| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-Oct-26 17:44:42 |
| Detected languages |
English - United States
|
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 26/72 (Scanned on 2024-11-21 02:26:02) |
ALYac:
Gen:Variant.Lazy.595216
Antiy-AVL: Trojan/Win32.Agent Arcabit: Trojan.Lazy.D91510 BitDefender: Gen:Variant.Lazy.595216 Bkav: W64.AIDetectMalware CTX: exe.trojan.lazy Cylance: Unsafe DeepInstinct: MALICIOUS Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Lazy.595216 (B) FireEye: Gen:Variant.Lazy.595216 Fortinet: W32/PossibleThreat GData: Gen:Variant.Lazy.595216 Google: Detected Lionic: Trojan.Win32.Generic.4!c Malwarebytes: Generic.Malware/Suspicious McAfee: Artemis!E84073E14F57 McAfeeD: ti!36E0893DE580 MicroWorld-eScan: Gen:Variant.Lazy.595216 Microsoft: Program:Win32/Wacapew.C!ml Panda: Trj/Chgt.AD Rising: Trojan.Kryptik@AI.86 (RDML:doXK3ZZGTmatg3BQI1ISaA) Symantec: ML.Attribute.HighConfidence TrendMicro-HouseCall: TROJ_GEN.R002H09KJ24 VIPRE: Gen:Variant.Lazy.595216 Varist: W64/ABTrojan.QEOB-8953 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2024-Oct-26 17:44:42 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2f800 |
| SizeOfInitializedData | 0x17e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000000C90C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x4b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetTempFileNameW
GetTempPathW GetLastError ResumeThread GetModuleHandleA GetProcAddress ExpandEnvironmentStringsW CreateFileW GetFileSize CloseHandle VirtualAlloc VirtualFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetThreadContext SetThreadContext WriteProcessMemory Wow64GetThreadContext Wow64SetThreadContext WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose RtlUnwind |
|---|---|
| ntdll.dll |
RtlLookupFunctionEntry
RtlCaptureContext NtCreateSection NtWriteFile RtlVirtualUnwind NtOpenFile NtClose RtlInitUnicodeString NtMapViewOfSection NtSetInformationFile |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Oct-26 17:44:42 |
| Version | 0.0 |
| SizeofData | 900 |
| AddressOfRawData | 0x3e334 |
| PointerToRawData | 0x3cf34 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140043040 |
| XOR Key | 0x4eb55cbf |
|---|---|
| Unmarked objects | 0 |
| ASM objects (30795) | 5 |
| C++ objects (30795) | 179 |
| C objects (30795) | 16 |
| ASM objects (33808) | 10 |
| C objects (33808) | 17 |
| C++ objects (33808) | 82 |
| Imports (30795) | 5 |
| Total imports | 123 |
| C++ objects (34123) | 5 |
| Resource objects (34123) | 1 |
| Linker (34123) | 1 |