| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Suspicious | PEiD Signature: | PolyEnE 0.01+ by Lennart Hedlund |
| Suspicious | The PE is packed with Aspack or Armadillo |
Unusual section name found: .enigma1
Section .enigma1 is both writable and executable. Unusual section name found: .enigma2 Section .enigma2 is both writable and executable. Unusual section name found: .vmp0 Section .vmp0 is both writable and executable. Unusual section name found: .vmp1 Section .vmp1 is both writable and executable. Unusual section name found: .vmp2 Section .vmp2 is both writable and executable. Unusual section name found: UPX0 Section UPX0 is both writable and executable. Unusual section name found: .winlice Section .winlice is both writable and executable. Unusual section name found: .petite Section .petite is both writable and executable. Unusual section name found: .rlp Section .rlp is both writable and executable. Unusual section name found: .dsstext Section .dsstext is both writable and executable. Unusual section name found: logicoma Section logicoma is both writable and executable. Unusual section name found: adr Section adr is both writable and executable. Unusual section name found: have Section have is both writable and executable. Unusual section name found: 30cm Section 30cm is both writable and executable. Unusual section name found: PETETRIS Section PETETRIS is both writable and executable. Unusual section name found: .alien Section .alien is both writable and executable. Unusual section name found: .pwdprot Section .pwdprot is both writable and executable. Unusual section name found: .arch Section .arch is both writable and executable. Section .rdata is both writable and executable. Unusual section name found: .tw Section .tw is both writable and executable. Unusual section name found: .vlizer Section .vlizer is both writable and executable. Unusual section name found: .aspack Section .aspack is both writable and executable. Unusual section name found: .adata Section .adata is both writable and executable. Unusual section name found: __wibu00 Section __wibu00 is both writable and executable. Unusual section name found: __wibu01 Section __wibu01 is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
Possibly launches other programs:
|
| Malicious | VirusTotal score: 37/70 (Scanned on 2026-06-27 15:06:43) |
ALYac:
Gen:Variant.Adware.Tedy.7571
APEX: Malicious AVG: Win64:Evo-gen [Trj] Arcabit: Trojan.Adware.Tedy.D1D93 Avast: Win64:Evo-gen [Trj] Avira: TR/W64.Evo BitDefender: Gen:Variant.Adware.Tedy.7571 Bkav: W32.Malware.EC29174F CTX: exe.trojan.tedy CrowdStrike: win/malicious_confidence_90% (D) Cylance: Unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS Elastic: malicious (moderate confidence) Emsisoft: Gen:Variant.Adware.Tedy.7571 (B) F-Secure: Trojan.TR/W64.Evo Fortinet: Riskware/Application GData: Gen:Variant.Adware.Tedy.7571 Google: Detected Gridinsoft: Adware.Win64.Heur.sa Kaspersky: HEUR:Trojan.Multi.Obfus.a Kingsoft: Win32.Troj.Unknown.a McAfeeD: ti!FDE7A66E32ED MicroWorld-eScan: Gen:Variant.Adware.Tedy.7571 Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Rising: Trojan.Obfus!8.4D47 (CLOUD) Sangfor: Trojan.Win32.Evo.V9ox SentinelOne: Static AI - Suspicious PE Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Tencent: Win32.Trojan.Obfus.Agow TrellixENS: Artemis!1E78D879D96C VIPRE: Gen:Variant.Adware.Tedy.7571 Varist: W64/ABAdware.YTCZ-7685 Zoner: Probably Heur.ExeHeaderP alibabacloud: Trojan:Win/Wacapew.C9nj |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 28 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x2600 |
| SizeOfInitializedData | 0x6a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000030E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x21000 |
| SizeOfHeaders | 0x600 |
| Checksum | 0xe484 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| msvcrt.dll |
malloc
strcpy strcat sprintf free memset calloc gets vsprintf getenv system abort atexit _getcwd tolower toupper strlen memcpy strcspn printf __iob_func fflush fgets puts _vsnprintf __set_app_type _controlfp __argc __argv _environ __getmainargs exit |
|---|---|
| kernel32.dll |
WriteConsoleA
GetStdHandle GetModuleHandleA SuspendThread GetThreadContext ResumeThread CloseHandle GetCurrentProcess GetCurrentThread DuplicateHandle CreateThread WaitForSingleObject GetExitCodeThread IsDebuggerPresent GetProcAddress QueryPerformanceFrequency QueryPerformanceCounter Sleep GetConsoleMode SetConsoleMode SetConsoleTitleA |
| Ordinal | 1 |
|---|---|
| Address | 0xd1af |
No comments yet.