ccac33be2e9b95d5f1a44a6a7f64ed08

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2013-Aug-06 07:53:03

Plugin Output

Info Matching compiler(s): Microsoft Visual C++
Microsoft Visual C++ v6.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • dumpcap.exe
  • filemon.exe
  • procexp.exe
  • procmon.exe
  • regmon.exe
  • rundll32.exe
  • tcpdump.exe
  • wireshark.exe
Contains references to debugging or reversing tools:
  • immunitydebugger.exe
  • ollydbg.exe
  • windbg.exe
Contains references to security software:
  • apimonitor.exe
  • monitor.exe
Looks for VMWare presence:
  • vmtools
  • vmware
Looks for VirtualBox presence:
  • vboxservice
  • vboxtray
Suspicious The PE is possibly packed. The PE only has 0 import(s).
Suspicious The file contains overlay data. 17920 bytes of data starting at offset 0x3a00.
Malicious VirusTotal score: 19/69 (Scanned on 2019-10-07 09:40:17) McAfee: RDN/Generic.hra
CrowdStrike: win/malicious_confidence_100% (D)
Symantec: Trojan.Sofacy
Avast: Win32:Agent-AUHS [Trj]
ClamAV: Win.Trojan.Sofacy-5
Endgame: malicious (high confidence)
McAfee-GW-Edition: Artemis!Trojan
FireEye: Generic.mg.ccac33be2e9b95d5
Sophos: Mal/Generic-S
SentinelOne: DFI - Malicious PE
Cyren: W32/Trojan.YKDM-4500
AegisLab: Trojan.Win32.Generic.4!c
Microsoft: Trojan:Win32/Foosace.D!dha
ALYac: Trojan.Sofacy.gen
TrendMicro-HouseCall: TROJ_GEN.R002H01J419
Ikarus: Trojan.Win32.Foosace
eGambit: Trojan.Generic
AVG: Win32:Agent-AUHS [Trj]
Panda: Trj/CI.A

Hashes

MD5 ccac33be2e9b95d5f1a44a6a7f64ed08
SHA1 2541bd798b3b207da05cd90d63d06a7e4c573129
SHA256 c336f8f6995363b3c769a8639a2e8986a9e700311db8043a867895e1f8c6a328
SHA3 5898d9155fbe2eb65f0291cc5143a3fde14306db733cb99cedacb2e9b82cb714
SSDeep 192:/3u/8FFMJn7Qm4ajbqrMM89ZIDMm/6X7U/pj20AEaUJAmfOxCj3IwIsW9WWEUJj:fukanEXajPXZO4X7mTtOxWNTW9WWfjl
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2013-Aug-06 07:53:03
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x2000
SizeOfInitializedData 0x1600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00002770 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x3000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x7000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 14178a1ee15ce12dbe439d8847e8a9fe
SHA1 dcb47d629d10d7c0a31d68b5495116969513230c
SHA256 ac744c2e8fe55ddc8b2ca22d5cea686f4309c4c0e8eef12e1dc324cf28c63169
SHA3 351a3d8071b1c843f13a427d0503aa533c67e2c69e5a43d8df9230d55a86202d
VirtualSize 0x1e83
VirtualAddress 0x1000
SizeOfRawData 0x2000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.51079

.rdata

MD5 4d7d6afa080e511d9147bddc4e743f06
SHA1 be47d2b50075b754e783189f5dac5d91e65ce5dd
SHA256 34eb994b37f7b16af752c0b8285b9fd08fba36345f34973755dce009d128f5bf
SHA3 67a8a54f33e734df17652592b76b84ae283cf0868e47dfdf975d16a4016375c2
VirtualSize 0x1b5
VirtualAddress 0x3000
SizeOfRawData 0x200
PointerToRawData 0x2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.31298

.data

MD5 c49e20bb7ae60d667c6edb5c9bf79c6a
SHA1 8080e483f5d612d84e123fe5acf39214438c2aaa
SHA256 80888c3168bece1870af3644e6e1a8a1b88097152bc780da412013a675e942c2
SHA3 41a15281c2ce2db5b792eeafdea1f96f5e19a898c7f02a4020620f13d5d9a494
VirtualSize 0x92c
VirtualAddress 0x4000
SizeOfRawData 0xa00
PointerToRawData 0x2600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.65607

.rsrc

MD5 e15d7305d354dda65727a0d7ab19d6dc
SHA1 ff3738d63c257e93bfbf1f35847a2cee0c9e408f
SHA256 d659fc306ed5a35280b3024dbf90fc195ea534548a44cd6d10fb2fab036fea6e
SHA3 995a261c0facd0cf55251825a1fd86a0035c7c384711110a00a13cfef6cbd1c3
VirtualSize 0x450
VirtualAddress 0x5000
SizeOfRawData 0x600
PointerToRawData 0x3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.64464

.reloc

MD5 0f343b0931126a20f133d67c2b018a3b
SHA1 60cacbf3d72e1e7834203da608037b1bf83b40e8
SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
SHA3 6841b2c10aa6e5f7a384143e4de58fbc9aa28a4b742e9ad4ed14ba148a723a43
VirtualSize 0x31c
VirtualAddress 0x6000
SizeOfRawData 0x400
PointerToRawData 0x3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0

Imports

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not read an import's name. [*] Warning: IMAGE_EXPORT_DIRECTORY field Characteristics is reserved and should be 0! [!] Error: Could not read the exported DLL name. [!] Error: The PE's resource section is invalid or has been manually modified. Resources will not be parsed.