d4cc7936dc45bd19f9d0763c84fda367
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2012-Dec-21 20:59:46 |
Plugin Output
| Suspicious | The PE is possibly packed. |
Unusual section name found:
Unusual section name found: Unusual section name found: .zero The PE only has 9 import(s). |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. |
Resource DLL is possibly compressed or encrypted.
Resources amount for 90.9556% of the executable. |
| Malicious | VirusTotal score: 51/72 (Scanned on 2025-01-21 22:08:38) |
ALYac:
Gen:Variant.Application.Patcher.10
APEX: Malicious AVG: Win32:MiscX-gen [PUP] AhnLab-V3: Trojan/Win.Generic.R435334 Antiy-AVL: Trojan[Packed]/Win32.Blackmoon Arcabit: Trojan.Application.Patcher.10 Avast: Win32:MiscX-gen [PUP] Avira: TR/Crypt.XPACK.Gen BitDefender: Gen:Variant.Application.Patcher.10 Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Ghanarava.1733043036fda367 CTX: exe.trojan.patcher CrowdStrike: win/malicious_confidence_70% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: a variant of Win32/HackTool.Patcher.AD potentially unsafe Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Application.Patcher.10 (B) F-Secure: Trojan.TR/Crypt.XPACK.Gen FireEye: Generic.mg.d4cc7936dc45bd19 Fortinet: Riskware/Patcher GData: Gen:Variant.Application.Patcher.10 Google: Detected Gridinsoft: Trojan.Heur!.022124A1 Ikarus: Dropper.SuspectCRC K7AntiVirus: Unwanted-Program ( 004b8dd41 ) K7GW: Unwanted-Program ( 004b8dd41 ) Lionic: Trojan.Win32.Generic.4!c Malwarebytes: Malware.AI.1530106395 MaxSecure: Trojan.Malware.316887860.susgen McAfee: Artemis!D4CC7936DC45 McAfeeD: ti!C75DFF972762 MicroWorld-eScan: Gen:Variant.Application.Patcher.10 Microsoft: Trojan:Win32/BlackMon!MSR Paloalto: generic.ml Panda: Trj/CI.A Rising: Trojan.Kryptik@AI.100 (RDML:doFyRhwFzsbjttn5KSVtBg) Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win32.Dropper.nc Sophos: Mal/Dropper-O Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrendMicro: Trojan.Win32.BLACKMON.USBLCM24 TrendMicro-HouseCall: Trojan.Win32.BLACKMON.USBLCM24 VIPRE: Gen:Variant.Application.Patcher.10 Varist: W32/ABTrojan.VZAT-8353 Xcitium: TrojWare.Win32.Agent.WFN@4t5srs Yandex: Trojan.GenAsa!+V7EyyfQ22g Zillya: Tool.Patcher.Win32.46162 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x40 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2012-Dec-21 20:59:46 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 10.0 |
| SizeOfCode | 0x800 |
| SizeOfInitializedData | 0x8112 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000151A (Section: ) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xe000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
Section_1
.rsrc
Section_3
.zero
Imports
| user32.dll |
MessageBoxA
wsprintfA |
|---|---|
| kernel32.dll |
ExitProcess
GetModuleHandleA GetProcAddress VirtualProtect VirtualAlloc VirtualFree LoadLibraryA |
Delayed Imports
1
DLL
500
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: Section has a size of 0!