d803f05ff3969a4c22b285f28ed57225

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Apr-19 09:56:51
Detected languages English - United States
Debug artifacts c:\clean\mix\Row\experience\tree\Station\mountainself.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryA
Possibly launches other programs:
  • CreateProcessW
Enumerates local disk drives:
  • GetVolumeInformationW
Malicious VirusTotal score: 58/70 (Scanned on 2019-10-24 02:09:30) MicroWorld-eScan: Trojan.GenericKD.30630713
FireEye: Generic.mg.d803f05ff3969a4c
CAT-QuickHeal: Trojan.IGENERIC
McAfee: Generic.azd
Zillya: Trojan.GenericKD.Win32.146477
K7AntiVirus: Riskware ( 0040eff71 )
Alibaba: TrojanDownloader:Win32/Nymaim.fcecddb6
K7GW: Riskware ( 0040eff71 )
Cybereason: malicious.ff3969
Arcabit: Trojan.Generic.D1D36339
Invincea: heuristic
F-Prot: W32/Nymaim.ALB
Symantec: Trojan.Nymaim.B
APEX: Malicious
Avast: Win32:Malware-gen
Kaspersky: Trojan.Win32.Nymaim.beqi
BitDefender: Trojan.GenericKD.30630713
NANO-Antivirus: Trojan.Win32.Nymaim.fakzat
Paloalto: generic.ml
ViRobot: Trojan.Win32.S.Agent.1418752.C
Ad-Aware: Trojan.GenericKD.30630713
Emsisoft: Trojan.GenericKD.30630713 (B)
Comodo: Malware@#3h1snsx19b30b
F-Secure: Trojan.TR/Dropper.ytuew
DrWeb: Trojan.DownLoader26.38781
VIPRE: Win32.Malware!Drop
TrendMicro: TROJ_NYMAIM.TIBBCBJ
McAfee-GW-Edition: Generic.azd
Trapmine: malicious.high.ml.score
Sophos: Troj/Nymaim-HH
SentinelOne: DFI - Malicious PE
Cyren: W32/Risk.TAJA-8130
Jiangmin: Trojan.Nymaim.ecs
Webroot: W32.Trojan.GenKD
Avira: TR/Dropper.ytuew
Fortinet: W32/Nymaim.HH!tr
Endgame: malicious (high confidence)
Microsoft: TrojanDownloader:Win32/Nymaim.K!bit
AegisLab: Trojan.Win32.Nymaim.4!c
ZoneAlarm: Trojan.Win32.Nymaim.beqi
TACHYON: Trojan/W32.Nymaim.1418752
AhnLab-V3: Trojan/Win32.Nymaim.C2471333
Acronis: suspicious
ALYac: Trojan.Nymaim.gen
MAX: malware (ai score=100)
VBA32: BScope.TrojanBanker.Gozi
Cylance: Unsafe
Zoner: Trojan.Win32.68950
ESET-NOD32: Win32/TrojanDownloader.Nymaim.BA
TrendMicro-HouseCall: TROJ_NYMAIM.TIBBCBJ
Rising: Downloader.Nymaim!8.781 (KTSE)
Yandex: Trojan.Nymaim!RmOpToHFWwk
Ikarus: Trojan.Dropper
GData: Win32.Trojan-Downloader.Nymaim.SXYOOF
AVG: Win32:Malware-gen
Panda: Trj/WLT.D
CrowdStrike: win/malicious_confidence_90% (W)
Qihoo-360: Win32/Trojan.Multi.daf

Hashes

MD5 d803f05ff3969a4c22b285f28ed57225
SHA1 9a0f74b99708884cfd7e8e0cb3a112fef45d06be
SHA256 3fc0739f91d21ed510d3c03559c37315d93100e13402284d3e48cd5a3f9f0e98
SHA3 471a40ebea43b57af499c099e3eb870e85d0323f04ae266c51e4fc9639c884c2
SSDeep 12288:JHNo6BuwLnTqzo/joOG0glGCjeVLQjDXkN7I/1pKaUBY7Y:lNo6I0nezmoOPwjeIDXIINpk6
Imports Hash c84b8ebca506e3b85a9a17f4d1970f6d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2009-Apr-19 09:56:51
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 9.0
SizeOfCode 0x59a00
SizeOfInitializedData 0x10dc00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000482E8 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x5b000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.0
ImageVersion 0.0
SubsystemVersion 5.0
Win32VersionValue 0
SizeOfImage 0x16b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c7c9bc16f7114e7f7eb25384dcf6820b
SHA1 31d8928aedcc26304175fd05ce85ae9370673488
SHA256 932c246d272f8ce8029709d82ae90e8ab5cc519998fccf3c8c1dbf4693aef891
SHA3 a3f7bf4806447215c54d443059c4b339fd96dd17af14ab683ce7c14d27634e66
VirtualSize 0x5985d
VirtualAddress 0x1000
SizeOfRawData 0x59a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.98001

.rdata

MD5 4ed3ecadba0805dcc6c608a6b9ccd4fe
SHA1 619b36a040b8461ddea63531821bccd72930651c
SHA256 b929d99b0ac31c68cf8d01bbb991144c2956659157d42e714b93b8171282fd94
SHA3 8c19e6bd6f86d1422758163443772863cb4fe31a5f7f82623e8a311922ff21a5
VirtualSize 0x5348
VirtualAddress 0x5b000
SizeOfRawData 0x5400
PointerToRawData 0x59e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.73148

.data

MD5 85564f9bc246d40a470c2004871037c6
SHA1 fa57bd5d9c8f883907836e95b2cb8da8a271bd3b
SHA256 8a79a2e1ff658cf58096819221b9d280daffa195394e02de55eba58f1ea48773
SHA3 191a5eb7104bdacdac3d195f133954000a7cbef7584646529416d8fabb653471
VirtualSize 0xf468
VirtualAddress 0x61000
SizeOfRawData 0x2200
PointerToRawData 0x5f200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.77138

.rsrc

MD5 9cd7d62ad0954b0828275ec420754916
SHA1 b7a36c9fdc8da9e6a64a7604b7b931c5beef6d2d
SHA256 1d37580a582eebe940f371ec570a558624f4036727fa4cfdb86dbe08727aa69c
SHA3 21c9ea81c88f18409689256d525cab51cd6a64d59358f75ae8726d7d51212727
VirtualSize 0xf9010
VirtualAddress 0x71000
SizeOfRawData 0xf9200
PointerToRawData 0x61400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.00125

Imports

KERNEL32.dll CreateProcessW
GetDiskFreeSpaceW
GetCurrentThreadId
RemoveDirectoryW
CreateEventW
GetVersion
GetVolumeInformationW
GetLocalTime
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
TlsSetValue
TlsAlloc
Sleep
GetProcAddress
LoadLibraryW
CloseHandle
FindFirstChangeNotificationW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetLastError
HeapFree
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleW
TlsGetValue
TlsFree
SetLastError
HeapAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
CreateFileA

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88988
MD5 a1cb1b6c20c9c24e72d5c5103febdbc0
SHA1 8a492fbb92c314833cdf3a5fb12397b3c6624a27
SHA256 a410bccda2de76a4c7f13cd6bd82c629f04d2f50692b628b2b1a6dce58b2be9c
SHA3 9df6d35f7cef17931aba398debfe94887b94b6fe1cac2d2065f4b0a1b3b58d77

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04904
MD5 1ff8bf6828261d01a85a2be75252c288
SHA1 8bfe4fb7ac3f328a8c9b9cb513c02f4656e60ef3
SHA256 aeee31c7afec44051711a3d498b69f7d4b3070c420b6d9834eda084c9da65a02
SHA3 722948f25e5bf7210ef447952e98977a9b6ae78a2d163c1581fa04bc19cec4d9

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.3715
MD5 c8fad3fa4ab7fee8456a97caa0938bcf
SHA1 60892925f674762faef2a81220aeabe510c34007
SHA256 5f7a74f726ef1f66b05038a6a176698e23e73083d8454958d16ff3fedd58f7d6
SHA3 f3c0d31ea3d59c12d3f7412c302ac2774091598440e9b5099d4bc29518aa79dc

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40646
MD5 ac1d9c89f944126870a7947ecee2702c
SHA1 c50f65d48b8829ac4cb7a3ae7c457957f540a580
SHA256 c271f36241d17e4998c1802638fc07d6bbd8694c75f571bdc6593341123475af
SHA3 274ea18e517f94fdc97406dd4f3f997c450692a0bdabd26d60bacf8a773aa943

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.35837
MD5 db556c6b3c5d17a8277f8c7b5868d931
SHA1 ea5bd4aaecf9aeb21fbc58233d6525a1aa8460ef
SHA256 e070d2e977b583a073a120d775cd90ba20c4071c8fa336ecb7a2256c81c14a71
SHA3 f79dc46f37bbded31e7540083e5fb5084105d0e85ea0a5d1019c297d3204eb8e

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.64316
MD5 ae4e927563ac56d69523eb2665a91129
SHA1 b938cf9098ce837d00f20052f4f3d02210062ba8
SHA256 199077894a9083484ee81c0aa407a444f45a7b054501597125c521604cde1669
SHA3 14ffe3e0080038b7ea96bb3e55ae819eff4537f5b1f3dd451b4d08c333453168

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.79451
MD5 8bb75b2cb9777b2655e675c04b5f34fe
SHA1 b14d13fb1ef8f0c0b6e984d8b54c7bd702771634
SHA256 c23052c25ae4a6366b456c96cf8157940b43fad49b93cd7d82f0f2b173298168
SHA3 ee9aa78b1251be00c1db0d943faaaea68841c12926cd6bfc80b44c87e9e7faa7

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.11484
MD5 a596c6ec153cc91e77b4fc1b3c0af1a7
SHA1 3ec5e8af03c2b7156a532c7f62c2471404f3fe82
SHA256 f525a510e0615afaf8d26a2c4858793bb751c8174a80ecdc0ebb301edb20c4b1
SHA3 4c61a03c9a0b5985df39e80f97ebc7c28d5ee56569bda954ade8a7b0c480c1c2

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.23956
MD5 28f65a8d35f2f428ccdf787117d4527e
SHA1 31201870d4126b76920169adf9f08899fe37ed41
SHA256 427357511b93bb7c4bd1c5bae6153c7c86811bacddeabf4e17804aabd8407727
SHA3 eefc2de723e7d24c2fe8f21c276a2b52e1f3ee632ad3698fbf42613bbf6ab6a6

32

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x42
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.72874
MD5 58a2cbb582b81f4848b4591cef78a212
SHA1 468fea43c460ca2c5426a7bf0666152beaed791e
SHA256 2014db751287bf146ab62603f21c1906d42df4730360fc41db25ff9e05226be5
SHA3 641da236c3184033a72317317dd6f7926b89352b53716728deaa0ef51f0b5108

47

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x479e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.85738
MD5 5c47b9016bdbf6b16197ce357e2eb61b
SHA1 7d8a73802b22eaa988bcf55b729f4214d50ea0a1
SHA256 2053d68988daf073d061f409e9d9d863507c17d3ced1a03f035fa516c824a3b2
SHA3 b9c049d121db03fbdc67bf05266f9a47bae6ffc3d2e00e0a1a8e48f3094051a4

48

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x479e6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.73927
MD5 b38d62b232d700f2d876cee881b8e71f
SHA1 aa35a0613cae07ad19fd653cd11815c4fc698542
SHA256 dedf89323ac0d8ebfbae30579819bdb1e5e38ef2a47b9bd93723c5f088733982
SHA3 e3c3b700f38036da0d38adac0abec09aec99703c0ab2e494ced8b037885bf612

100

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01226
Detected Filetype Icon file
MD5 0a13fa2fb3d482e348632d920a8dd2ec
SHA1 5291ee4761a0e5d1ba34a6b75665dba9cbc5f866
SHA256 d670ce3db3b0dbc8bed5e3de0f3f34d874be9035e1d14782adcc19171b2e3c92
SHA3 fc8d06e04bab8e99a6cda69f037335b3cbaeeac345dcfd3ce3eace210c329fba

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x56
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65542
MD5 bd62b6f553a2d1d012cc53fc325221d2
SHA1 c5353cec27b30fb35e414dd5f3d0e9205aaf1c07
SHA256 388f75e900f0c15fd66249d7b2e7edf6e14eeefb859e6f766b75058e44f27af6
SHA3 b59854a353caba5e0be1002399bcb847b4dd99e37cff0c7967dd0d42c1eab089

String Table contents

rather horse most

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2018-Apr-19 09:56:51
Version 0.0
SizeofData 82
AddressOfRawData 0x5e2f8
PointerToRawData 0x5d0f8
Referenced File c:\clean\mix\Row\experience\tree\Station\mountainself.pdb

TLS Callbacks

Load Configuration

Size 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x461e44
SEHandlerTable 0
SEHandlerCount 0

RICH Header

Errors

<-- -->