fbd4ea403c67ebdba21276b36aca64a7
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Mar-08 23:05:20 |
| Detected languages |
English - United States
|
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is an NSIS installer | Unusual section name found: .ndata |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
1109142 bytes of data starting at offset 0x19a00.
The overlay data has an entropy of 7.9262 and is possibly compressed or encrypted. Overlay data amounts for 91.3549% of the executable. |
| Malicious | VirusTotal score: 53/71 (Scanned on 2026-02-16 03:11:12) |
ALYac:
Gen:Trojan.Malware.kvZ@a4cXcwji
APEX: Malicious AVG: Win32:Evo-gen [Trj] AhnLab-V3: Trojan/Win.Generic.R757258 Alibaba: Trojan:Win32/Dedok.ef5b2294 Antiy-AVL: Trojan/Win32.Agent Arcabit: Trojan.Malware.EED929 Avast: Win32:Evo-gen [Trj] Avira: HEUR/AGEN.1373296 BitDefender: Gen:Trojan.Malware.kvZ@a4cXcwji Bkav: W32.AIDetectMalware CAT-QuickHeal: Trojan.Win64 CTX: exe.trojan.generic CrowdStrike: win/malicious_confidence_100% (D) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Trojan.MulDrop35.46216 ESET-NOD32: Win32/Inoci.A trojan Elastic: malicious (high confidence) Emsisoft: Gen:Trojan.Malware.kvZ@a4cXcwji (B) F-Secure: Heuristic.HEUR/AGEN.1373296 Fortinet: W32/Inoci.A!tr GData: Gen:Trojan.Malware.kvZ@a4cXcwji Google: Detected Gridinsoft: Trojan.Win32.Kryptik.sa Ikarus: Trojan-Dropper.Win64.Agent K7AntiVirus: Trojan ( 005ce47e1 ) K7GW: Trojan ( 005ce47e1 ) Kaspersky: Trojan.Win32.Dedok.cet Kingsoft: Win32.Trojan-PSW.Stealer.gen Lionic: Trojan.Win32.Agent.tsYE Malwarebytes: Generic.Malware/Suspicious MaxSecure: Trojan.Malware.584852859.susgen McAfeeD: ti!D22B56FBE800 MicroWorld-eScan: Gen:Trojan.Malware.kvZ@a4cXcwji Microsoft: Trojan:Win32/Etset!rfn Paloalto: generic.ml Rising: Stealer.Agent!8.C2 (CLOUD) Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Suspicious PE Skyhigh: BehavesLike.Win32.Dropper.tc Sophos: Mal/Generic-S Tencent: Win32.Trojan.Dedok.Simw TrellixENS: Artemis!FBD4EA403C67 TrendMicro: TROJ_GEN.R002C0DBF26 TrendMicro-HouseCall: TROJ_GEN.R002C0DBF26 VIPRE: Gen:Trojan.Malware.kvZ@a4cXcwji Varist: W64/ABTrojan.TZNV-4935 ViRobot: Trojan.Win.Z.Stealer.1214102 VirIT: Trojan.Win32.GenusT.FMNN alibabacloud: Trojan[stealer]:Win/Inoci.A huorong: HVM:Trojan/Deceiver.gen!A |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2025-Mar-08 23:05:20 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x6a00 |
| SizeOfInitializedData | 0x2d200 |
| SizeOfUninitializedData | 0x800 |
| AddressOfEntryPoint | 0x0000358D (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x8000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 6.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x56000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.ndata
.rsrc
Imports
| ADVAPI32.dll |
RegEnumValueW
RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW |
|---|---|
| SHELL32.dll |
SHGetPathFromIDListW
SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW |
| ole32.dll |
CoCreateInstance
OleUninitialize OleInitialize IIDFromString CoTaskMemFree |
| COMCTL32.dll |
ImageList_Destroy
#17 ImageList_AddMasked ImageList_Create |
| USER32.dll |
MessageBoxIndirectW
GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics |
| GDI32.dll |
GetDeviceCaps
SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor |
| KERNEL32.dll |
lstrcmpiA
CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW |
Delayed Imports
1
105
106
111
103
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xd24e50e9 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2003 (.NET) build 4035) | 2 |
| Total imports | 163 |
| Imports (VS2003 (.NET) build 4035) | 15 |
| 48 (9044) | 10 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
Errors
[*] Warning: Section .ndata has a size of 0!