d923bd29112d4c7267a745d8287283f6a4d11eb2da0557eae881c75d92aa1e80

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2021-Aug-01 04:39:37

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 7854066 bytes of data starting at offset 0x47a00.
The overlay data has an entropy of 7.99836 and is possibly compressed or encrypted.
Overlay data amounts for 96.3992% of the executable.
Malicious VirusTotal score: 3/65 (Scanned on 2022-02-22 03:31:07) APEX: Malicious
McAfee-GW-Edition: BehavesLike.Win64.Generic.wc
SentinelOne: Static AI - Suspicious PE

Hashes

MD5 7d9062c6879304dd650a2712406d41bf
SHA1 7975b0f171aedbacba711a1a8539bf5a51554bd4
SHA256 d923bd29112d4c7267a745d8287283f6a4d11eb2da0557eae881c75d92aa1e80
SHA3 8f4bf3cb2a1b42ae0e90bd9e4a4c32f7ae51e1c04885c0d5939373d3a0fadacb
SSDeep 196608:Fh4x7B/ICteEroXxWVfEqlbkkwR7VTEU+ZIZFWtw8Syj0wZ:aFInEroXgfEqirRRoUTZMtw8SEr
Imports Hash 2cdcfb3a828433ba76b5b41f45519bd9

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2021-Aug-01 04:39:37
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x23600
SizeOfInitializedData 0x24000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000009D04 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x5c000
SizeOfHeaders 0x400
Checksum 0x7ca68a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 005fa3c431f3d0f1fc815ef603750e9c
SHA1 58b99f0cc6c4557ca01e33f434e0b89ac2cb8f95
SHA256 2dd1d849123e816979f83f8a8f0687e18fb7d514f92d4a15f0f9f6041e055581
SHA3 68684231d5dd8de9e9358722f76e9d8dca13f1297cc42e6300021273e6104903
VirtualSize 0x23520
VirtualAddress 0x1000
SizeOfRawData 0x23600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46951

.rdata

MD5 537c9f75e1e0a3ad952dec4473429e14
SHA1 d0975974c2f0e376f8a0bf5ed8cc7c2bd2f2ebeb
SHA256 f7b6c5393f7e544154e3aae4b996b7f86cba32b0a9b3b3ac76c3d9d962652377
SHA3 2b1acb68be0b9db5c8632b90825264496b2345f2975920b14536218ecffbfe5b
VirtualSize 0x1147c
VirtualAddress 0x25000
SizeOfRawData 0x11600
PointerToRawData 0x23a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.72647

.data

MD5 e72304a9e9f9718bd2a4b7dfcb43ccda
SHA1 0cd33090a246c6c05624aa34c04288089026437a
SHA256 83d60d72970ebeed49e9801bca3d16983c81404b68869cccd0cff977e8efa04f
SHA3 063fcf10e7fd9a0c5ccd068237b7a2b52282a9dfd7183b278ab6b89cabbaa5ab
VirtualSize 0x103b8
VirtualAddress 0x37000
SizeOfRawData 0xe00
PointerToRawData 0x35000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.65086

.pdata

MD5 15f095e2a81a7269bcf276c3bf00a592
SHA1 ee1045d0085ede68043b058f002fa90a70d3d6c1
SHA256 700c80c98ba4d377e4c8dc08dbc4d0c9b0bcdd7c6959bda9b4e1e38e2489e40c
SHA3 22aa50194643cb5329d0131d7babbb200c5aabc3d153e49bc4a6aae9491012e8
VirtualSize 0x1e0c
VirtualAddress 0x48000
SizeOfRawData 0x2000
PointerToRawData 0x35e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.14015

_RDATA

MD5 2da00c611f87ac523528ea22d612a913
SHA1 06b4700c27cdaa0a9d92af5532c30e5343cf0ac1
SHA256 9d97ddd4b5e6b957f8b694faf25046f81970bad2a6630db214d24278e0586293
SHA3 85a5472723df4920dd68ceb9952004856c2aa6ec4669cc7e0ced67615c64a216
VirtualSize 0xf4
VirtualAddress 0x4a000
SizeOfRawData 0x200
PointerToRawData 0x37e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.9609

.rsrc

MD5 ca3fc7191708061d8c48c4ddc240690a
SHA1 c317e90675f4a780bf9b0334d970a9f7a450278e
SHA256 4093f2f79191c54276540eea0ea3fd29202f4de3cdeac071bbb3f3f45f2d7a53
SHA3 1d11c337da453fa31c60979ef32ec546b2d464818c1f2c425258e5de045b4fcf
VirtualSize 0xf058
VirtualAddress 0x4b000
SizeOfRawData 0xf200
PointerToRawData 0x38000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.35645

.reloc

MD5 aef3fe5d01c63e9b3a006bad387e1444
SHA1 795511433ec8f77e79d39494dea1431263cd7c3b
SHA256 ec2a2351388304049a981ea35dae3ac39b1bc53ebcda57c195584f3015935668
SHA3 91b07d2964138282f0a33cc3e79ae0ac436e86e8a29d16f8cedaef7213d0a7d4
VirtualSize 0x73c
VirtualAddress 0x5b000
SizeOfRawData 0x800
PointerToRawData 0x47200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.23369

Imports

KERNEL32.dll GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LoadLibraryA
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
GetStartupInfoW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5dc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27487
MD5 74f626c81575a07e3b07c2dc99182644
SHA1 ee70a022da5478ed90c8c3d470ae7f9001833369
SHA256 2e2cca97e1e8b9f8d03658535fc2cbf6b05794bfe98ae45f1088ed60f26b3f12
SHA3 6a4fe0aab938a61f45896fb5a82d3745c16d4ead6bc614d34f9c94b29c8954f2

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2021-Aug-01 04:39:37
Version 0.0
SizeofData 656
AddressOfRawData 0x33980
PointerToRawData 0x32380

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140037018

RICH Header

XOR Key 0x584622d4
Unmarked objects 0
C objects (27412) 11
ASM objects (27412) 7
C++ objects (27412) 185
253 (28518) 3
C++ objects (VS 2015/2017/2019 runtime 29913) 38
C objects (VS 2015/2017/2019 runtime 29913) 17
ASM objects (VS 2015/2017/2019 runtime 29913) 9
Imports (27412) 5
Total imports 114
C objects (VS2019 Update 9 (16.9.4) compiler 29914) 19
Linker (VS2019 Update 9 (16.9.4) compiler 29914) 1

Errors

Leave a comment

No comments yet.