d3fd0b668cd3c337a1656c1a5ccb2d98066707722c983096fad075cd66a6adfd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-08 15:50:05

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegCloseKey
  • RegOpenKeyExA
  • RegQueryValueExA
 Possibly launches other programs:
  • CreateProcessW
 Uses Windows's Native API:
  • NtClose
  • NtCreateFile
  • NtDeviceIoControlFile
  • NtLockFile
  • NtQueryObject
  • NtSetInformationFile
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
 Interacts with the certificate store:
  • CertOpenSystemStoreW
Malicious VirusTotal score: 40/71 (Scanned on 2026-09-08 20:59:10) ALYac: Generic.Dacic.11262.090C03CD
APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Malware/Win.Dacic.R765588
Antiy-AVL: Trojan/Win32.Agent
Arcabit: Generic.Dacic.11262.090C03CD
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Generic.Dacic.11262.090C03CD
Bkav: W32.Malware.F32F1192
CTX: exe.unknown.dacic
CrowdStrike: win/malicious_confidence_100% (D)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
DrWeb: Trojan.DownLoader49.40340
ESET-NOD32: Win64/FakeTool.C trojan
Elastic: malicious (high confidence)
Emsisoft: Generic.Dacic.11262.090C03CD (B)
F-Secure: Trojan.TR/W64.Agent
Fortinet: W64/Agent.MCC!tr
GData: Generic.Dacic.11262.090C03CD
Google: Detected
Gridinsoft: Trojan.Win64.Agent.oa!s1
Ikarus: Trojan.Win64.Agent
K7AntiVirus: Riskware ( 00584baa1 )
K7GW: Riskware ( 00584baa1 )
Kaspersky: HEUR:Trojan-Downloader.Win32.Magnar.gen
Malwarebytes: Trojan.Loader
MaxSecure: Trojan.Malware.121218.susgen
McAfeeD: ti!D3FD0B668CD3
MicroWorld-eScan: Generic.Dacic.11262.090C03CD
Microsoft: Trojan:Win64/Convagent.RVA!MTB
Panda: Trj/GdSda.A
Symantec: ML.Attribute.HighConfidence
Tencent: Malware.Win32.Gencirc.10c46679
VIPRE: Generic.Dacic.11262.090C03CD
Varist: W64/ARisk.PQ
Webroot: Win.Trojan.Gen
huorong: Backdoor/Agent.rv

Hashes

MD5 bba31dd1b7fd37a5a17d1e7e1d06093e 🔍
SHA1 a8e283013b30a93da0772847d10b5434e2d1850e 🔍
SHA256 d3fd0b668cd3c337a1656c1a5ccb2d98066707722c983096fad075cd66a6adfd 🔍
SHA3 f9e4460785a3e9eaa1cf7f3bc761bae0ad88528c561bd28bbe9c3a9de01fe4cc 🔍
SSDeep 12288:Tbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDbvfqItNqdg:TbOVE5ifGPRZwfvf3fd 🔍
Imports Hash 73f461c771aef77ec43d53a0c54f0c8d 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-08 15:50:05
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x75400
SizeOfInitializedData 0xa0c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x11c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4805b8ccce84685fe4530a58a8d231e3 🔍
SHA1 95a7b04c41576916d0ac0288bf8605d5c31eb579 🔍
SHA256 24ebe676b71ee6b6cb8688d2a894ca1be55bc90f9beb11e8780bbc072425d338 🔍
SHA3 799df72a55efd5db178edb71b89333a67d08d735b03ae82de5d52719e5112ae6 🔍
VirtualSize 0x75286
VirtualAddress 0x1000
SizeOfRawData 0x75400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36945

.rdata

MD5 227d820ab3e48ed872d28fa865a13634 🔍
SHA1 25d3d9b61b8b659a5e7ba561752c5a6f554da596 🔍
SHA256 3fe22f27500382a07fc175429509b113768ed5f05a7c73163503e604eb11e3e1 🔍
SHA3 d1f6ada57fde9ea5abacb2b2db871cb08ae20e9adb455e3ba0c04dc5202bb8d0 🔍
VirtualSize 0x9c5a0
VirtualAddress 0x77000
SizeOfRawData 0x9c600
PointerToRawData 0x75800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.08534

.data

MD5 a13d039c43daffca9acd20a4cbed5310 🔍
SHA1 f30592fddfb9b43877aaf272169fb63eab4a9d79 🔍
SHA256 abf459a36b81847fdb2450b94e80bc9663e8e17de149f9d468c0f88828ac0d9c 🔍
SHA3 7316759545f6fc8fbc1e3da0baef19275347ce0e691da1b03f46d9d0e1f54bbc 🔍
VirtualSize 0x780
VirtualAddress 0x114000
SizeOfRawData 0x800
PointerToRawData 0x111e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.75727

.pdata

MD5 d5a6d76f34c7753a6619ce8e1e8189fd 🔍
SHA1 ebc0f1a8fbb2f3743f6c4ab4cee3491695970e63 🔍
SHA256 1d56fca469f24149ff128a4797a631ade1dbf0ca8b333a246c2929868e112d6d 🔍
SHA3 155e69466cbf9a7b67d6da17abc8816bab302a6b0bfe44dfd18b1718d07070c4 🔍
VirtualSize 0x13f8
VirtualAddress 0x115000
SizeOfRawData 0x1400
PointerToRawData 0x112600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80006

.CRT

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x117000
SizeOfRawData 0x200
PointerToRawData 0x113a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 d4163cd782027139760d0eb803098005 🔍
SHA1 8be6c130911dd3328555930f4b13db76d4b65066 🔍
SHA256 bf09ac4ea974dffd64ea60096241978f8774580594a40cbba53630fcff37bddd 🔍
SHA3 d73b0ce6b63ab03d4bcff3cbda4d2efe32e258bcad61fb32f90083c96758bec1 🔍
VirtualSize 0x2219
VirtualAddress 0x118000
SizeOfRawData 0x2400
PointerToRawData 0x113c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0100799

.reloc

MD5 aa7540e1601bc82bd90cea5f4c52ed0f 🔍
SHA1 7dc9be6e43734bf77d328d68290fe1189dea4f05 🔍
SHA256 73cffbcff84c03f5b021f968764c007fbc618a048a66bd6eced70099abad3af3 🔍
SHA3 1744bacd428d679c8af597b32ce1650285852e8fd2554abc3cfbca7af0b6da78 🔍
VirtualSize 0x2bc
VirtualAddress 0x11b000
SizeOfRawData 0x400
PointerToRawData 0x116000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.11754

Imports

ntdll.dll NtClose
NtCreateFile
NtDeviceIoControlFile
NtLockFile
NtQueryObject
NtSetInformationFile
RtlEqualUnicodeString
RtlExitUserProcess
RtlGetFullPathName_U
RtlWaitOnAddress
KERNEL32.dll AcquireSRWLockExclusive
CloseHandle
CreateProcessW
ExitProcess
GetCurrentThreadId
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileAttributesW
GetLastError
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
GlobalMemoryStatusEx
MoveFileW
MultiByteToWideChar
ReadFile
ReleaseSRWLockExclusive
SetEnvironmentVariableA
SetFilePointerEx
Sleep
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteFile
ADVAPI32.dll RegCloseKey
RegOpenKeyExA
RegQueryValueExA
SystemFunction036
CRYPT32.dll CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
WS2_32.dll WSAGetLastError
WSASocketW
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x518000
EndAddressOfRawData 0x51a218
AddressOfIndex 0x514000
AddressOfCallbacks 0x517000
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4096BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.