| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-23 10:44:09 |
| Detected languages |
English - United States
|
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains another PE executable:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. | Resource 101 detected as a PE Executable. |
| Malicious | VirusTotal score: 24/68 (Scanned on 2026-05-30 02:32:53) |
APEX:
Malicious
Antiy-AVL: RiskWare/Win64.Gamehack Bkav: W32.Malware.616478BC CTX: exe.trojan.agen CrowdStrike: win/malicious_confidence_90% (W) Cylance: Unsafe DeepInstinct: MALICIOUS ESET-NOD32: Win64/GameHack_AGen.BHR potentially unsafe application Elastic: malicious (high confidence) Fortinet: Adware/GameHack_AGen Google: Detected Lionic: Trojan.Win32.GameHack.4!c MaxSecure: Trojan.Malware.300983.susgen McAfeeD: Real Protect-LS!BE89B934FE9B Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence TrellixENS: Artemis!BE89B934FE9B TrendMicro: Trojan.Win32.ZYX.USBLEQ26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLEQ26 Varist: W64/ABApplication.QDLZ-8003 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-May-23 10:44:09 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x5a000 |
| SizeOfInitializedData | 0x91e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000596FC (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xf0000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| SHELL32.dll |
ShellExecuteW
Shell_NotifyIconW |
|---|---|
| WININET.dll |
InternetOpenA
InternetReadFile InternetConnectA InternetSetOptionA InternetOpenUrlA InternetCloseHandle HttpOpenRequestA HttpSendRequestA HttpQueryInfoA |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
| KERNEL32.dll |
RtlVirtualUnwind
RtlLookupFunctionEntry RtlCaptureContext CloseHandle Sleep MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess ReadProcessMemory GetModuleHandleW GetProcAddress WaitForSingleObject CreateRemoteThread VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA LoadResource UnhandledExceptionFilter SizeofResource FindResourceW K32EnumProcessModulesEx K32GetModuleBaseNameA GetLastError GetTickCount64 WideCharToMultiByte OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte SetUnhandledExceptionFilter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess InitializeSListHead TerminateProcess GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime LockResource |
| USER32.dll |
SetClipboardData
GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow OpenClipboard SetCursorPos SetCursor ClientToScreen LoadIconW GetSystemMetrics IsWindowVisible SetLayeredWindowAttributes ShowWindow LoadCursorW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient GetCursorPos ValidateRect SetForegroundWindow UpdateWindow TrackPopupMenu AppendMenuW DestroyMenu DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW CloseClipboard GetClientRect MessageBoxW TranslateMessage PeekMessageW DispatchMessageW CreatePopupMenu |
| MSVCP140.dll |
_Thrd_detach
?_Xout_of_range@std@@YAXPEBD@Z _Thrd_id _Thrd_join ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z |
| IMM32.dll |
ImmSetCandidateWindow
ImmGetContext ImmSetCompositionWindow ImmReleaseContext |
| D3DCOMPILER_47.dll |
D3DCompile
|
| VCRUNTIME140.dll |
_CxxThrowException
__std_exception_copy memcpy memmove memset strchr memchr memcmp __std_terminate __C_specific_handler __current_exception __current_exception_context __std_exception_destroy |
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_invoke_watson
_beginthreadex _register_thread_local_exe_atexit_callback terminate _c_exit _exit exit _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initterm_e _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm |
| api-ms-win-crt-string-l1-1-0.dll |
strncpy
strlen wcslen towlower strncpy_s strncmp wcscmp wcscpy_s strcmp _stricmp |
| api-ms-win-crt-stdio-l1-1-0.dll |
fseek
ftell _set_fmode fwrite __acrt_iob_func fflush fclose __p__commode fread __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _wfopen |
| api-ms-win-crt-math-l1-1-0.dll |
cosf
sinf __setusermatherr expf powf fmodf roundf ceilf sqrtf acosf |
| api-ms-win-crt-heap-l1-1-0.dll |
_callnewh
free _set_new_mode malloc |
| api-ms-win-crt-utility-l1-1-0.dll |
qsort
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-23 10:44:09 |
| Version | 0.0 |
| SizeofData | 892 |
| AddressOfRawData | 0xb5268 |
| PointerToRawData | 0xb4668 |
| StartAddressOfRawData | 0x1400b5608 |
|---|---|
| EndAddressOfRawData | 0x1400b5610 |
| AddressOfIndex | 0x1400bec70 |
| AddressOfCallbacks | 0x14005b740 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400be1c0 |
| XOR Key | 0x4d31be27 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| ASM objects (35207) | 4 |
| C objects (35207) | 10 |
| C++ objects (35207) | 31 |
| Imports (35207) | 6 |
| Imports (33145) | 19 |
| Total imports | 225 |
| C++ objects (35224) | 12 |
| Resource objects (35224) | 1 |
| 151 | 1 |
| Linker (35224) | 1 |
No comments yet.