESET-NOD32: Win32/Packed.VMProtect.ACI trojan
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Barys.512030 (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: W32/PossibleThreat
GData: Gen:Variant.Barys.512030
Google: Detected
Gridinsoft: Trojan.Heur!.02212023
K7AntiVirus: Riskware ( 005cdde61 )
K7GW: Riskware ( 005cdde61 )
Kingsoft: Win32.Troj.kepavll.v
Lionic: Trojan.Win32.VMProtect.4!c
Malwarebytes: Malware.AI.1219459597
MaxSecure: Trojan.Malware.324995110.susgen
McAfeeD: Real Protect-LS!C7849372055C
MicroWorld-eScan: Gen:Variant.Barys.512030
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.Kryptik@AI.82 (RDML:ngk1Paygo3F95rFaggRijQ)
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score
TrellixENS: Artemis!C7849372055C
TrendMicro: Trojan.Win32.ZYX.USBLGF26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLGF26
VIPRE: Gen:Variant.Barys.512030
Varist: W64/ABTrojan.OAYC-6984
ViRobot: Trojan.Win.Z.Vmprotect.6287872
Zillya: Trojan.VMProtect.Win32.147930
alibabacloud: VirTool:Win/Wacatac.B9nj

Hashes

MD5 c7849372055c177d86f8a2898573c105 🔍
SHA1 cc2a506f41d134d12362a80eacaef594512bf080 🔍
SHA256 cb9518e0f9fb8b53ef3adc3df2cd71e23b50398fe175b1d5440477d180f1da8b 🔍
SHA3 fc5a96c250ac5ee70b664a5ae4bbb378cdb8ab851f3d70414ddd1481e222ba93 🔍
SSDeep 98304:VbuLeIiRNeByyZ0eRGBMpXVxpdkoq9JWLp8gLkHsQdju1Ln7385/I+F+LzRQDuk:VbuLeICNpy5kooMbAj4oxNF+LzRQD 🔍
Imports Hash 383f2043001930d9aca2734e1d190ffd 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2026-May-12 17:40:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x165000
SizeOfInitializedData 0x154200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000655AE0 (Section: .P?Q)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xba9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x164e5c
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x13ce46
VirtualAddress 0x166000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x7880
VirtualAddress 0x2a3000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xe1f0
VirtualAddress 0x2ab000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.;8D

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2eddba
VirtualAddress 0x2ba000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.l{}

MD5 007539b721096d44958e4b7707deff55 🔍
SHA1 834408ee272108632f0be27a6ed0ba3ba1b04f9c 🔍
SHA256 f30fdd63afca57aac53c74acbcfd0f96a35c9670ba6a0d3783e4206786d4cb80 🔍
SHA3 c8246f129defb33a7dd69034061fac98fe891c978d5eeaf582c9dbd6a6b2fa94 🔍
VirtualSize 0x17a0
VirtualAddress 0x5a8000
SizeOfRawData 0x1800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.243607

.P?Q

MD5 ad0e46a8c65ec57c12f6b55913a49837 🔍
SHA1 6d80b501c59694afa2684d9627d8a482b60d760e 🔍
SHA256 0785cc742067d0702991d697d4bdc1f1e93cbc59cb030013c90157f1dee94ec3 🔍
SHA3 af54ac2ac0ce0c01eb5713010503f810a8fbca5d4dfe101478ab223cbc16e13b 🔍
VirtualSize 0x5fbf74
VirtualAddress 0x5aa000
SizeOfRawData 0x5fc000
PointerToRawData 0x1c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.98474

.reloc

MD5 17ed7aacd4613fe91e39ba4c7c62a37f 🔍
SHA1 a1fd0af53f3a8902c0bd0268dc3335ea61a6495c 🔍
SHA256 882b88944e7b364af707e6e074feca3d5b94dc26eab84dc8d2ed229066163def 🔍
SHA3 1d2f74d43b296358f984ef89f28eeba1e5c83ef1ff40559758688745235b40e4 🔍
VirtualSize 0x134c
VirtualAddress 0xba6000
SizeOfRawData 0x1400
PointerToRawData 0x5fdc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.44933

.rsrc

MD5 b853360a077825d319db1f4602ebe940 🔍
SHA1 111634b1ce7b3b3b2b1a06c61937d13457f2d5c3 🔍
SHA256 3f053cb36a17aa1dd1f555ba3bcf04c2fd99a376f91e4357b3f1f652a89b25c7 🔍
SHA3 80bf3f346ac531cde71b99910a95f253d2b485b38a5f52f87b816d063a05c57f 🔍
VirtualSize 0x1d5
VirtualAddress 0xba8000
SizeOfRawData 0x200
PointerToRawData 0x5ff000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7123

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
KERNEL32.dll ReleaseSRWLockExclusive
USER32.dll GetCursorPos
ADVAPI32.dll CryptGetHashParam
SHELL32.dll SHGetFolderPathA
IMM32.dll ImmSetCompositionWindow
D3DCOMPILER_43.dll D3DCompile
dwmapi.dll DwmEnableBlurBehindWindow
MSVCP140.dll ?_Id_cnt@id@locale@std@@0HA
WINHTTP.dll WinHttpConnect
WININET.dll HttpOpenRequestA
WINMM.dll timeGetTime
CRYPT32.dll CertFreeCertificateChain
WS2_32.dll accept
SHLWAPI.dll PathFindFileNameW
PSAPI.DLL GetModuleInformation
USERENV.dll UnloadUserProfile
bcrypt.dll BCryptGenRandom
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll strrchr
api-ms-win-crt-stdio-l1-1-0.dll fputs
api-ms-win-crt-utility-l1-1-0.dll rand
api-ms-win-crt-string-l1-1-0.dll isalnum
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
api-ms-win-crt-convert-l1-1-0.dll strtol
api-ms-win-crt-math-l1-1-0.dll _dclass
api-ms-win-crt-runtime-l1-1-0.dll _invoke_watson
api-ms-win-crt-filesystem-l1-1-0.dll _fstat64
api-ms-win-crt-locale-l1-1-0.dll ___lc_codepage_func
api-ms-win-crt-time-l1-1-0.dll strftime
api-ms-win-crt-environment-l1-1-0.dll getenv
KERNEL32.dll (#2) ReleaseSRWLockExclusive
KERNEL32.dll (#3) ReleaseSRWLockExclusive

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1402a3f40

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .;8D has a size of 0!
Leave a comment

No comments yet.