d8fa17f5f121d5d5566ae6c678f337b8

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Sep-03 19:50:03

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
Can access the registry:
  • RegCloseKey
  • RegCreateKeyExA
  • RegDeleteKeyA
  • RegDeleteValueA
  • RegEnumKeyExA
  • RegEnumValueA
  • RegOpenKeyExA
  • RegQueryValueExA
  • RegSetValueExA
Possibly launches other programs:
  • CreateProcessA
Uses Microsoft's cryptographic API:
  • CryptAcquireContextA
  • CryptCreateHash
  • CryptDestroyHash
  • CryptGetHashParam
  • CryptHashData
  • CryptReleaseContext
  • CryptUnprotectData
Uses functions commonly found in keyloggers:
  • GetForegroundWindow
  • MapVirtualKeyA
Leverages the raw socket API to access the Internet:
  • WSACleanup
  • WSAGetLastError
  • WSAIoctl
  • WSAStartup
  • __WSAFDIsSet
  • closesocket
  • connect
  • gethostbyname
  • gethostname
  • htons
  • inet_ntoa
  • ioctlsocket
  • ntohs
  • recv
  • select
  • send
  • setsockopt
  • shutdown
  • socket
Enumerates local disk drives:
  • GetDriveTypeA
  • GetLogicalDriveStringsA
  • GetVolumeInformationA
Manipulates other processes:
  • OpenProcess
  • Process32First
  • Process32Next
Can take screenshots:
  • BitBlt
  • CreateCompatibleDC
  • GetDC
Queries user information on remote machines:
  • NetWkstaGetInfo
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 d8fa17f5f121d5d5566ae6c678f337b8
SHA1 4f9cb5e2c899b0b2032e325c4fe09df6030f4176
SHA256 a94ff8fdc7fff60816bc7395c03ff19398a12eb37aa627d03199805aee504b3f
SHA3 91e62a0f197255a3c42758c16de884de4c61440b7121f8b571d3070ebb53dbb0
SSDeep 1536:AsOrUazrEh/mPmJTDslBjQx1XcbjyS548cC1fG928OfVDGw:AsOQ2QmPwTDsM1XcbjyccC1fb8Vw
Imports Hash 8e97a1515090baa46f52cf0ff6a6d12f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2017-Sep-03 19:50:03
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x12800
SizeOfInitializedData 0x3800
SizeOfUninitializedData 0x6800
AddressOfEntryPoint 0x000022CA (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x14000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x20000
SizeOfHeaders 0x400
Checksum 0x235ba
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 794d22347a532809ed742a7791f827af
SHA1 80c4704890fb80ff41d744f916d7696fac7a5a6c
SHA256 f200c339b68bb7e8efab51c4f9bc8b7c26aebf49e3e3c571bc157b02081dbe2c
SHA3 877d44e4af5cf808c6f98108ac64901188ff6fe45ea1f65eebd7ef61bb4e83cb
VirtualSize 0x12710
VirtualAddress 0x1000
SizeOfRawData 0x12800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.86047

.data

MD5 d0396c8537b30ec313c806773c0ca551
SHA1 7b7178fa374af0bc0203e3b63059327c53a8d51d
SHA256 17e94272952c5093c7458d68f2c4b247cac7ae23afaa24923cff195ca71a3891
SHA3 774db5e9193625bda47bceec321b496ef2c1f7820455e67a09440b86deff0107
VirtualSize 0x2408
VirtualAddress 0x14000
SizeOfRawData 0x2600
PointerToRawData 0x12c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.25426

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x6684
VirtualAddress 0x17000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 610e64310ef6cb93342c20cd6018874b
SHA1 ed29d2d274c73c591994f11e2938400d58c6387d
SHA256 61bba26d2d5ea1ebcccf3a4a1386369ec83d997a1d29859be5c0cbe8aa45941c
SHA3 f22c1c28b704d0dffe122d83c2e57a391b860588b62f475cfa71f57f83f0022d
VirtualSize 0x115c
VirtualAddress 0x1e000
SizeOfRawData 0x1200
PointerToRawData 0x15200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.25357

Imports

ADVAPI32.DLL CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CRYPT32.DLL CryptUnprotectData
GDI32.dll BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetDIBits
SelectObject
KERNEL32.dll CloseHandle
CreateDirectoryA
CreateFileA
CreateMutexA
CreatePipe
CreateProcessA
CreateToolhelp32Snapshot
DeleteFileA
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
GetFileAttributesExA
GetLastError
GetLocalTime
GetLogicalDriveStringsA
GetModuleFileNameA
GetProcAddress
GetProcessTimes
GetStartupInfoA
GetSystemInfo
GetSystemTime
GetTickCount
GetVersionExA
GetVolumeInformationA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
MoveFileA
OpenProcess
PeekNamedPipe
Process32First
Process32Next
ReadFile
ReleaseMutex
ResumeThread
SetErrorMode
SetFileAttributesA
SetFilePointer
Sleep
TerminateProcess
WideCharToMultiByte
WriteFile
msvcrt.dll _beginthreadex
_filelengthi64
_vscprintf
_vsnprintf
calloc
fclose
fflush
fgetpos
fgets
fopen
fread
free
fsetpos
fwrite
getenv
malloc
realloc
strcat
strchr
strcpy
NETAPI32.DLL NetApiBufferFree
NetWkstaGetInfo
SHELL32.DLL SHFileOperationA
USER32.dll CreateWindowExA
DefWindowProcA
DispatchMessageA
EnumWindows
GetDC
GetDesktopWindow
GetForegroundWindow
GetKeyNameTextA
GetKeyState
GetKeyboardState
GetMessageA
GetSystemMetrics
GetWindowTextA
IsWindowVisible
MapVirtualKeyA
PostQuitMessage
RegisterClassExA
ReleaseDC
SendMessageA
SetCursorPos
SetWindowTextA
ShowWindow
ToAscii
TranslateMessage
keybd_event
mouse_event
WS2_32.dll WSACleanup
WSAGetLastError
WSAIoctl
WSAStartup
__WSAFDIsSet
closesocket
connect
gethostbyname
gethostname
htons
inet_ntoa
ioctlsocket
ntohs
recv
select
send
setsockopt
shutdown
socket

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
<-- -->