ce0b6999ca953189f336b6d418b1ccb7

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2020-Jan-05 12:15:27

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • ntohl
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 6153348 bytes of data starting at offset 0x46200.
The overlay data has an entropy of 7.98963 and is possibly compressed or encrypted.
Overlay data amounts for 95.5403% of the executable.
Malicious VirusTotal score: 4/70 (Scanned on 2023-04-23 16:14:11) APEX: Malicious
ClamAV: Win.Dropper.Detected-9969224-0
McAfee-GW-Edition: BehavesLike.Win64.Agent.vc
Google: Detected

Hashes

MD5 ce0b6999ca953189f336b6d418b1ccb7
SHA1 e893296ccae17f627f16c99fd7e3e5d16cad961d
SHA256 47df6391fb63494de914e36ef06c35c66b408b9b3d78c5bc83cad8f78cf0edc6
SHA3 4559f3db10cafccca6cd995c06a69cbfbf391f60b00768fba21b96ddd8b00421
SSDeep 98304:PU98+VJ9FevzX4hhcYMeBFh5iFIRv2Vb84e4EvtAocyBQPnRNJe1B+XKmbF/ZQs:Pafne7XbeR5U84sGRNJp5esulRBjwHY
Imports Hash 7aa1951517b3b8d38b12f874b66196c9

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2020-Jan-05 12:15:27
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21600
SizeOfInitializedData 0x24800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000008B14 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x59000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bc76aa9332c27788b891bf46421d2261
SHA1 686c80d3a8c6ec573a5c6ffec549cad4bb0a678a
SHA256 cb7cce6853729802c59d8b2371573b1d807180eb07dc52cabe8bdce46d6bbccb
SHA3 65a7d369a5d960b36a306c893e459eb1db6966cef5ace4dcf57206437e94db47
VirtualSize 0x214d0
VirtualAddress 0x1000
SizeOfRawData 0x21600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45785

.rdata

MD5 ffb1fcb4e358028e22b7048afa07095b
SHA1 02ddad3a50d506a6c99e5b3dc6a07c74f19c58d7
SHA256 15a56cb31592fb28a104e40d74875614919201e4df622e9498f4eae25f55f3c0
SHA3 8785d12699279c3006f73dd1c859f98ec357ce28002baab673d347c3b47a9480
VirtualSize 0xf49e
VirtualAddress 0x23000
SizeOfRawData 0xf600
PointerToRawData 0x21a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.83487

.data

MD5 e001c48c58a83fc36b1ec29411188fa4
SHA1 5203faefd2291bfaffc2738d35c00d2fb6da126b
SHA256 9882f044a326f172e5819392d47e875664b0b6e27fa8e727491b11610869260d
SHA3 7830e8f91b5192569c0285f2617b20c96c86f56e8e04d49bdc2b822a59b35fda
VirtualSize 0xf108
VirtualAddress 0x33000
SizeOfRawData 0xc00
PointerToRawData 0x31000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.84757

.pdata

MD5 2d86c7785fa4cdbeee10fa69a2e2d271
SHA1 625726f93f714083cc036be0032c9831c09a5e0a
SHA256 af4c7f89891ee7a467a0e3667c1d65a994cfa9e381481107a0a73df865adbf81
SHA3 77171c94d107898995ee3fd39d2b5a3cd1bc847f86a549d6c81c7be9b652a37f
VirtualSize 0x1d10
VirtualAddress 0x43000
SizeOfRawData 0x1e00
PointerToRawData 0x31c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.22925

.gfids

MD5 4ca521d659f21e53989de742d2577e62
SHA1 ab0eeab214975ac81307258033a40b34f277929e
SHA256 b2325b63a1da49ed3306a132e879fb2ad3dd3ca7bc3d024b361f322287b3679c
SHA3 929ef5c35d504b513bee15816bd5069061ea9de82e77270018884c2a36b03f68
VirtualSize 0xac
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x33a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.72035

.rsrc

MD5 6a570329e64389431974c04631d5952b
SHA1 19201462fa5d02d5bf77ad9d780905bb5cf37dc3
SHA256 435d6727452cca845d63ed530d3a0a849ea4588b00df8afcde175d141f19f7e3
SHA3 5a425645872692e7923ff3c6e44987d21300149407393e8f7aeaf07af481d979
VirtualSize 0x11dec
VirtualAddress 0x46000
SizeOfRawData 0x11e00
PointerToRawData 0x33c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.56501

.reloc

MD5 7df6f38c84844da9738fba2d2a443f7f
SHA1 09b4da2d7f37b424aeb8df0b7632a1c8594c96b7
SHA256 cb41bb86c2112e09afbc8136608737abb0546f4114d4afc43569cbab15e1a7e9
SHA3 1c398c095d035089b5c1ddc3d8c79ae6690ea575e50ec72207e8f7dd97a8c21e
VirtualSize 0x690
VirtualAddress 0x58000
SizeOfRawData 0x800
PointerToRawData 0x45a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.9923

Imports

KERNEL32.dll GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
SetDllDirectoryW
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetExitCodeProcess
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
ADVAPI32.dll ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll ntohl

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3dd6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.94696
Detected Filetype PNG graphic file
MD5 eabd0c25778c00b98fd0582a26080082
SHA1 907a9461e4f74c551c8b3cee00e446cf3c766ecb
SHA256 382131e76b9d49e33ed874b2de04d057b3a2258bdb9796c30573f27b96d7574b
SHA3 ebed22ec87d4d5c5aa8ff449493fcd115aeb6b2d04601abc4cdb871fea977146

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.51664
Detected Filetype Icon file
MD5 6059a956a82010a366409c00e68cc327
SHA1 a339d03cc3e2c9a0f31200b463c483f600e05615
SHA256 99e72c069317b4fd5bc5ad467a5dfec7a4502a1c7ee2720968115106a64d77d1
SHA3 cc71a63e21f011adab305ff9fc54765dd6762d003b6bcef92be6efef364bbe04

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29227
MD5 da7fc00c6855b7856e41300ad8d75b2f
SHA1 feb7aef0a733ffb54bf1b51fb25a82b8158458a9
SHA256 4027629a3ca95775d2483049c305ffaae8295c37cd15552973680711976066fb
SHA3 e172ff2d9ca9c42ec3f13853ad90ffc612ebed7f10127b01c5b9b9ad9f917629

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2020-Jan-05 12:15:27
Version 0.0
SizeofData 720
AddressOfRawData 0x2fab8
PointerToRawData 0x2e4b8

TLS Callbacks

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140033010

RICH Header

XOR Key 0x86ac5c9d
Unmarked objects 0
241 (40116) 7
243 (40116) 169
242 (40116) 13
ASM objects (VS2015 UPD3 build 24123) 7
C++ objects (VS2015 UPD3 build 24123) 28
C objects (VS2015 UPD3 build 24123) 19
Imports (65501) 7
Total imports 115
C objects (VS2015 UPD3 build 24210) 17
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors

<-- -->