d422a6db20b60139eb0545eec6b7e7db

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Jul-09 14:20:02

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for VMWare presence:
  • vmware
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryA
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Leverages the raw socket API to access the Internet:
  • #14
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 8352362 bytes of data starting at offset 0x4ba00.
The overlay data has an entropy of 7.99864 and is possibly compressed or encrypted.
Overlay data amounts for 96.424% of the executable.
Suspicious VirusTotal score: 1/71 (Scanned on 2019-10-21 14:06:44) APEX: Malicious

Hashes

MD5 d422a6db20b60139eb0545eec6b7e7db
SHA1 8cf66dcd2a74b9fdeaff4c991865a20584eb11e0
SHA256 79589b55b96890474de15f3b876590ba5280738f04de9042fc49426bc19c4bfa
SHA3 535c9da3b23f6912a48896b60ff36a12c2a9913e8ed4496b4fc2017ca0d19036
SSDeep 196608:PwbzKWezRV6XZIvCYIeSOsHkVfSKbF0k6iPzxl4ik5:+zBYL6pnOsHktSaQiP4ik
Imports Hash 76624002d6ae7190ccd07ceecb1695a4

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2019-Jul-09 14:20:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x21400
SizeOfInitializedData 0x2a200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000089B4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x5f000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 118d860be8b5ef84801d3590b63c697a
SHA1 ed769eea78d7ff835456b9df70ae945487ed1a95
SHA256 1a23b2edc63583994db0d3f3b490ca8af32526eb7a38ef7b9f32dc90f9207957
SHA3 70a92db1a3781db727032e5374479abda5ad11e693ab04b82c52c506cd398233
VirtualSize 0x21390
VirtualAddress 0x1000
SizeOfRawData 0x21400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46391

.rdata

MD5 c7c30ea54de0af8459276ec8ef3f9ab1
SHA1 8e286bd2383ed974a671406d777825f860dbd782
SHA256 57de8ee75aa251250369790452ccc645b7d56fd916a071382a44232f855b4ce6
SHA3 7006627b68e0a55dcbd69cd375a2c4097908a2142d8903d98f4e085ef4c040f8
VirtualSize 0xf3c8
VirtualAddress 0x23000
SizeOfRawData 0xf400
PointerToRawData 0x21800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.85444

.data

MD5 c229bcbda01da0475768ccb43a6d6ddc
SHA1 32eb208e5b8e467c0c25069f75d8db61340100ad
SHA256 26bf1ce7ad18845c908dcf49ef396c989a6f94a6bb67f7898878fd045933cff6
SHA3 601c43a883b10f3c4c457560251f2c82bf330412fcae5a2c1b596730823b01c6
VirtualSize 0xf108
VirtualAddress 0x33000
SizeOfRawData 0xc00
PointerToRawData 0x30c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.84446

.pdata

MD5 b17954c41ce2b463e7e9449034b8effd
SHA1 79d6d219750e1e60b1ea825d626648b48913cfce
SHA256 401dd44c253a82e21e266c4e6d2ce637bb05fd953d521db564e19eefb2713305
SHA3 66b263d0a1a6efd0ffb9dab74841737002a8860b7a4e26a34f00e90be3414e6d
VirtualSize 0x1d04
VirtualAddress 0x43000
SizeOfRawData 0x1e00
PointerToRawData 0x31800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.22959

.gfids

MD5 89b55f0393e019393a93908a53d1cb7a
SHA1 94be5176ab6fc86d03a49d973a5e7901c02ab220
SHA256 ae6dc1e153c4020a222ea2ea3a04700b6026ec09e37c46d5e717e50c8deff96d
SHA3 12709837bbe0488a534408d43f074edee6f94bd586e140dc85432ec8d6118bb4
VirtualSize 0xac
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x33600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.74158

.rsrc

MD5 52f5ccca814aada9f3341434df70b257
SHA1 47c2def18dcf9f569e7b9d01b4f07b58dca2fff4
SHA256 00921f51f24675be669d8870c8b4e449ea8892abd6ed0181445ee3fcc165e303
SHA3 4b974cd1743c26b31bc9d4cfaea9c6b5be8867cabcfd5b2bd259fe66c0cdf8ad
VirtualSize 0x17924
VirtualAddress 0x46000
SizeOfRawData 0x17a00
PointerToRawData 0x33800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.37909

.reloc

MD5 a863830437d17bfa07f80f1311f3452b
SHA1 3bc934f3c394ff2fb27c5d360d2331c3ecf1dc63
SHA256 a83862f8f2c8af3f1b0491be6b8f8b3a45b7b65e8386a648f48fa9f6cf48e845
SHA3 6f6b69bba6ae5aa4792311989953ff4a1872ea83b93548db3fb07214b6c7d3ed
VirtualSize 0x698
VirtualAddress 0x5e000
SizeOfRawData 0x800
PointerToRawData 0x4b200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.99579

Imports

KERNEL32.dll GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException
WS2_32.dll #14

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.50194
MD5 2f3b5d2ae572b13ca4fb5463adbb3cae
SHA1 0b354a2f2554193b9e1642feb9efc81f60f655f8
SHA256 3dc941ecd05f429452f0f4eb309e2637bf2ddfa279c0a56d8409f3d4ab8bd291
SHA3 5eed75cc34c2572654ae475bd7a0019d09e0daaf7802d5f087e43024c50928a7

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.87328
MD5 e363ac2af28d02228a07a0bc75bd0863
SHA1 ba18eb9b2562b3d16977b0789e2d1d4d1a3b6c35
SHA256 7bbee6d90f00296754a1716bad67b7380f41ff4b13e5bbca43e889eaaaf435ab
SHA3 ef0ff5c854c63e4600a174880f49cf95e684c046c40c01b2028c366c56e9d7d3

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.79782
MD5 049d7616a830bd937e11a9c8a8c87520
SHA1 2772a749fb7fca7d0c31b2ccd00e3b1d4c2a7d8e
SHA256 43c056de43d7479d0d1d30c98e54a2120904f77779199e28c96fd83efafd35e0
SHA3 6e4eab4f40f6b81e1d3d0d3158c7827fe5110a53a17c304344170fd693208d20

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.02089
MD5 e13b02d9fc14a92fea79b46ef8af63ed
SHA1 d660477b6e25432e9b7cfa308edccbe7e7460e3e
SHA256 b208370222481b0654f3df0f3f54599bc252377f2d3a66d21d69135151e2e5ba
SHA3 3f2f9e803d34767f9b80ee12a17ac33686384a8e05b5814259fa7ac63154662f

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1a53
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.87108
Detected Filetype PNG graphic file
MD5 b14729a3047e5e1a0b9182801b332f43
SHA1 ad8955923554cd38bdd556bfd812de03c462f985
SHA256 d9b36d773ec7dfe2c6a4427eecb08849caad52204cddea51b1870eb44d7e9248
SHA3 d7af84cf7a1e519d7eea9092227e207748201b79ce7058377aaf3182d2f1ac46

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67841
Detected Filetype Icon file
MD5 3064f92bcc9aaf2188f04c7fc9dafa71
SHA1 f297a9d4d6928f224e367a252579e84d9281ffac
SHA256 9bd4a0c60d58b3b5cabbfe8446b0930d04724a56e2e84a9503176fc00d18a2d9
SHA3 d73dcd2e6e5f417a87c0d43d8bba1dd853867fad667c00019f35c9f8091002ec

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3f2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29269
MD5 79d6d6d2d7ca6d8847391d0f33d315ef
SHA1 e37bb2234de553bad6c4277d0ae653ee9185e49f
SHA256 8012f43aa6fa61cdfec6bf1a47f35e199a69fc75a1e18dae550d1245ea297893
SHA3 8bcd4a2d1fe72e3996144fab40b21fba87dc18452b8cd429a8b30a57bbf9dc5c

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2019-Jul-09 14:20:02
Version 0.0
SizeofData 720
AddressOfRawData 0x2fa78
PointerToRawData 0x2e278

TLS Callbacks

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140033010

RICH Header

XOR Key 0x2165d1bb
Unmarked objects 0
241 (40116) 7
243 (40116) 170
242 (40116) 13
ASM objects (VS2015 UPD3 build 24123) 7
C++ objects (VS2015 UPD3 build 24123) 28
C objects (VS2015 UPD3 build 24123) 19
Imports (65501) 5
Total imports 114
C objects (VS2015 UPD3 build 24210) 17
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3 build 24210) 1

Errors

<-- -->