e49ea69ab70a8c2392a422ab1bb12d52aedab68e57aa6735e95ac9c26634cab5
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Detected languages |
English - United States
|
| TLS Callbacks | 3 callback(s) detected. |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 47/70 (Scanned on 2026-07-01 18:16:53) |
ALYac:
Trojan.GenericKD.77041509
AVG: Win64:MalwareX-gen [Misc] AhnLab-V3: Trojan/Win.Locker.C5825947 Alibaba: Trojan:Win64/MalwareX.26dba4c0 Antiy-AVL: Trojan/Win64.Locker Arcabit: Trojan.Generic.D4978F65 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Trojan.GenericKD.77041509 Bkav: W32.Malware.2EBF93F5 CTX: exe.trojan.locker CrowdStrike: win/malicious_confidence_70% (W) Cylance: Unsafe Cynet: Malicious (score: 99) ESET-NOD32: Win64/LockScreen.AM trojan Elastic: malicious (high confidence) Emsisoft: Trojan.GenericKD.77041509 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: W64/Agent_AGen.FOB!tr GData: Trojan.GenericKD.77041509 Google: Detected Ikarus: Trojan.Win64.Agent K7AntiVirus: Trojan ( 005cb21c1 ) K7GW: Trojan ( 005cb21c1 ) Kaspersky: HEUR:Trojan.Win64.Locker.gen Kingsoft: Win64.Trojan.Locker.gen Lionic: Trojan.Win32.Locker.4!c Malwarebytes: Generic.Malware/Suspicious MaxSecure: Trojan.Malware.345033516.susgen McAfeeD: ti!E49EA69AB70A MicroWorld-eScan: Trojan.GenericKD.77041509 Microsoft: Trojan:Win32/Kepavll!rfn Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Trojan.Agent!8.B1E (CLOUD) Sangfor: Trojan.Win64.Agent.Vkl6 SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Infected.jh Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.149a910c TrellixENS: Artemis!42781F82CB7A VBA32: Trojan.Win64.Locker VIPRE: Trojan.GenericKD.77041509 Varist: W64/ABTrojan.DZKF-8077 Yandex: Trojan.Locker!Gv7QGDpki2s alibabacloud: Trojan:Win/Agent_AGen.FPH |
Hashes
| MD5 | 42781f82cb7a0098ee55d90d0918a34b 🔍 |
|---|---|
| SHA1 | 791784b724ecd15d85c90e50c500cfcb41118d4e 🔍 |
| SHA256 | e49ea69ab70a8c2392a422ab1bb12d52aedab68e57aa6735e95ac9c26634cab5 🔍 |
| SHA3 | 281ff4fb60f0cd1aeaa595f639f8a3e299a7869f56a233b94edd09255d11d392 🔍 |
| SSDeep | 12288:lRxmBUPplf0t02XiaSySrzETjwQem9Mhxtqn:lRxmBiCSdd2Mhxc 🔍 |
| Imports Hash | 7b8d08c26653381d52d064b0940fdeb4 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x71a00 |
| SizeOfInitializedData | 0x32000 |
| SizeOfUninitializedData | 0xe00 |
| AddressOfEntryPoint | 0x0000000000001348 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xaa000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xa6a2b |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 041af1b8ccf189a3e3943e4ad8d8de10 🔍 |
|---|---|
| SHA1 | f7b7b76d6aa946b403aaadcad22e56ecd9bd5880 🔍 |
| SHA256 | e30c78fc2cfbf5cd94d88b80928670ebe1d60432375061572862f46faf13fe3d 🔍 |
| SHA3 | d0f54e7447c5428a093e2471e917ce0414b8b24736b44fb57cb95b87ca059825 🔍 |
| VirtualSize | 0x71870 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x71a00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.15022 |
.data
| MD5 | 05cc29c8ae62d76a1bb8ff276ad42570 🔍 |
|---|---|
| SHA1 | 4bd15336125faa598ef7dbccd91a0ac4b0cdb212 🔍 |
| SHA256 | 18c3565e75f2383c729aa9c5333ca061b5f22b625407587903cdbb2fa9233f55 🔍 |
| SHA3 | 58081a4ab8f99b52b12a6b999522d03c3a84fed8911dfbbc6d880ee41834c8e9 🔍 |
| VirtualSize | 0x2120 |
| VirtualAddress | 0x73000 |
| SizeOfRawData | 0x2200 |
| PointerToRawData | 0x71e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.547452 |
.rdata
| MD5 | 40dfe34360e64f6bced64d77350cbc86 🔍 |
|---|---|
| SHA1 | 840e57dfb3108668c57e77a567499e972246a08d 🔍 |
| SHA256 | 59cb6ae962adad99a3b3219a00414996d57a0330e3040f27543a02cc7f819556 🔍 |
| SHA3 | 6cefb527adc196f0b8e79aaffac1b862550cd4cc73d0bbe27146fdd8b887745d 🔍 |
| VirtualSize | 0xf670 |
| VirtualAddress | 0x76000 |
| SizeOfRawData | 0xf800 |
| PointerToRawData | 0x74000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.60172 |
.pdata
| MD5 | 010e7216419d18545bc979d9f150663b 🔍 |
|---|---|
| SHA1 | dcfc22965329a6e4ee407d44a934a534b3bbe86e 🔍 |
| SHA256 | d6b4be488bfd196f6d92eb1f477cd0e7aea210ad77b146de48e99dba271b087b 🔍 |
| SHA3 | 83a1665e5e6c3c6fda6287ddb73ed810b6d8a2a10424817633745678ac751d19 🔍 |
| VirtualSize | 0xc2ac |
| VirtualAddress | 0x86000 |
| SizeOfRawData | 0xc400 |
| PointerToRawData | 0x83800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.83163 |
.xdata
| MD5 | eaba060b8df752f74f46a415f194258c 🔍 |
|---|---|
| SHA1 | 794502e8150f60949c04920d5423a24ed16fe601 🔍 |
| SHA256 | 4d4db2b2175e0cf381050fe462f778d606495847ca7ba2213a18160013f61939 🔍 |
| SHA3 | 7211fa33f4244a9d070f58c4ea99e3d8b6a719888f97569ee97281f4a78f54bc 🔍 |
| VirtualSize | 0xced4 |
| VirtualAddress | 0x93000 |
| SizeOfRawData | 0xd000 |
| PointerToRawData | 0x8fc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.51575 |
.bss
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xd10 |
| VirtualAddress | 0xa0000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.idata
| MD5 | 10d803c1392afc56d59bd1ad409d1871 🔍 |
|---|---|
| SHA1 | 967beb208db0453ab7c25bd2a5f5b3ef1d0362b1 🔍 |
| SHA256 | 47d15006a0fa5f2618e57edaf83465548252215eceeeec22d9ee818d9c328e79 🔍 |
| SHA3 | c3f726dfad142efa7445e0055d442532217369a7ae159ea24ac2d96f1e1d729c 🔍 |
| VirtualSize | 0x1834 |
| VirtualAddress | 0xa1000 |
| SizeOfRawData | 0x1a00 |
| PointerToRawData | 0x9cc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.01985 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0xa3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x9e600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 9ed68aa8efc625cf4678563a7a03c818 🔍 |
|---|---|
| SHA1 | 723f7e902e55ab2c4fc12a8b68968ad5bee39734 🔍 |
| SHA256 | 2887848fbc6b01edcf787fd032a4af79b2009174249cefcbf8264bcda220dac3 🔍 |
| SHA3 | c058a387dca91f673d92c3e7d4f7eef5b003a4fe565e86bba433093c9cb89fed 🔍 |
| VirtualSize | 0x3efc |
| VirtualAddress | 0xa4000 |
| SizeOfRawData | 0x4000 |
| PointerToRawData | 0x9e800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.9238 |
.reloc
| MD5 | f0af64b5c1e2b56141b4d08bfc1e4e88 🔍 |
|---|---|
| SHA1 | a2f5b74d585ce4dea5814f6e84ffa2f37bbe5cd0 🔍 |
| SHA256 | ea9ae27bc09a924c7be2df8e1973d4b78066d6b7041232030a76584b8ed8c84c 🔍 |
| SHA3 | 060e5a2f335342e4390eecacbc0248985cef42f92ff26ab3e4c67360af7b0c05 🔍 |
| VirtualSize | 0x1570 |
| VirtualAddress | 0xa8000 |
| SizeOfRawData | 0x1600 |
| PointerToRawData | 0xa2800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.41035 |
Imports
| ADVAPI32.dll |
RegCloseKey
RegDeleteValueA RegOpenKeyExA RegSetValueExA |
|---|---|
| GDI32.dll |
CreateCompatibleDC
CreateFontA CreateSolidBrush DeleteDC DeleteObject GetObjectA GetStockObject SelectObject SetBkMode SetTextColor StretchBlt |
| KERNEL32.dll |
CloseHandle
CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte |
| msvcrt.dll |
__C_specific_handler
___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _ismbblead _setjmp _vscprintf _vsnprintf _vsnwprintf abort atexit calloc exit fgetwc fprintf fputc fputs free getc getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale signal strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _strdup _read |
| USER32.dll |
BeginPaint
CallNextHookEx CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint FillRect GetAsyncKeyState GetClientRect GetMessageA GetSystemMetrics GetWindowTextA InvalidateRect KillTimer LoadCursorA LoadImageA MessageBoxA PostQuitMessage RegisterClassA SendMessageA SetTimer SetWindowTextA SetWindowsHookExA ShowWindow TranslateMessage UnhookWindowsHookEx UpdateWindow |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x3e48 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.94346 |
| Detected Filetype | PNG graphic file |
| MD5 | d9e8bb96d08dd65535eff62b7d867fbe 🔍 |
| SHA1 | 13f3475ce9bd448714dc0ee9b46927c7c63a7ca7 🔍 |
| SHA256 | e9dad530a74275714dcf04991617047d90e7026edbd15ab1f8fc543c18c5f3c5 🔍 |
| SHA3 | 237dfd04ac022482d9bfa0c0a3cf62b922d720796477b42cd47771cc9ce464f8 🔍 |
0
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.51664 |
| Detected Filetype | Icon file |
| MD5 | cfbe39b848f0fb299ecfd629e9583693 🔍 |
| SHA1 | 4f5ced43e40655df12bb4940e47683a370bd8a1d 🔍 |
| SHA256 | 92df7f81746e2f311bdb505ddfb80ab2abccf60bedee1d8795427ec6d1c21519 🔍 |
| SHA3 | 7fb4793feadea389b3c7d33e131a8f8f3eef3c4798454b8915223709e2d5f5cc 🔍 |
Version Info
TLS Callbacks
| StartAddressOfRawData | 0x1400a3000 |
|---|---|
| EndAddressOfRawData | 0x1400a3008 |
| AddressOfIndex | 0x1400a012c |
| AddressOfCallbacks | 0x140085640 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x000000014000759F
0x0000000140007590 0x000000014001139A |
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
Leave a comment
No comments yet.