dfdbf3e4c3e3b186b4fcea508c5a45a4

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2011-Feb-27 22:16:45

Plugin Output

Suspicious The PE is packed with mpress Unusual section name found: .MPRESS1
Section .MPRESS1 is both writable and executable.
Unusual section name found: .MPRESS2
Section .MPRESS2 is both writable and executable.
The PE only has 6 import(s).
Malicious VirusTotal score: 46/72 (Scanned on 2020-01-18 12:43:49) Bkav: W32.AIDetectVM.malware
MicroWorld-eScan: DeepScan:Generic.Malware.Sdld!!.A43C68BC
FireEye: Generic.mg.dfdbf3e4c3e3b186
CAT-QuickHeal: Trojan.Agent
McAfee: RDN/Generic.dx!dgd
Cylance: Unsafe
VIPRE: Trojan.Win32.Generic!BT
Sangfor: Malware
K7AntiVirus: Unwanted-Program ( 004d38111 )
Alibaba: Trojan:Win32/Esulat.fa7059a4
K7GW: Unwanted-Program ( 004d38111 )
Cybereason: malicious.4c3e3b
Invincea: heuristic
APEX: Malicious
ClamAV: Win.Trojan.Sality-20191
BitDefender: DeepScan:Generic.Malware.Sdld!!.A43C68BC
AegisLab: Trojan.Win32.DeepScan.4!c
Endgame: malicious (high confidence)
Sophos: Generic PUA DH (PUA)
Comodo: Malware@#smup5nqmy6h1
TrendMicro: TROJ_GEN.R005C0PDQ19
McAfee-GW-Edition: BehavesLike.Win32.Trojan.xh
Trapmine: malicious.high.ml.score
CMC: Virus.Win32.Sality!O
Emsisoft: DeepScan:Generic.Malware.Sdld!!.A43C68BC (B)
SentinelOne: DFI - Malicious PE
Jiangmin: Trojan.GenericKD.a
Webroot: W32.Downloader.Fosniw
Fortinet: Riskware/HackTool_Patcher_CX
Antiy-AVL: Trojan/Win32.TSGeneric
Arcabit: DeepScan:Generic.Malware.Sdld!!.A43C68BC
Microsoft: Trojan:Win32/Esulat.A!rfn
Acronis: suspicious
ALYac: DeepScan:Generic.Malware.Sdld!!.A43C68BC
MAX: malware (ai score=100)
VBA32: BScope.Trojan.MulDrop
ESET-NOD32: a variant of Win32/HackTool.Patcher.CX potentially unsafe
TrendMicro-HouseCall: TROJ_GEN.R005C0PDQ19
Rising: Trojan.Wacatac!8.10C01 (CLOUD)
Yandex: PUP.Patcher!
Ikarus: Trojan.Win32.Crypt
eGambit: Unsafe.AI_Score_99%
GData: DeepScan:Generic.Malware.Sdld!!.A43C68BC
Ad-Aware: DeepScan:Generic.Malware.Sdld!!.A43C68BC
Panda: PUP/Patcher
CrowdStrike: win/malicious_confidence_90% (W)

Hashes

MD5 dfdbf3e4c3e3b186b4fcea508c5a45a4
SHA1 37ff99d17049d7ca9fb3324c2deac96861cef377
SHA256 4f9208f87a734974d00eb3fba5c8bc6f67136ceb331d7982e17548adf5164683
SHA3 ec5ba35598e4702a5308715ada8dee8736007834486ddc35ac75c002ed08f880
SSDeep 96:ZwwE4pzU6f0b6EMDshG5AuwdEgWN/JNMe8hpcfnp3:O4pzU6f0phG5A/Eg28hpYp
Imports Hash 9b02cabfb707d22690ee394fdedd3088

DOS Header

e_magic MZ
e_cblp 0x40
e_cp 0x1
e_crlc 0
e_cparhdr 0x2
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0xb400
e_oeminfo 0xcd09
e_lfanew 0x40

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 2
TimeDateStamp 2011-Feb-27 22:16:45
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x1000
SizeOfInitializedData 0xe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00004145 (Section: .MPRESS2)
BaseOfCode 0x1000
BaseOfData 0x2000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x5000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.MPRESS1

MD5 d487dc524e5e07210080e6a3308b64c3
SHA1 d06a891b4d47f940ea9fd42a54951c6856bd7c92
SHA256 a1b038f4a585dbf5ff87952eb34c9ee91467d00e2231b34e7836d5b6d7cbb7ed
SHA3 6134fd3a61432cce108e25001f9a293827dfca9362ec6c37b868bfd76891d4c3
VirtualSize 0x3000
VirtualAddress 0x1000
SizeOfRawData 0x1200
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.20999

.MPRESS2

MD5 78a6239ad99abddaab48e7c1a2d8a92e
SHA1 b81dac8acddcbefea25632505e41877f841b6465
SHA256 135172ca56ce5edb0be966391179a5f0ef4c0e8786e385e6bc9e8f47e3377a56
SHA3 731d467e058fcf5d05e3e7df2ae0b98e23ba362ccf25a62a488343e911f21c18
VirtualSize 0x3f4
VirtualAddress 0x4000
SizeOfRawData 0x400
PointerToRawData 0x1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.90023

Imports

KERNEL32.DLL GetModuleHandleA
GetProcAddress
MSVCRT.dll exit
USER32.dll wvsprintfA
SHELL32.dll SHGetMalloc
comdlg32.dll GetOpenFileNameA

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors