cbc7504b6f3d555618ad2757b570a9026d76fc8488853068103a47fdfed51dca
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2012-Jun-12 06:01:32 |
| Detected languages |
English - United States
|
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C++ 8.0 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .data3
Unusual section name found: .data2 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 58/72 (Scanned on 2023-11-14 07:03:13) |
ALYac:
Gen:Variant.Razy.599948
APEX: Malicious AVG: Win32:Cridex-N [Trj] AhnLab-V3: Trojan/Win32.Zbot.R79702 Alibaba: Ransom:Win32/Blocker.096d9d44 Antiy-AVL: Trojan[Packed]/Win32.Krap Arcabit: Trojan.Razy.D9278C Avast: Win32:Cridex-N [Trj] Avira: TR/Crypt.XPACK.Gen BitDefender: Gen:Variant.Razy.599948 BitDefenderTheta: AI:Packer.00B2B79B1F Bkav: W32.AIDetectMalware ClamAV: Win.Trojan.Agent-1236425 CrowdStrike: win/malicious_confidence_100% (W) Cybereason: malicious.310442 Cylance: unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.DownLoader15.17379 ESET-NOD32: Win32/AutoRun.Spy.Banker.P Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Razy.599948 (B) F-Secure: Trojan.TR/Crypt.XPACK.Gen FireEye: Generic.mg.d494fb7e14ce5bc4 Fortinet: W32/Lockscreen.LOA!tr GData: Gen:Variant.Razy.599948 Google: Detected Gridinsoft: Malware.Win32.Gen.bot!se58553 Ikarus: Worm.Win32.Cridex Jiangmin: TrojanDropper.Dapato.hxn K7AntiVirus: Spyware ( 0040ae601 ) K7GW: Spyware ( 0040ae601 ) Kaspersky: Trojan-Ransom.Win32.Blocker.hmnq Lionic: Trojan.Win32.Blocker.4!c MAX: malware (ai score=94) Malwarebytes: Generic.Malware/Suspicious MaxSecure: Trojan.Packed.Krap.iu McAfee: PWS-Zbot.gen.bex MicroWorld-eScan: Gen:Variant.Razy.599948 Microsoft: Worm:Win32/Cridex.E NANO-Antivirus: Trojan.Win32.Dwn.stlir Panda: Bck/Qbot.AO Rising: Ransom.Reveton!8.F2 (TFE:2:D4ITAqlNGCM) Sangfor: Trojan.Win32.Agent.updb SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Mytob.ch Sophos: Troj/Zbot-DHN Symantec: Packed.Generic.459 Tencent: Win32.Trojan.Blocker.Kcnw Trapmine: malicious.high.ml.score VBA32: BScope.Malware-Cryptor.SB.01798 VIPRE: Gen:Variant.Razy.599948 Varist: W32/Zbot.DQ.gen!Eldorado Webroot: W32.Trojan.Gen Xcitium: TrojWare.Win32.Kryptik.UHZ@4qh07d ZoneAlarm: Trojan-Ransom.Win32.Blocker.hmnq Zoner: Trojan.Win32.6680 tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 6 |
| TimeDateStamp | 2012-Jun-12 06:01:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x5a00 |
| SizeOfInitializedData | 0x15600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000015E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x7000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x21000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1d4ab |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.data
.data3
.data2
.rsrc
.reloc
Imports
| KERNEL32.dll |
LoadLibraryW
GetProcAddress GetWindowsDirectoryW lstrcatW CreateFileW GetCommandLineA ReadFile |
|---|---|
| USER32.dll |
GetDC
ReleaseDC PostQuitMessage InvalidateRect BeginPaint DefWindowProcA LoadIconA LoadCursorA RegisterClassExA CreateWindowExA ShowWindow UpdateWindow GetMessageA TranslateMessage DispatchMessageA |
| GDI32.dll |
GetStockObject
SelectObject GetTextMetricsA SetBkMode TextOutA |
| msvcrt.dll |
memcpy
|
Delayed Imports
1
2
1 (#2)
2 (#2)
3
0
String Table contents
| ActiveMovie Control |
| ActiveMovie File Types |
| Accessories |
| Multimedia |
| Software\Microsoft\Multimedia\DirectXMedia |
| Extensions |
| .Prog |
| CLSID |
| Content Type |
| DefaultIcon |
| Extension.MediaType.bak |
| Extension.MIME |
| Extension.MIME.bak |
| MediaType.Description |
| MediaType.Description.bak |
| MediaType.Icon |
| MediaType.Icon.bak |
| MediaType.MediaType |
| MediaType.MediaType.bak |
| MediaType.Open.bak |
| MediaType.Play.bak |
| MediaType.Verb.bak |
| MIME.CLSID.bak |
| MIME\Database\Content Type\ |
| OCX.clsid |
| OCX.ocx |
| Open |
| Play |
| RunDll.NT |
| RunDll.Win9x |
| Shell |
| Shell.Open |
| Shell.Play |
| Software\Microsoft\Multimedia\ActiveMovie\File Extensions |
| ActiveMovie Control |
| Shortcut.Parameters |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: The WIN_CERTIFICATE appears to be invalid.
Leave a comment
No comments yet.