d9f19b99930397e4a07201ae70e527c8

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2017-Jul-18 12:48:42

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
Suspicious Strings found in the binary may indicate undesirable behavior: Contains obfuscated function names:
  • 63 40 4e 4b 63 46 4d 5d 4e 5d 56
Suspicious The PE is possibly packed. The PE only has 9 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • FindWindowA
Suspicious The file contains overlay data. 4 bytes of data starting at offset 0x1400.
Malicious VirusTotal score: 18/70 (Scanned on 2021-02-14 13:02:33) Lionic: Trojan.Win32.YotQm.4!c
Elastic: malicious (high confidence)
MicroWorld-eScan: Gen:Trojan.Heur.amX@YotQm1n
Cybereason: malicious.993039
APEX: Malicious
BitDefender: Gen:Trojan.Heur.amX@YotQm1n
Ad-Aware: Gen:Trojan.Heur.amX@YotQm1n
FireEye: Generic.mg.d9f19b99930397e4
Emsisoft: Gen:Trojan.Heur.amX@YotQm1n (B)
SentinelOne: Static AI - Malicious PE - Downloader
GData: Gen:Trojan.Heur.amX@YotQm1n
eGambit: Unsafe.AI_Score_94%
Arcabit: Trojan.Heur.E44EAC
Microsoft: Trojan:Win32/Zpevdo.A
BitDefenderTheta: AI:Packer.4E2D08C31B
ALYac: Gen:Trojan.Heur.amX@YotQm1n
MAX: malware (ai score=99)
VBA32: suspected of Trojan.Downloader.gen.s

Hashes

MD5 d9f19b99930397e4a07201ae70e527c8
SHA1 f9a48ddbe15d3d8d34cddfbe8d246d7d1b841216
SHA256 f58b95ca013aee22037b7d90c217d412b9385bf7f808ecc1d5ffda9aed65924b
SHA3 27aa5b238aa4f784a10889eefcc03071bc6ab44c6a48839394f5086c1d287587
SSDeep 48:yMmI0kdPg0HrqOnM3tJ46mU6YOI8lcpoBuuIihhvnLBeq0PG2nPlTB5ZLDmb1297:QI0N5tJlDV8HBuuVht3ojPldDmbuiE
Imports Hash f7f1062275990f5e3d11d1e9558bbe56

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xb8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2017-Jul-18 12:48:42
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 5.0
SizeOfCode 0xa00
SizeOfInitializedData 0x600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001000 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x4000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 57334fd1d3a3ab9f69f156ab3734bce6
SHA1 15a01b501f1d9cec8158717b04693cdd984ea18c
SHA256 352a1b812b4d85caada9d932666c4d9671b95c47680eceb41437e32efb3c58be
SHA3 939dd90e27b91a3d3c85cc874ebde1f4056b67c1b9bb18bba49107f9f8009a5f
VirtualSize 0x848
VirtualAddress 0x1000
SizeOfRawData 0xa00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.77698

.rdata

MD5 97893d0f78ab5115446cc3866d4d0f1b
SHA1 9603d7da79787883ff3bd396f6ae8faa07a31b08
SHA256 4261571ff5fc4fd9b72639f10290fc918bb0bf993e2df933c3a53133295928b6
SHA3 9e20a692b2f547a9993d93c2b3315e2d211b5f1db15cd844153a9de67c85b560
VirtualSize 0x13e
VirtualAddress 0x2000
SizeOfRawData 0x200
PointerToRawData 0xe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.90599

.data

MD5 44846cf3668f2ece23ff5db964ec5426
SHA1 c9aaab942876ab534d08a58f19a89d0382df4f7b
SHA256 4565906030f229d5ff2ac4b251cdb52c5f19a73b52f3551a0b5581c72eb31be0
SHA3 37bded5877537422cdf4d30152140eb338b0afbedae1f2827360d25f0514a59d
VirtualSize 0x284
VirtualAddress 0x3000
SizeOfRawData 0x400
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.96083

Imports

user32.dll FindWindowA
kernel32.dll WriteFile
CloseHandle
ExitProcess
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetStdHandle

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x7aa03e64
Unmarked objects 0
19 (8078) 21
18 (8444) 3

Errors

<-- -->