d03848a6760af241d8641f65fbc2f166

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Aug-01 04:39:46

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Functions related to the privilege level:
  • OpenProcessToken
Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 15674098 bytes of data starting at offset 0x43c00.
The overlay data has an entropy of 7.99588 and is possibly compressed or encrypted.
Overlay data amounts for 98.2603% of the executable.
Malicious VirusTotal score: 39/67 (Scanned on 2021-11-29 17:35:55) MicroWorld-eScan: Trojan.GenericKD.47461715
CAT-QuickHeal: Trojanransom.Python
McAfee: Artemis!D03848A6760A
Cylance: Unsafe
K7AntiVirus: Trojan ( 0058abe71 )
BitDefender: Trojan.GenericKD.47461715
K7GW: Trojan ( 0058abe71 )
Cyren: W64/S-d6d7eeed!Eldorado
Symantec: W32.Beapy
ESET-NOD32: Python/Filecoder.JH
APEX: Malicious
Paloalto: generic.ml
Kaspersky: Trojan-Ransom.Python.Agent.av
Tencent: Python.Trojan-ransom.Agent.Av
Ad-Aware: Trojan.GenericKD.47461715
Emsisoft: Trojan.GenericKD.47461715 (B)
Comodo: TrojWare.Win32.Agent.fpyqf@0
Zillya: Trojan.Disco.Win32.1337
TrendMicro: TROJ_FRS.0NA103KM21
McAfee-GW-Edition: BehavesLike.Win64.Ransom.wc
FireEye: Trojan.GenericKD.47461715
Sophos: Mal/Generic-R + Troj/Ransom-GLB
Webroot: W32.Trojan.Gen
Antiy-AVL: Trojan/Generic.ASMalwS.34493BB
Kingsoft: Win32.Troj.Undef.(kcloud)
Microsoft: Trojan:Win64/Malgent!MSR
Gridinsoft: Ransom.Win64.Agent.sa
Arcabit: Trojan.Generic.D2D43553
GData: Trojan.GenericKD.47461715
VBA32: TrojanRansom.Python
ALYac: Trojan.Ransom.Filecoder
MAX: malware (ai score=100)
Malwarebytes: Trojan.Dropper.Python
Panda: Trj/CI.A
TrendMicro-HouseCall: TROJ_FRS.0NA103KM21
Fortinet: PossibleThreat.PALLASNET.H
AVG: FileRepMalware
Avast: FileRepMalware
CrowdStrike: win/malicious_confidence_100% (W)

Hashes

MD5 d03848a6760af241d8641f65fbc2f166
SHA1 df7c24b7358564751b5a7e649bc7b915f655c6e2
SHA256 09a0caadc4df3d4278368f94f52007894c2b51d3785d985cb8e42646e8a33b68
SHA3 5e46c9ef67201ee9b20cdce14f8d43257d6b02f251d86f83a9b6a659f4373ca5
SSDeep 393216:Gm2/QtcXInEroXJlh2pefEqirRRop9YNst0Y1vl:r2/Qa4ErUfQpswvKdWY
Imports Hash 7320b3cae0f7c7e579e85728a091f04b

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2021-Aug-01 04:39:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x23600
SizeOfInitializedData 0x20200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000A87C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x58000
SizeOfHeaders 0x400
Checksum 0xf38063
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 fbe9a9320dded9c9c127eba073379e5b
SHA1 e0b53e01618f2e1b86bdd1d66774aaa3947e8526
SHA256 ebe71cdf82ddae321ef23c651dbb29c0f090a4a44a679983d003e572953329d2
SHA3 7c75a3ace97699cf74aab9fb08522bbcac49d78d7e19c19097b74574230d04d3
VirtualSize 0x23570
VirtualAddress 0x1000
SizeOfRawData 0x23600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46764

.rdata

MD5 5d7dc94d58c9dbe6c8c89d77db6f9263
SHA1 07935390f582870e8d9c7c1840415351e326d9a5
SHA256 2305c7bc70ee2003c1964f209c6af86940fb135eb5d93b10458da9dbc59751bf
SHA3 8632893801f0da628fdc8ec4e149b472dee2c7b67ca4eaa81213f01cca836cd9
VirtualSize 0x11818
VirtualAddress 0x25000
SizeOfRawData 0x11a00
PointerToRawData 0x23a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.69896

.data

MD5 76e2b8b9b964af59eae8ba384fd1752d
SHA1 65065a27c520f61676824f5028bd9eaabf91eef1
SHA256 573226683dc0b81e726cdaae4f176199bc210f0676a6980bb48edc11305f0fc3
SHA3 45cf44cc280b1a4baf37ac1f617e0e85263053e17c5fdacc93d65676389182a5
VirtualSize 0x103b8
VirtualAddress 0x37000
SizeOfRawData 0xe00
PointerToRawData 0x35400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.65052

.pdata

MD5 78840f8faef121ad5724de82223bb640
SHA1 2add408863eeccb1b8a069cb89fe652d3932c58f
SHA256 364ceb575b826e89b248f2a2c8bcc2aae720f5709c5d6bc6efbe10e9957c49c5
SHA3 faef65d00f320b558cf41a4b37e0b371725d9a00db7cdb5772400ab9f28ff539
VirtualSize 0x1db8
VirtualAddress 0x48000
SizeOfRawData 0x1e00
PointerToRawData 0x36200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.34857

_RDATA

MD5 30b46bd8739a903c952245a0c5bb8cd5
SHA1 75abdf61b0b6bfb56d3e6f5b407c06a6965d1c7d
SHA256 3df704a97cd853bd951247685843063c2a04e7bb6c8f2ebf669946208cff90c4
SHA3 5e7b676cd7332ce2a56ef4fe717c9a49c8e424cf53484e69cbb0cedf9ef2ba96
VirtualSize 0xf4
VirtualAddress 0x4a000
SizeOfRawData 0x200
PointerToRawData 0x38000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.99323

.rsrc

MD5 50a2c0b9b235c111180fdced1b47630d
SHA1 38d3ceec27f2847a3b3647da9ee7a7aa6506a63c
SHA256 36a28970b17ac5b913386ee3d28e2c91fd4e8f1447ead0642dffe2c365ac34b9
SHA3 0de8ace33692cfef5aa0f7eca67a346ab2a58aead6c2d7525032410f7d1484b7
VirtualSize 0xb0b0
VirtualAddress 0x4b000
SizeOfRawData 0xb200
PointerToRawData 0x38200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.49123

.reloc

MD5 83a5d6911cb5246ec84c7889b3c1bee6
SHA1 996575fde39f1d9f3b396c4db567e9043bf32732
SHA256 8cd9c08edfe94ea80401739a2ba7b32b3d0392cb778d892cef1bfdd74fd4df98
SHA3 3af83e02c08010035b5584392c6b80ce85af1d35074c92ec4844c07374c40e3d
VirtualSize 0x748
VirtualAddress 0x57000
SizeOfRawData 0x800
PointerToRawData 0x43400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.22613

Imports

USER32.dll CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetOEMCP
GetACP
IsValidCodePage
GetFileAttributesExW
FlushFileBuffers
GetCurrentDirectoryW
GetCPInfo
GetEnvironmentStringsW
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
FreeEnvironmentStringsW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LoadLibraryA
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.17423
MD5 1a0726560abaf945d0442d59eb2561b2
SHA1 3900f1510d7c46678a8c57c20f75bbc1acdcea96
SHA256 457308ab2455f4c54b5a15deb4a10d64204ad7cc09f45e213c2d5c620922e2ef
SHA3 0688f7e0754422e162545d0ac8c65e741a71493edb87004916816ea810ff57b3

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.09695
MD5 f0412717cf70ac11ae1af56bf02f5772
SHA1 4fe7ff16dc98646c0807e1b3d3dafc42fcd0b0db
SHA256 55cd02edf46530d9fc34915acaade250a92a33ad67eec10bea5be2e1a75a66f4
SHA3 44345e7ee6e058ff6d2948a54c599cc82aba88b117efcd8c5edf0d2f65043bb3

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.0117
MD5 3b294ead5b9791e0d545c0f57e622e28
SHA1 d39cd183ec1d0d4f9e70ef86e5ada93411ff499b
SHA256 ad8df15db1f67485befa156238a66bb84f6f1d1bcd54d300ec6e501fb6e28bbb
SHA3 30283282bd608ea5a16f7ff9f11e522039bccc4cccd06344909dfb3dd6868b50

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.03281
MD5 04decf93e7ae871cffa5f0543cffc150
SHA1 f09c1c525fbd6dcf1f5322945d06d403465bc995
SHA256 c644efb8b352139b90cea0c105de70e2c88ef3efb2acd480f40804b8adfe1867
SHA3 3e8f28453538272ac6daa213bcd104b649b027291e7762fe8b3874037e82b979

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x402e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93561
Detected Filetype PNG graphic file
MD5 8b231b8fd1b6791789675b54d7b143f4
SHA1 e1c536f6decf467a4ea03e5229ad05a697089cc1
SHA256 dce1e9388d151d213b2e91bec37ae1c89feedf82e1cb6fcc8bdeab29a36b1d5e
SHA3 f4738e1cc438af8b8026627bd6640dcef1302787e44405e4641c904ae6f4ce12

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.52489
MD5 98c49503da74fab567576a28ea88b8b4
SHA1 f5ca864aa4340b40c862935c9b8ec79d95352c5d
SHA256 589b2873e29802a9848eb556c26e4c45ba49bc6c03eb54be9d1d8d97858872ba
SHA3 12063c4d8e1e59ce621a692be06a2cd6678a6b41f5880547fdd3fecd63f4a808

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65614
MD5 2b5142426a85c301377c33315edc1e01
SHA1 0716a424f250ae544c5952d3e2b786d8b97fa9a7
SHA256 397f4e1da1a40c89d4bffd7f0ed4606956efcd771162f0420affb41d9b3d3de6
SHA3 886a746fb477e24e5e1b839566903aae5d2edbff3280c5487cf399051691f6e0

8

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.68031
MD5 7b52de00b91531e1b965f6d1cf3510d6
SHA1 cd07c11cd6ff638a4a01a8b555a9a15e84e77357
SHA256 01d926d10424809b469775f9e9e7749c763841968dc0ff96be847385429a329e
SHA3 71fe71ce46fa90b6fa5ec8fc96b5980d3057d4787bfc8cadaf593cf729865abc

9

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.32052
MD5 3a2e2cc9ef53e9a29958913bbbffa740
SHA1 8e3f3e64271f8e842465d78391516396d06aaf52
SHA256 8792fb054a35bf3e0e3c7e08a6d2160adcedb803ce822ef3ef4ca6febd64da5b
SHA3 ef474785ee471734dc41d31464069442911dd75c72d187d456c8d73654e47702

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.3406
Detected Filetype Icon file
MD5 ab9ef77e6e66de762f348f4f68656e76
SHA1 d1caac11804af9eb4977cc092b49dc4f87c08bcd
SHA256 d1c3bdfbe49f5b290629cf4d1b386ebb25f68efd5282328370bd0d887a2951e4
SHA3 ca4dfb8c4df174a93d69d63c9aee1ec5796df1480a27cd748c47f4a428c75eb2

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5d4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27404
MD5 e9da93e916e77c12ef67fc1a266b1625
SHA1 adb815309a018e6340eda89c8171f273950a57fb
SHA256 9e09691ebc65f573a1ab5ec0a41a1a63e3c070f5970a94babac69887f40bee10
SHA3 f86b1b417d20376bb24d56f292c2642bd2f36c6b869558514e33e987734f0f57

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Aug-01 04:39:46
Version 0.0
SizeofData 656
AddressOfRawData 0x33a80
PointerToRawData 0x32480

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140037018

RICH Header

XOR Key 0x646b2763
Unmarked objects 0
C objects (27412) 11
ASM objects (27412) 7
C++ objects (27412) 188
253 (28518) 4
C++ objects (VS2019 Update 9 (16.9.2-3) compiler 29913) 38
C objects (VS2019 Update 9 (16.9.2-3) compiler 29913) 17
ASM objects (VS2019 Update 9 (16.9.2-3) compiler 29913) 9
Imports (27412) 11
Total imports 136
C objects (VS2019 Update 9 (16.9.4) compiler 29914) 19
Linker (VS2019 Update 9 (16.9.4) compiler 29914) 1

Errors

<-- -->