df0e3b56ef473c70d02c7987ec78cdec6496f37ebd2d333c55e731dbb68c1129

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-11 14:15:58
Detected languages Chinese - PRC
English - United States
FileVersion 1.0.0.1
ProductVersion 1.0.0.1

Plugin Output

Suspicious PEiD Signature: PeStubOEP v1.x
Suspicious The PE is possibly packed. Unusual section name found:
Unusual section name found:
Unusual section name found:
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegCloseKey
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Malicious VirusTotal score: 13/70 (Scanned on 2026-10-13 07:16:16) APEX: Malicious
Bkav: W32.Malware.4D0979D8
CrowdStrike: win/malicious_confidence_90% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.VMProtect.AC suspicious application
Elastic: malicious (high confidence)
Malwarebytes: Malware.Heuristic.2108
McAfeeD: Real Protect-LS!B34C7E5C1F36
Microsoft: Program:Win32/Wacapew.C!ml
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.high.ml.score

Hashes

MD5 b34c7e5c1f366581e76c2dda60e52712 🔍
SHA1 b0b9329bdb724008f1fe1dc708e892ec4f9e5bcc 🔍
SHA256 df0e3b56ef473c70d02c7987ec78cdec6496f37ebd2d333c55e731dbb68c1129 🔍
SHA3 d8179067d488198e01274e937d09c10be19b5c016be6e79ed3c757519ef48b1b 🔍
SSDeep 393216:SwXqygdbs4hAEKqs3n5dUblihWK3TxY3CYmieQ:Shs/EKqs3n3Wlik3CYR 🔍
Imports Hash 3e9c3e4ae445ce0f83cdd8e9630e441f 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Oct-11 14:15:58
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x27d200
SizeOfInitializedData 0x2daa00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000129ABE3 (Section: )
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1ef3000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x27d10c
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xa3d4c
VirtualAddress 0x27f000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xb4a18
VirtualAddress 0x323000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xfc3c
VirtualAddress 0x3d8000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Section_5

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xd42690
VirtualAddress 0x3e8000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Section_6

MD5 3f079574de51aa4b92f162f9083249b7 🔍
SHA1 d636e81497dc71ddf6a35280b6eb6850ee6f2fc4 🔍
SHA256 828346fe2f7808dd6bf9e724b8d4aada0aee2df5836b85ea5b2daa93b26a603a 🔍
SHA3 d36874e8c357dfde20d6d63b401f8c79d5633c28453fc10f666dffe9d34c06b6 🔍
VirtualSize 0x200
VirtualAddress 0x112b000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.89039

Section_7

MD5 1cee3dd9548573bf6ddbc24729922e2e 🔍
SHA1 d2dbe69c00ff80d528dc2c74d3ffc4f08d745e6b 🔍
SHA256 678c2206cc8a7e77d29bee19b03964b9eb0ffd6af0aea79c688877f4044e61f4 🔍
SHA3 442297e50a065d63d08e09496a39f7a039d1a8a38bfa6104bd544c2d62777a38 🔍
VirtualSize 0xdc059c
VirtualAddress 0x112c000
SizeOfRawData 0xdc0600
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.9776

.rsrc

MD5 010d3f1634e386ba6201ad4818b374bc 🔍
SHA1 5ff4fe90ceb0e45f80ee36fc4cdc4852e4d0dfae 🔍
SHA256 bd3d8e7562c570799a8c2830cb2d2e41fa6fa5678635f7bf568e57848762e39a 🔍
SHA3 41a090d6f37534e9008104510ff44aee9c7385df36576ae6d01d1b710bb39ed1 🔍
VirtualSize 0x51ac
VirtualAddress 0x1eed000
SizeOfRawData 0x5200
PointerToRawData 0xdc0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.80409

Imports

mfc140.dll #4994
KERNEL32.dll CreateFileA
USER32.dll MoveWindow
GDI32.dll TextOutA
ADVAPI32.dll RegCloseKey
SHELL32.dll SHGetFolderPathA
COMCTL32.dll InitCommonControlsEx
SHLWAPI.dll PathRemoveBackslashA
ole32.dll OleRun
OLEAUT32.dll GetErrorInfo
gdiplus.dll GdiplusShutdown
MSVCP140.dll ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
WINMM.dll timeGetTime
WS2_32.dll WSASetLastError
IPHLPAPI.DLL GetAdaptersAddresses
VCRUNTIME140.dll longjmp
api-ms-win-crt-runtime-l1-1-0.dll _beginthreadex
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0.dll strncpy_s
api-ms-win-crt-locale-l1-1-0.dll setlocale
api-ms-win-crt-heap-l1-1-0.dll realloc
api-ms-win-crt-multibyte-l1-1-0.dll _mbscmp
api-ms-win-crt-convert-l1-1-0.dll _strtoui64
api-ms-win-crt-filesystem-l1-1-0.dll _lock_file
api-ms-win-crt-utility-l1-1-0.dll srand
api-ms-win-crt-time-l1-1-0.dll clock
api-ms-win-crt-math-l1-1-0.dll frexp
api-ms-win-crt-environment-l1-1-0.dll getenv

Delayed Imports

1

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x4cff
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.87403
Detected Filetype PNG graphic file
MD5 0f2ddeff5a202208eab632a3c1ed4ae8 🔍
SHA1 01510a40d552b6670d6516467ca550a8342d3ce6 🔍
SHA256 f5be5ba53b6f611a1e386c39a144152ebfd334ddee557c043ca63a6be1c9e4f6 🔍
SHA3 ca2d4db1bb428cd777f634f78a1de225d4df3d6a755f29ef8e63eed5ae6bac4f 🔍

128

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.51664
Detected Filetype Icon file
MD5 bc3514e1b0366644533fe62e63351c5f 🔍
SHA1 26561b0f6e8f296b7996be59ea11c0177cfc344a 🔍
SHA256 433575728a4b52e556d02c995986a7a8ccaa110f2ad2d38d600a04a32c7b1dd7 🔍
SHA3 ac49378fa0407fd4096ee0e12af5fad6c0ebaa4284d21b6f3fee6ac22cef0f56 🔍

1 (#2)

Type RT_VERSION
Language Chinese - PRC
Codepage UNKNOWN
Size 0x140
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04647
MD5 de1b1835ebb62716e5aa6689155c033b 🔍
SHA1 c56277a38378b4b99d0e30278923dc67b0b9602f 🔍
SHA256 96973a5a8a4eabe12310ddebd97f6d9f8156f3eced4b8af1e74cdf5f2ea8936f 🔍
SHA3 5a24b07d8e7f30ac87706df848cca7e7e114c5d8b10dc4d6acf3038445d7dafc 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x224
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.04378
MD5 245b863be176aab16ef1dbe168defe03 🔍
SHA1 c0a369f6f0e77b89c5d9d37fb94e1d5e2d431b5b 🔍
SHA256 59ba97d56a01766792386c3b379946bb613c8921e3daf8a878855a268ad5e4aa 🔍
SHA3 7efbe82f17422b353f747a146c1e8f1b9df37e90648150f2020442ff9477341e 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.1
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language Chinese - PRC
FileVersion (#2) 1.0.0.1
ProductVersion (#2) 1.0.0.1
Resource LangID Chinese - PRC

TLS Callbacks

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140323010

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section has a size of 0!
Leave a comment

No comments yet.