| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Nov-11 19:12:09 |
| Detected languages |
English - United States
|
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses known Mersenne Twister constants
Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 43/71 (Scanned on 2026-03-26 15:20:14) |
APEX:
Malicious
AVG: Win64:MalwareX-gen [Cryp] Antiy-AVL: Trojan/Win64.GenKryptik Arcabit: Trojan.Tedy.DD1B6F Avast: Win64:MalwareX-gen [Cryp] BitDefender: Gen:Variant.Tedy.858991 Bkav: W64.AIDetectMalware CAT-QuickHeal: Hacktool.Injector CTX: exe.trojan.genkryptik CrowdStrike: win/malicious_confidence_90% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win64/GenKryptik.HOSX trojan Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Tedy.858991 (B) Fortinet: W64/GenKryptik.HOSX!tr GData: Gen:Variant.Tedy.858991 Google: Detected Gridinsoft: PUP.Win64.Puwaders.cl Ikarus: Trojan.Win64.Krypt K7AntiVirus: Trojan ( 006d91201 ) K7GW: Trojan ( 006d91201 ) Lionic: Trojan.Win32.Generic.4!c Malwarebytes: Malware.AI.4249831387 MaxSecure: Trojan.Malware.584370077.susgen McAfeeD: ti!E88DC150D4E7 MicroWorld-eScan: Gen:Variant.Tedy.858991 Microsoft: HackTool:Win32/Injector!MTB Paloalto: generic.ml Rising: Trojan.Kryptik!8.8 (CLOUD) SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win64.Infected.ch Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence Tencent: Malware.Win32.Gencirc.14a8de06 TrellixENS: Artemis!D203EAD9237E TrendMicro-HouseCall: TROJ_GEN.R014H09AJ26 VIPRE: Gen:Variant.Tedy.858991 Varist: W64/ABTrojan.DJMR-0223 Yandex: Trojan.GenKryptik!7Y1MX/vH628 Zillya: Trojan.GenKryptik.Win64.64819 alibabacloud: Trojan:Win/Injector.Gen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2025-Nov-11 19:12:09 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xa0600 |
| SizeOfInitializedData | 0x36400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000006E990 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xdd000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| WS2_32.dll |
freeaddrinfo
send WSACloseEvent gethostname ioctlsocket sendto recvfrom getsockopt getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent |
|---|---|
| WLDAP32.dll |
#217
#33 #46 #301 #200 #30 #79 #35 #143 #32 #27 #26 #22 #41 #50 #45 #60 #211 |
| CRYPT32.dll |
CertFreeCertificateChain
CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore |
| Normaliz.dll |
IdnToUnicode
IdnToAscii |
| KERNEL32.dll |
CompareStringW
GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW ExitProcess SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage LCMapStringW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetTempPathA GetLastError LoadLibraryA DeleteFileA GetProcAddress FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW QueryPerformanceCounter GetTickCount CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA MultiByteToWideChar QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx Sleep WideCharToMultiByte MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId RtlUnwind VerifyVersionInfoW CreateFileA GetFileSizeEx GetDriveTypeW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DeleteFileW HeapSize WriteConsoleW VerSetConditionMask CreateFileW LoadLibraryExW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree |
| ADVAPI32.dll |
CryptHashData
CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash OpenThreadToken CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA |
| bcrypt.dll |
BCryptGenRandom
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Nov-11 19:12:09 |
| Version | 0.0 |
| SizeofData | 956 |
| AddressOfRawData | 0xc0aa0 |
| PointerToRawData | 0xbf4a0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Nov-11 19:12:09 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400cc880 |
| XOR Key | 0xabf1716c |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33140) | 193 |
| C objects (33140) | 18 |
| ASM objects (33140) | 8 |
| Unmarked objects (#2) | 2 |
| 253 (VS 2015-2022 runtime 33030) | 7 |
| C objects (VS 2015-2022 runtime 33030) | 18 |
| ASM objects (VS 2015-2022 runtime 33030) | 18 |
| C++ objects (VS 2015-2022 runtime 33030) | 83 |
| Total imports | 217 |
| Imports (33140) | 15 |
| C objects (33523) | 126 |
| C++ objects (LTCG) (33145) | 2 |
| Resource objects (33145) | 1 |
| Linker (33145) | 1 |
No comments yet.