e2bd4044fab4214c4aa7dd65d65fca21

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2019-Jun-17 08:07:18

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains domain names or URLs:
  • http://172.223.112.130
  • http://info.newsrental.net
  • info.newsrental.net
  • newsrental.net
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • LoadLibraryA
  • GetProcAddress
Can access the registry:
  • RegQueryInfoKeyA
  • RegEnumKeyExA
  • RegQueryValueExA
  • RegCloseKey
Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
Has Internet access capabilities:
  • InternetQueryOptionA
  • InternetCloseHandle
  • InternetOpenA
  • InternetSetCookieA
  • InternetAttemptConnect
  • InternetWriteFile
  • InternetSetOptionA
  • InternetReadFile
  • InternetConnectA
Leverages the raw socket API to access the Internet:
  • #52
  • #57
  • #12
  • #116
  • #15
  • #115
Enumerates local disk drives:
  • GetDriveTypeW
  • GetDriveTypeA
Malicious VirusTotal score: 58/70 (Scanned on 2019-10-07 23:43:56) MicroWorld-eScan: Trojan.GenericKD.30920306
FireEye: Generic.mg.e2bd4044fab4214c
McAfee: Trojan-FQCE!E2BD4044FAB4
Cylance: Unsafe
Zillya: Trojan.GenericKD.Win32.142298
K7AntiVirus: Trojan ( 00531dce1 )
Alibaba: Backdoor:Win32/Cypress.00c480dd
K7GW: Trojan ( 00531dce1 )
CrowdStrike: win/malicious_confidence_100% (W)
Invincea: heuristic
F-Prot: W32/Popool.B.gen!Eldorado
Symantec: Backdoor.Trojan
TotalDefense: Win32/FakeDoc_i
APEX: Malicious
Paloalto: generic.ml
Kaspersky: Backdoor.Win32.Cypress.q
BitDefender: Trojan.GenericKD.30920306
NANO-Antivirus: Trojan.Win32.Cypress.falfex
ViRobot: Backdoor.Win32.S.Agent.395776.E
Avast: Win32:Malware-gen
Rising: Trojan.Generic@ML.100 (RDMK:m3tJKOBB4cCagrZMYeykAg)
Endgame: malicious (high confidence)
Emsisoft: Trojan.GenericKD.30920306 (B)
Comodo: Malware@#1xz1sdhwnq77w
F-Secure: Trojan.TR/ATRAPS.Gen4
DrWeb: BackDoor.Spy.3610
VIPRE: Trojan.Win32.Generic.pak!cobra
TrendMicro: BKDR_POWPOOL.B
McAfee-GW-Edition: BehavesLike.Win32.MultiPlug.fh
Sophos: Troj/Bckdoor-AD
SentinelOne: DFI - Suspicious PE
Cyren: W32/Popool.B.gen!Eldorado
Jiangmin: Backdoor.Cypress.e
Webroot: W32.Trojan.GenKD
Avira: TR/ATRAPS.Gen4
Fortinet: W32/Agent.TDK!tr
Antiy-AVL: Trojan[Backdoor]/Win32.Cypress
Arcabit: Trojan.Generic.D1D7CE72
AegisLab: Trojan.Win32.Cypress.4!c
ZoneAlarm: Backdoor.Win32.Cypress.q
Microsoft: Trojan:Win32/Popool.B
TACHYON: Backdoor/W32.Agent.395776.BP
AhnLab-V3: Backdoor/Win32.Cypress.R227847
Acronis: suspicious
VBA32: Backdoor.Cypress
ALYac: Backdoor.Agent.Cypress
MAX: malware (ai score=100)
Ad-Aware: Trojan.GenericKD.30920306
ESET-NOD32: a variant of Win32/Agent.TIA
TrendMicro-HouseCall: BKDR_POWPOOL.B
Tencent: Win32.Trojan.Fakedoc.Auto
Yandex: Backdoor.Cypress!
Ikarus: Trojan.Win32.Agent
GData: Trojan.GenericKD.30920306
AVG: Win32:Malware-gen
Cybereason: malicious.4fab42
Panda: Trj/GdSda.A
Qihoo-360: Win32/Trojan.2c0

Hashes

MD5 e2bd4044fab4214c4aa7dd65d65fca21
SHA1 0423672fe9201c325e33f296595fb70dcd81bcd9
SHA256 af2abf0748013a7084507f8e96f6e7c21a3f962fbbb148dcbb482a98c06940a1
SHA3 9200673212f960ac055112269ff6591d99fb7c717f522d6dee37d4aee339221d
SSDeep 6144:Py7VqCkozgC2uNmz/MbVflIaPhlHvuFFNTP9DZ8EX8kE5KRf+L8uvyvcQ0BiF:Py7V6N/wISZvk7TP9F1X8hcRe8u6wW
Imports Hash 3369edc7cc76aeda733a7503f3df4071

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2019-Jun-17 08:07:18
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 10.0
SizeOfCode 0x46e00
SizeOfInitializedData 0x1c200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00029577 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x48000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x65000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4959bf84a19a135c88ea7c39225f1d89
SHA1 da2cf292472146f1566572464e2ec0c768a4e52e
SHA256 9c8cbecce9d02f4c340312bf85204fe0f495140cd57c5ad4ddac715fe36ebd08
SHA3 3bf91aeb0bb115e0b67db0ecd102b058431c95ca4e9eb7e74aadc5b1b97f42cb
VirtualSize 0x46d65
VirtualAddress 0x1000
SizeOfRawData 0x46e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.63515

.rdata

MD5 d50018843590c32eb79d342721898433
SHA1 f4b5c969be8bc2448caaea2bab2a6a8a6a4ce30b
SHA256 82a700b5d7d23947a1dbe4dff307f6d5b95dfec44440dc105a0840daf95b259f
SHA3 71585b65ab71d20d9e70966e8486dec0d5058cff824dd0d622f21386e129422a
VirtualSize 0xaae6
VirtualAddress 0x48000
SizeOfRawData 0xac00
PointerToRawData 0x47200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.78818

.data

MD5 9e606c44104cdec204f9f9ee704ee6f6
SHA1 3da18d6fa1dcd206ba45c225f41cf172ef7d78e7
SHA256 922fd0bf4929f8f3f55c3c298889fc2f844234e1672263e86c59618f26294f69
SHA3 1a415c905ffea65e96f5fa9488fd63e3dfa9b02adb814bf37c39c02c7fb9d147
VirtualSize 0x4f18
VirtualAddress 0x53000
SizeOfRawData 0x2600
PointerToRawData 0x51e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.01939

.rsrc

MD5 3fa0cc199f5d913247eafa261a40458f
SHA1 cd13d62efb1c5b0a783eb7abeaa85c3d30c2339c
SHA256 b1ec015f93f69593558787702693618d34bf61b4520b89bc25cc73284a9c61c1
SHA3 e1edba6a07d37a5dccf4443d148af375dca370b0ff94339c91be229479ad1b49
VirtualSize 0x5de8
VirtualAddress 0x58000
SizeOfRawData 0x5e00
PointerToRawData 0x54400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.33912

.reloc

MD5 24fbf07008dfef250d1a83e9defbebc3
SHA1 1979e39d45da330b7d20648c28943b86be884be8
SHA256 75e2d1d6527b6688b2aa26b0cf345637fce2ee71c4117cf91e5c7da2e9798d52
SHA3 091bf8e6606ed7a5af408b31bcfb8efe1586672e20a9dce66220212936080c5d
VirtualSize 0x662c
VirtualAddress 0x5e000
SizeOfRawData 0x6800
PointerToRawData 0x5a200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.08529

Imports

KERNEL32.dll WideCharToMultiByte
MultiByteToWideChar
CreateFileA
FileTimeToSystemTime
GetFileSize
SetFilePointer
ReadFile
CreateFileW
SetEndOfFile
GetSystemDefaultLangID
GetLastError
LoadLibraryW
GetProcessHeap
HeapFree
FreeLibrary
GetSystemDirectoryA
CreateProcessA
CreateThread
CloseHandle
IsDebuggerPresent
LoadLibraryA
GetProcAddress
Sleep
GetTickCount
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
GetDriveTypeW
WriteConsoleW
SetStdHandle
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetTimeZoneInformation
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapCreate
GetModuleFileNameW
WriteFile
SetEnvironmentVariableA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
HeapReAlloc
FindFirstFileExA
FindNextFileA
FindClose
GetDriveTypeA
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
CompareStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent
HeapSize
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetLocaleInfoW
ADVAPI32.dll RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
SHELL32.dll SHGetFolderLocation
SHGetPathFromIDListA
ShellExecuteA
ole32.dll CoCreateGuid
WININET.dll InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetSetCookieA
InternetAttemptConnect
HttpOpenRequestA
InternetWriteFile
InternetSetOptionA
InternetReadFile
InternetConnectA
HttpSendRequestExA
WS2_32.dll #52
#57
#12
#116
#15
#115
VERSION.dll GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.0244
MD5 dd3436dcca0482e70449328e3a9eca8e
SHA1 e08b60601929b181c588bda164b0d611a8975a21
SHA256 ae6bdffff2f5901ea76be4ea7a861954a5d953c04aa84c128fab524ba99be01d
SHA3 f97bdeb0251e0ca75f0fe761c70176665deaeb3d746e0a150ba034878249e059

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89186
MD5 137f549d5ca7b9fbe85d17c2cde1947d
SHA1 ea3563a2a0ace9a22be37017ca24d7389520a820
SHA256 578d7c1c129132a1f0e0baef6938dde987828368c4d4ccb497a5bfcc3af69067
SHA3 db46128fe40f06c3b4eee6d48b7635bc9788b79663065666b389d5a2afce0889

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25454
MD5 8a17fff67ed9dff4cfe0e432d3e8cc84
SHA1 eb0a3f2afbab88cca6bb372101af31deda793830
SHA256 ea6c9b05cf7d287d239c11377b6fe9106e57440cf8dc4dad92edd39b63e856f4
SHA3 aa05ccb4380a682d30694857749a48b2f11950cc4e5375e84f0a607e0aae83ca

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58238
MD5 c3ae6aa671f74cf053cc80f93ce24c14
SHA1 8d4a933694fe252cdf4dcdbbf8b131e13c0a5ebf
SHA256 0754d0c337d6782fa5e693a82122dd0d3c88e019d4a23825c6ac05056d912cc7
SHA3 5abbfb663acb353398ee089290c1995142e9191987fbd8bdacea0bc9f8197c5e

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.88741
MD5 28c2d3bf9f77497675d69f8b7f089c2e
SHA1 10c165f7d735c9e7ebbb8309a69f87635d52f9e1
SHA256 a1707ff737f7f04bc870b014256462b20b8f6703076dcf3e18f8a87c65f4a916
SHA3 ff2f8d65c80e2f057c4296fb784b647edf723d07af2d246623a9d4073ef919ff

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89113
MD5 be0876a81757b5586e6b4a356346b305
SHA1 e1bf26cd79c7a9100b57bd53517eb640e675b413
SHA256 727199f2c68bb7ee1b43b39d0c6ff9089a6eee50a77744f604edc090d9c1477b
SHA3 de0a254aa568eae7d0405b66fe4e153ca1c998aea0a3bb8f5ded3a3a0c2aec1c

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.26307
MD5 ee18fdd0975d650e6d3212771254bf01
SHA1 8d39f10a5d778eb19a0f49fcb3b718ece0741b27
SHA256 c4e098c9d8a2d7ab8cac186a94a397f69fcfdfca538e1bba306203a9764b0213
SHA3 e785edd8a2f410cd02ebffa339b97c5d1d86949b147237be3b7ed5dd436f8b09

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.59211
MD5 3e58723c84f3ce16b1dc831cbcbae7f5
SHA1 bf5887d201d27191f6a089a20cc1164cb564abb2
SHA256 5d812134dbd8d40fb3a3fc7f1842a556761f2a32b28178fbf2080b8a340f9d8d
SHA3 97f1fea556eeceecb5ee28509c9a75ea8550cf55026ad6a3b4afc0ffb7f08885

101

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.81487
Detected Filetype Icon file
MD5 881e3e116c50ff13d25c2f0b0f9a8bda
SHA1 982aeb8d3631e3f3b59d19f9e547a38a52037d96
SHA256 6e75b916785f34a8f76bd4efc392559c46df359b9840208823bef6ddf4654de5
SHA3 99784b076b9e068e2738faad1f2e5ef4dc8b725dc7d6a7ad185a1ef5888b8781

Version Info

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x453758
SEHandlerTable 0x44e0b0
SEHandlerCount 176

RICH Header

XOR Key 0xf26a3129
Unmarked objects 0
ASM objects (VS2010 build 30319) 29
C objects (VS2010 build 30319) 190
C objects (VS2008 SP1 build 30729) 3
Imports (VS2008 SP1 build 30729) 17
Total imports 166
C++ objects (VS2010 build 30319) 73
175 (VS2010 build 30319) 11
Resource objects (VS2012 build 50727 / VS2005 build 50727) 1
Linker (VS2010 build 30319) 1

Errors

<-- -->