edade22dec485b6f1ae58791ab328641

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Aug-01 09:43:04

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 13636821 bytes of data starting at offset 0x50000.
The overlay data has an entropy of 7.99635 and is possibly compressed or encrypted.
Overlay data amounts for 97.6535% of the executable.
Malicious VirusTotal score: 10/75 (Scanned on 2024-08-01 10:30:51) APEX: Malicious
AVG: Win64:Malware-gen
Avast: Win64:Malware-gen
Bkav: W64.AIDetectMalware
MaxSecure: Trojan.Malware.121218.susgen
McAfeeD: ti!E8301E1FAB6A
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win64.Downloader.tc
Zillya: Trojan.Agent.Script.1743086

Hashes

MD5 edade22dec485b6f1ae58791ab328641
SHA1 4858ca7eb4b2f2c9a8a19bf4d57e0d228810e877
SHA256 e8301e1fab6a2218c7fe99e0d87f404bd7d8da3bb324a90be06c6a0a34b61827
SHA3 96111f8ca612f7b555de09ceacbde948b7b9a17edd6b464a3a88e0ebfb301751
SSDeep 393216:+l824xJ78W+eGQRJ9jo/au5qW80hoA/EM/YT:msf8W+e5RJ9MV5qW80h
Imports Hash 20d446c1cb128febd23deb17efb67cf6

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2024-Aug-01 09:43:04
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x29c00
SizeOfInitializedData 0x26000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000C200 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x57000
SizeOfHeaders 0x400
Checksum 0xd60aee
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6f12541b07558e1c46246b2a798f0b6d
SHA1 9b87a6585852fcda1d3d8483136996ca658ea7e5
SHA256 d18cf403027fce2b848a37cc5ee21de353cd1260957b1b2d6b26aa7152040661
SHA3 0f5a6cd2dc96384d2650cff0a390aaee83a0509bc0f9976e7adc0ebaa03e069f
VirtualSize 0x29ba0
VirtualAddress 0x1000
SizeOfRawData 0x29c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48756

.rdata

MD5 df92717c08b1e419f3845a21684b2866
SHA1 f981e6b225193cba7160f1b9c7400d76a7f0805e
SHA256 f386bbc874c13477b9af6b21091607019515ad955454d3be01ae262507cbcf2b
SHA3 67a72f1cf8a9b8a5f7eef94a221b62ca0ee17c787369e8e55ce9a1c81447987c
VirtualSize 0x12c0c
VirtualAddress 0x2b000
SizeOfRawData 0x12e00
PointerToRawData 0x2a000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80942

.data

MD5 99d84572872f2ce8d9bdbc2521e1966e
SHA1 1745c4ccf67c876d978058025646a6fc708919e0
SHA256 38832a73d4f0bee667066837ff09b7b2d61d6a52f95f8ff67f31699d6259cd20
SHA3 58fe1fb70b3e9e03cced62aeeb962d64068bf67d1a451d70017c8ebd326cad3a
VirtualSize 0x3338
VirtualAddress 0x3e000
SizeOfRawData 0xe00
PointerToRawData 0x3ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.82717

.pdata

MD5 a2a3bd363becd437dc0a7e6907c97754
SHA1 17572707870051e1003e0879a03b88f9335b7537
SHA256 ee455d46eb64a7d9f285ed638a1b1455abffd85fe9f8a2b2f513094b6b7f6017
SHA3 359b410bde204d5b053249b5968bd0cfdba4c6b59c95c7ae7bd32eddeafe7a49
VirtualSize 0x2298
VirtualAddress 0x42000
SizeOfRawData 0x2400
PointerToRawData 0x3dc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.32738

_RDATA

MD5 52ec5387fbc7d960d9158c15aab19421
SHA1 bd7580b061dbd1b296a29c9764f8d7750388e6d6
SHA256 b2efe87f9e28cc3b4cfb9be5c48da6a6d676ba5da3c574282787d2e9c987c665
SHA3 17dfdd7feb232f2d49b262eb7c79f5aba9e7752793659e3176427e2012c9c862
VirtualSize 0x15c
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x40000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.78092

.rsrc

MD5 c654ab5a3bc06ebf8c554f36c31153c0
SHA1 15f14494bdbdf064f1fd3feb003db789d877e097
SHA256 7a34d25a6102010594863608c5b847d40b74201c575da9accc58c6ecd5ff2920
SHA3 99360e3dc950f1c7388db76c92481fcde651acdb41dac2e74bc497a0ec382930
VirtualSize 0xf41c
VirtualAddress 0x46000
SizeOfRawData 0xf600
PointerToRawData 0x40200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.55497

.reloc

MD5 4138d4447f190c2657ec208ef31be551
SHA1 41f776fbf46111f4aac8e7ff1e7fa89541eda087
SHA256 6d0446dfad2fe0f8b0220b0031af4c220fbb7e9002fdb1c76bd38c4d17b85aed
SHA3 b89616b1b553c7efb9a63061f47fa6c98e5e668e1965a28a42e3c0c42647ddc6
VirtualSize 0x75c
VirtualAddress 0x56000
SizeOfRawData 0x800
PointerToRawData 0x4f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.24013

Imports

USER32.dll CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15653
MD5 15d6a8563184abef13a1ee75aea262ad
SHA1 d7d896432efd845f283f2b98a66486df05bf5e10
SHA256 7cccfafd00332ac9c9f6ac0112cc0653991eb169943919e55d05f3fa15929821
SHA3 93904dad7224f31021bf8d53753e553f8233c2f40f6dbe25e67b692c6ae378ab

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.44895
MD5 1c06420cfb94514d35c088699a04774d
SHA1 2c23d7df4bc8ce3fb15f33e78c042b12814aea3b
SHA256 d73c1848a067a0fd094423213dc1e855b5b29b0b441f0bcb315feb90d662972e
SHA3 a630c0bd054ccf853d3673897d2a553e10797d288b3f09898503304ecec7d7f3

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.77742
MD5 db1208cf5d76055be1c3a34567af9f5a
SHA1 c5adcd7407c8b18459e4b4ce96fb70ecf5701a97
SHA256 5a008270f7254f5ca861e9936f4b5b7a23c04d63165895234fd1782bc03ec0e5
SHA3 549076010917e74ff3fe656848779d90468b96740184b07016dbf2833e9abf99

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x952c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95095
Detected Filetype PNG graphic file
MD5 f6fbada22d6a6c07ef8fdaa504f117d5
SHA1 591a723501eff1a4920462f8efcaf3715e829450
SHA256 3919b11194f130d310dfe08bdce2891c5b64f2703107f53a5a1cbc016fdb609f
SHA3 ceca597fff3f436773eb9e48be245ce9d24439b9527a0d3aedaa1469e49d3f5c

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.0521
MD5 86ce219c337119fe35646823cb56d091
SHA1 74d3090f01f3128bda93a3a7525f139c495bffbd
SHA256 7ef5a24efde1748c0eb12c5817b14cfe1397ae968489a7824a269d02c8223cee
SHA3 8daaa7aab035df895cb478d3b92385d12aebd96c8bbde3a05a615ff56d41aebf

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15081
MD5 58b7700e8f20d0a3c77021eb7e7019dc
SHA1 87f7668b96ab48bd6ba5c8b9968dbb024a028407
SHA256 c5536b396be6dcfc96f4e4f77cc7007b2a56730ee57598a6979cc1c1c71c920a
SHA3 13bb36cea0c569109ddca6560016003d3ce662f8e0bc189e9750019ccdc7bc72

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.39466
MD5 9de69c1c4b3a06597da9c275b38bffb6
SHA1 a4ed3bd1bb4edc0eaa187b68929f596906e9ee87
SHA256 ac2e25dc4a4f7bd96a0bcf3ea63cd1bcf26a6f6a05835e32f96ef99cb4323f30
SHA3 6ff197b54509b5c0fa643d6bdbc756cccec2b5bc8495c770883c021e833f7509

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 cd3a631eace19041876b4c4c6ec8461a
SHA1 d4b3f99c4d648e3446dc05e7fb6e444e42dfed01
SHA256 f5b94a42f1c77c9eef858a0dfd656419fea900b00318c2c0bf49c2fce345d838
SHA3 b6dcbb1b4c262eb5aee12773a52c29ff20fef809a4e61822700d005457944b9f

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Aug-01 09:43:04
Version 0.0
SizeofData 772
AddressOfRawData 0x3a860
PointerToRawData 0x39860

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003e018
GuardCFCheckFunctionPointer 5368886304
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xdc64562c
Unmarked objects 0
ASM objects (30795) 8
C++ objects (30795) 187
C objects (30795) 10
253 (VS2022 Update 4 (17.4.2) compiler 31935) 4
C++ objects (VS2022 Update 4 (17.4.2) compiler 31935) 40
C objects (VS2022 Update 4 (17.4.2) compiler 31935) 17
ASM objects (VS2022 Update 4 (17.4.2) compiler 31935) 9
Imports (30795) 11
Total imports 139
C objects (VS2022 Update 5 (17.5.4) compiler 32217) 21
Linker (VS2022 Update 5 (17.5.4) compiler 32217) 1

Errors

<-- -->