fae904641982096ab7924993c7f7adfe6500861f6a21d3c35a728702c9608c52

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2032-Dec-04 18:12:15
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • virus
 Contains domain names:
  • 2scripts.sil.org
  • crl.microsoft.com
  • en.wikipedia.org
  • example.com
  • fontawesome.com
  • github.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
  • http://en.wikipedia.org
  • http://en.wikipedia.org/wiki/MIT_License
  • http://www.microsoft.com
  • http://www.microsoft.com/Typography
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0
  • http://www.microsoft.com/typographyMicrosoft
  • https://curl.se
  • https://fontawesome.com
  • https://github.com
  • https://www.verisign.com
  • https://www.verisign.com/rpa
  • microsoft.com
  • verisign.com
  • wikipedia.org
  • www.microsoft.com
  • www.verisign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Uses constants related to RC5 or RC6
Uses constants related to TEA
Uses known Mersenne Twister constants
Suspicious The PE is possibly packed. Unusual section name found: .cj17ree
Section .cj17ree is both writable and executable.
Unusual section name found: .1e4ftnt
Unusual section name found: .a0819y9
Unusual section name found: .dkpu79o
Unusual section name found: .669obma
Unusual section name found: .b21q2bf
Section .b21q2bf is both writable and executable.
The PE only has 5 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Malicious VirusTotal score: 49/69 (Scanned on 2026-07-12 11:44:55) ALYac: Gen:Variant.Lazy.726718
APEX: Malicious
AVG: Win64:MalwareX-gen [Cryp]
AhnLab-V3: Malware/Win.Generic.R779792
Alibaba: Trojan:Win64/MalwareX.a5b10229
Antiy-AVL: Trojan/Win64.Zusy
Arcabit: Trojan.Lazy.DB16BE
Avast: Win64:MalwareX-gen [Cryp]
Avira: TR/W64.MalwareX
BitDefender: Gen:Variant.Lazy.726718
Bkav: W32.Malware.764D6C7C
CTX: exe.trojan.zusy
CrowdStrike: win/malicious_confidence_90% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Lazy.726718 (B)
F-Secure: Trojan.TR/W64.MalwareX
Fortinet: W32/PossibleThreat
GData: Gen:Variant.Lazy.726718
Google: Detected
Gridinsoft: Trojan.Heur!.030124A3
K7AntiVirus: Riskware ( 00584baa1 )
K7GW: Riskware ( 00584baa1 )
Kingsoft: Win64.Troj.zusy.v
Lionic: Trojan.Win32.Zusy.4!c
Malwarebytes: Malware.AI.4155183716
MaxSecure: Trojan.Malware.272843718.susgen
McAfeeD: Real Protect-LS!623E594A314A
MicroWorld-eScan: Gen:Variant.Lazy.726718
Microsoft: Trojan:Win64/Zusy.LVN!MTB
Paloalto: generic.ml
Panda: Trj/CI.A
Rising: Trojan.Zusy!8.10EDD (TFE:4:JokifwNdUcH)
Sangfor: Trojan.Win32.Lotok.swkab
SentinelOne: Static AI - Malicious PE
Skyhigh: BehavesLike.Win64.Trojan.vh
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.high.ml.score
TrellixENS: Artemis!623E594A314A
TrendMicro: Trojan.Win32.ZYX.USBLFF26
TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFF26
VIPRE: Gen:Variant.Lazy.726718
Varist: W64/ABTrojan.BOYD-7361
Webroot: Win.Trojan.Gen
Zoner: Probably Heur.ExeHeaderL
alibabacloud: Trojan:Win/Zusy.LYS2XJC
tehtris: Generic.Malware

Hashes

MD5 623e594a314a2cd438fbfa2b778c25b3
SHA1 9794c9dfd1c97bf511a6d058c536f57a359fa806
SHA256 fae904641982096ab7924993c7f7adfe6500861f6a21d3c35a728702c9608c52
SHA3 e0f7e0e0e1d93cbe3f0635888a276c7c13f3738655b8adad2e370dff3066bb38
SSDeep 49152:/nnX1y+qVTtO6/cuAfTHyZtFOCxYtDrlJkm6uAkh/qNwffAj3g/bTqSk6hIVVnT:/IgTHkACup/lgQ/6STOXG
Imports Hash 3ea8d1f7c399cbf070a36d4f9f0fe436

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2032-Dec-04 18:12:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x23600
SizeOfInitializedData 0x5d0a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000618000 (Section: .b21q2bf)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x668000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.cj17ree

MD5 d8ecf1d56519b848340b1499b132953d
SHA1 ffc1e9d420b643685ba76a3db7749045b213fd96
SHA256 a55c6c56ece2e2e5a0c070b1146db1e2cf40bfefc00cf5408cb9c6654ed73851
SHA3 330027a5ecaee9c0b358ec4943bc964496ee044d79da5ea536cbb6ffe90c44c6
VirtualSize 0x23586
VirtualAddress 0x1000
SizeOfRawData 0x23600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99863

.1e4ftnt

MD5 41f1f3aeb13c0bc35f37c5cd4335f45a
SHA1 2918636058ebed72a7974a1b08830ef126ea5b48
SHA256 c1b9081f99f1a55c801090ae6ba769bf81113ad241627b994b47466d2b241955
SHA3 9b4f53d86153c06d535791c163743868dc3d43af172fa8972e8fb70a11189d96
VirtualSize 0x5894
VirtualAddress 0x25000
SizeOfRawData 0x5a00
PointerToRawData 0x23a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.15685

.a0819y9

MD5 9e900c6b6c20df954f332b76f5b3910e
SHA1 fcbe7f13e81d3e5aca88f85baafd92078ea7e2fd
SHA256 13645b17c6df1cbbb92f2000045099b02a4b53b7b517e65059828f1afdd42d37
SHA3 2748ae227ae1ee9ab99ccdbdf26fcdb1c3da441e762d4be28aa127624216c6f2
VirtualSize 0x5c9ab8
VirtualAddress 0x2b000
SizeOfRawData 0x5c9a00
PointerToRawData 0x29400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.81284

.dkpu79o

MD5 6e35640b7c510d29fe2dd2eb2c0aa334
SHA1 498831532858292b9d5a184b2dc5fdf30b4e9b4d
SHA256 e1d448244afa3af65edd09fe08e4581230f0bce3b10d0f0d9405d960cad056aa
SHA3 139ffc9964aded2014cd64e25161b0dd3446e12ed91edc1e1e746e1fdbb5bed9
VirtualSize 0xfd8
VirtualAddress 0x5f5000
SizeOfRawData 0x1000
PointerToRawData 0x5f2e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.17195

.rsrc

MD5 4974b67efcec84f4c38d811cf8eef71f
SHA1 768719b2147309c56a5811b19ec47b226a61c80c
SHA256 d5adf77422ba631e1377e4f9e9c273c74f37301086908133e95243305d67ad25
SHA3 1c95424862ff1c75d84971d2235b159e0ddd0449b7ec79cf1fe2886b0e3d7a44
VirtualSize 0x2c8
VirtualAddress 0x5f6000
SizeOfRawData 0x400
PointerToRawData 0x5f3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.10725

.reloc

MD5 51b16460ddba9bac400af2a70a3d5384
SHA1 1159beb3561d04aa1062f2ce4ffeda4ea099fa2d
SHA256 c7896f3344f2a0bf6ac02a9de81700d38dfc4207431985015892fa9a8de2540e
SHA3 9af4049b8b681a6d6f3a3223af92b39a6c4ec9c46517bd77376d6b023be1f98f
VirtualSize 0x11c
VirtualAddress 0x5f7000
SizeOfRawData 0x200
PointerToRawData 0x5f4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.41922

.669obma

MD5 0804084eaa3afc873ab0154320906f73
SHA1 4e12b98e8630d70f69336c21e8ea849fcdcc1821
SHA256 308e8282284b5803abcff48423d042f13a75c83ea7818325bdc4ae1389eeb025
SHA3 e58b3aadfa68fa81e0fee8b49d8798463d36d83ca37172d0595cb8a5024800c1
VirtualSize 0x1f9df
VirtualAddress 0x5f8000
SizeOfRawData 0x1fa00
PointerToRawData 0x5f4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.62885

.b21q2bf

MD5 b81360fd4ed30e996c0e636032309111
SHA1 436f0646ee7dfeffc9ba9185ac595dd975b6ded8
SHA256 8d77904965b651facac3575f47adb09996b61279acf931570365c3bf1d6f2ff6
SHA3 13e9fa98109840177db361ecdcda19b0e92243d4d1d120d14b87fea0e75cdee8
VirtualSize 0x4f290
VirtualAddress 0x618000
SizeOfRawData 0x4f400
PointerToRawData 0x613e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.75741

Imports

kernel32.dll LoadLibraryA
GetProcAddress
VirtualProtect
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x266
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.99009
MD5 c827c6e3cb4e41d6b528a738d3232cf6
SHA1 a8f0cc7262684a904eecb242b44acc426c052e43
SHA256 7dc9bf8f6e68950e763cf4ce37e0904bf369a5f25024f3ced7383bef2c245cbf
SHA3 9230eabe587d0530e8efa27c168f1df980fbb185ddf6fefe2c423144eb8d875d

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1405f47c0

RICH Header

Errors

Leave a comment

No comments yet.