e524d8066aa47ae1da9a73ee3eeb2262

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2015-Jun-03 22:49:11
Detected languages English - United States

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .udata
Unusual section name found: .wdata
Unusual section name found: .relok
Suspicious The PE contains functions most legitimate programs don't use. Can access the registry:
  • RegRestoreKeyA
  • RegCreateKeyExA
  • RegUnLoadKeyW
  • RegDeleteValueA
  • RegOpenKeyW
 Possibly launches other programs:
  • ShellExecuteW
 Uses Microsoft's cryptographic API:
  • CryptSignHashA
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAllocEx
 Interacts with services:
  • OpenServiceW
  • ControlService
Malicious VirusTotal score: 60/71 (Scanned on 2019-12-07 02:07:02) DrWeb: Trojan.Siggen8.17135
MicroWorld-eScan: Trojan.GenericKDZ.54738
FireEye: Generic.mg.e524d8066aa47ae1
McAfee: GenericRXHE-OK!E524D8066AA4
Malwarebytes: Trojan.Crypt
Zillya: Trojan.Emotet.Win32.15917
Sangfor: Malware
K7AntiVirus: Trojan ( 0054a0351 )
Alibaba: Trojan:Win32/Spelevo.190318
K7GW: Trojan ( 0054a0351 )
Cybereason: malicious.66aa47
Arcabit: Trojan.Generic.DD5D2
Invincea: heuristic
BitDefenderTheta: Gen:NN.ZexaF.32519.luW@aq5RFHdi
F-Prot: W32/Kryptik.AEK.gen!Eldorado
Symantec: Packed.Generic.493
ESET-NOD32: a variant of Win32/Kryptik.GQZC
TrendMicro-HouseCall: TROJ_FRS.0NA103CI19
Avast: Win32:ReposFxg-F [Trj]
ClamAV: Win.Malware.Tofsee-6896728-0
Kaspersky: Trojan-Banker.Win32.Emotet.coso
BitDefender: Trojan.GenericKDZ.54738
NANO-Antivirus: Trojan.Win32.GenKryptik.focjuh
Paloalto: generic.ml
AegisLab: Trojan.Win32.Emotet.L!c
Tencent: Malware.Win32.Gencirc.10180d18
Ad-Aware: Trojan.GenericKDZ.54738
Emsisoft: Trojan.GenericKDZ.54738 (B)
Comodo: Malware@#3eif6ejgpdzho
F-Secure: Trojan.TR/AD.LockyC.lyfhk
VIPRE: Trojan.Win32.Generic!BT
TrendMicro: TROJ_FRS.0NA103CI19
McAfee-GW-Edition: BehavesLike.Win32.EncLoadMoney.cc
Fortinet: W32/GenKryptik.DFRU!tr
Sophos: Mal/Elenoocka-G
Ikarus: Virus.Win32.Ramnit
Cyren: W32/Trojan.QTRN-3619
Jiangmin: Trojan.Banker.Emotet.hls
Webroot: W32.Rogue.Gen
Avira: TR/AD.LockyC.lyfhk
MAX: malware (ai score=100)
Antiy-AVL: Trojan[Backdoor]/Win32.IRCNite
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/SmokeLoader.YL
ZoneAlarm: Trojan-Banker.Win32.Emotet.coso
AhnLab-V3: Trojan/Win32.Agent.R263597
Acronis: suspicious
VBA32: BScope.Trojan.Zbot.2312
ALYac: Trojan.Agent.Emotet
Cylance: Unsafe
APEX: Malicious
Rising: Trojan.Fuerboos!8.EFC8 (TFE:1:gUuGJHv9yWG)
Yandex: Trojan.PWS.Emotet!
SentinelOne: DFI - Malicious PE
MaxSecure: Trojan.Malware.1728101.susgen
GData: Trojan.GenericKDZ.54738
AVG: Win32:ReposFxg-F [Trj]
Panda: Trj/Genetic.gen
CrowdStrike: win/malicious_confidence_100% (W)
Qihoo-360: Win32/Trojan.3e0

Hashes

MD5 e524d8066aa47ae1da9a73ee3eeb2262
SHA1 dc7cf5808417cd8d271e8270f44a1beb95c23ec0
SHA256 ca30c42334fcc693320772b4ce1df26fe5f1d0110bc454ec6388d79dffea4ae8
SHA3 0c429c78e7ba825ce23fbb19654ec22be48eb0fd640f61b82d73f4b68637caf4
SSDeep 3072:W0ovoKI7BrcPRLokQUsdXuCDZ+GqWr2LshbX1xiaY6t5czEx2F870KO8H7kAkFp:QoKIYKkydD0GtMsBX1xlVrUEgQy8H7k
Imports Hash 0e36b6fd871c4b767759d53838d30b78

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2015-Jun-03 22:49:11
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x2d200
SizeOfInitializedData 0x1e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00002008 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2f000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x33000
SizeOfHeaders 0x400
Checksum 0x31e7e
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 fb95d2e3a4177dce4f4dac404111f411
SHA1 50067a62704adcf2c11807b2d35d2f129880178c
SHA256 04fe6bdafcef8cdccfa152923900810b7fb0201f561a042ba1508656aab0110d
SHA3 80d0e9d8c56b6eabd314d43df09ad153b01f3db8d2f5d4f3309b9262f59aeaea
VirtualSize 0x2d0c4
VirtualAddress 0x1000
SizeOfRawData 0x2d200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.81866

.udata

MD5 77a253309a265eefa9201c7854bd6937
SHA1 cc4d86bcd1e2e8410138e3099e76a4da0a284974
SHA256 4a2fb9245f644c372dbdcb5e9a8db8c6786bd33aceffd5fd68a352e2ff5c9548
SHA3 3f58bf192719e470b41db383c5d136d46a2c2669aace5f8ccbbd5d8eb37dca6f
VirtualSize 0x91a
VirtualAddress 0x2f000
SizeOfRawData 0xa00
PointerToRawData 0x2d600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_WRITE
Entropy 4.66858

.wdata

MD5 252844c1ad4da3efe805bc0ae6da9bc3
SHA1 9df56298f9a12d0c2df7389380ec2375a8c28ce8
SHA256 4cff5fb1a60caf6254b714b795005eb99ca39b4e23cab07fd2f897372cc5a631
SHA3 99a6bf1f25c5fc79c3c01a21bccbc80305afb9b921a7b0164f78cc7ae52c88c5
VirtualSize 0x4e1
VirtualAddress 0x30000
SizeOfRawData 0x600
PointerToRawData 0x2e000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.788159

.rsrc

MD5 58a121486e367f9649509f2d7a7cc6a8
SHA1 304af98a033c497defa704773da58849c29badbf
SHA256 885f026f1d3017c3fa9083ee61de6ac621b2fddca0c481581b9826973c7032f7
SHA3 7b0d0a23e18570f95e37d19d9b192058e31c1adc4b2fd9b684f12e0ce4cd38d5
VirtualSize 0x656
VirtualAddress 0x31000
SizeOfRawData 0x800
PointerToRawData 0x2e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 3.13139

.relok

MD5 0e83c0129ae28d0835e384d3592076f1
SHA1 64024d32b4352da91093e2f91b7248822aec4617
SHA256 4cd21281aed916eeca51c1017b80dd73268a3703a242a7cd28141f581af90ca8
SHA3 dca86f42b02e3f5835120152e577f30ad95096498ef3b36665ee2183212c52e6
VirtualSize 0x464
VirtualAddress 0x32000
SizeOfRawData 0x600
PointerToRawData 0x2ee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.61014

Imports

user32.dll CreateWindowExA
DispatchMessageA
LoadMenuW
DrawStateW
CreateDesktopA
CharToOemA
GetMessageA
LoadCursorA
IsDialogMessageA
GetClassLongW
LoadBitmapA
GetPropA
PeekMessageW
LoadIconW
advapi32.dll OpenServiceW
RegRestoreKeyA
GetUserNameW
RegCreateKeyExA
ControlService
RegUnLoadKeyW
RegDeleteValueA
CryptSignHashA
RegOpenKeyW
OpenEventLogA
kernel32.dll QueryDosDeviceW
RemoveDirectoryA
OpenMutexA
CloseHandle
FindResourceW
CompareStringW
VirtualProtect
GetModuleHandleW
GetLastError
CreateJobObjectW
WriteFile
WaitForSingleObjectEx
CreateFileW
SetLastError
CreateMutexW
VirtualAllocEx
InterlockedDecrement
GetLongPathNameW
LoadLibraryA
GetOEMCP
GetCurrentProcess
CreateFileMappingA
ExitThread
DeleteFileA
MoveFileExW
FindFirstFileW
ReadConsoleA
UnmapViewOfFile
GetSystemDirectoryA
OpenJobObjectW
GetSystemTime
crypt32.dll CertCreateCRLContext
CertCloseStore
CertCompareCertificate
modemui.dll drvCommConfigDialogA
drvGetDefaultCommConfigA
shell32.dll SHDefExtractIconW
ShellExecuteW
Shell_NotifyIconA
DragQueryFileA
SHGetFolderPathW
StrStrW
FindExecutableA
ExtractIconW
SHFree
ShellExecuteW
SHGetFileInfoW
SHGetDataFromIDListA
SHFileOperationA
SHQueryRecycleBinW
StrRChrA
ShellMessageBoxA
modemui.dll (#2) drvCommConfigDialogA
drvGetDefaultCommConfigA

Delayed Imports

1

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#2)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#3)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#4)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#5)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#6)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#7)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#8)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#9)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#10)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#11)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#12)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#13)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#14)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#15)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#16)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#17)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#18)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

1 (#19)

Type FRTS
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.94761
MD5 5e435a242b70b17bed2fd9b06d2e3248
SHA1 a21eb6c44b23ddaf0511ce20833b86484fc369ba
SHA256 430a5a48506794e40d8ac1a18fd2449747ff5f880fd8c13f3632ea2e1b56d25b
SHA3 13b7af590adc95409b31937de43d3ea75aa0be781a780be7eb1cac99e41247b8

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the requested directory (offset=0x0).
<-- -->