f2b90487ccf966408996bd182314719a9be80a95a6e646cf71b98055be58691e
PE
Verdict: HOSTILE
AI
Packed PE with empty code section
Local reference
Suspicious dependency
Inferred
Empty-code PE with dominant packed loader section: file:0x0
Empty-text PE with nonstandard high-entropy packing: file:0x0
Opaque empty-text PE with near-total packed code: file:0x0
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ..............Empty-text PE with nonstandard high-entropy packing |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080000000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!ThOpaque empty-text PE with near-total packed code |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
5045000064860700d282d06000000000 |
PE..d......`.... |
| 0x90 |
00000000f00023000b020e1d00c60000 |
......#......... |
| 0xa0 |
00280000000000000a9a200000100000 |
.(........ ..... |
| 0xb0 |
00000040010000000010000000020000 |
...@............ |
| 0xc0 |
06000000000000000600000000000000 |
................ |
| 0xd0 |
0090480000040000851f2d0002002081 |
..H.......-... . |
| 0xe0 |
00000400000000000000010000000000 |
................ |
| 0xf0 |
00001000000000000010000000000000 |
................ |
| 0x100 |
00000000100000000000000000000000 |
................ |
| 0x110 |
c0911d008c0000000000000000000000 |
................ |
| 0x120 |
b05a4800e43000000000000000000000 |
.ZH..0.......... |
| 0x130 |
0000000000 |
..... |
Objectives
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ.............. |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080000000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
5045000064860700d282d06000000000 |
PE..d......`.... |
| 0x90 |
00000000f00023000b020e1d00c60000 |
......#......... |
| 0xa0 |
00280000000000000a9a200000100000 |
.(........ ..... |
| 0xb0 |
00000040010000000010000000020000 |
...@............ |
| 0xc0 |
06000000000000000600000000000000 |
................ |
| 0xd0 |
0090480000040000851f2d0002002081 |
..H.......-... . |
| 0xe0 |
00000400000000000000010000000000 |
................ |
| 0xf0 |
00001000000000000010000000000000 |
................ |
| 0x100 |
00000000100000000000000000000000 |
................ |
| 0x110 |
c0911d008c0000000000000000000000 |
................ |
| 0x120 |
b05a4800e43000000000000000000000 |
.ZH..0.......... |
| 0x130 |
0000000000 |
..... |
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ.............. |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080000000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
5045000064860700d282d06000000000 |
PE..d......`.... |
| 0x90 |
00000000f00023000b020e1d00c60000 |
......#......... |
| 0xa0 |
00280000000000000a9a200000100000 |
.(........ ..... |
| 0xb0 |
00000040010000000010000000020000 |
...@............ |
| 0xc0 |
06000000000000000600000000000000 |
................ |
| 0xd0 |
0090480000040000851f2d0002002081 |
..H.......-... . |
| 0xe0 |
00000400000000000000010000000000 |
................ |
| 0xf0 |
00001000000000000010000000000000 |
................ |
| 0x100 |
00000000100000000000000000000000 |
................ |
| 0x110 |
c0911d008c0000000000000000000000 |
................ |
| 0x120 |
b05a4800e43000000000000000000000 |
.ZH..0.......... |
| 0x130 |
0000000000 |
..... |
Metadata
notable severity, 95% confident.
binary
PE has no signature record
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 d2 82 d0 60 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 1d 00 c6 00 00 00 28 00 00 00 00 00 00 0a 9a 20 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 85 1f 2d 00 02 00 20 81 00 00 04 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 91 1d 00 8c 00 00 00 00 00 00 00 00 00 00 00 b0 5a 48 00 e4 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......`..........#..........(........ [email protected]... ..................................................................ZH..0...............
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ.............. |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
00000000000000000000000080000000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
5045000064860700d282d06000000000 |
PE..d......`.... |
| 0x90 |
00000000f00023000b020e1d00c60000 |
......#......... |
| 0xa0 |
00280000000000000a9a200000100000 |
.(........ ..... |
| 0xb0 |
00000040010000000010000000020000 |
...@............ |
| 0xc0 |
06000000000000000600000000000000 |
................ |
| 0xd0 |
0090480000040000851f2d0002002081 |
..H.......-... . |
| 0xe0 |
00000400000000000000010000000000 |
................ |
| 0xf0 |
00001000000000000010000000000000 |
................ |
| 0x100 |
00000000100000000000000000000000 |
................ |
| 0x110 |
c0911d008c0000000000000000000000 |
................ |
| 0x120 |
b05a4800e43000000000000000000000 |
.ZH..0.......... |
| 0x130 |
0000000000 |
..... |
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 d2 82 d0 60 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 1d 00 c6 00 00 00 28 00 00 00 00 00 00 0a 9a 20 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 85 1f 2d 00 02 00 20 81 00 00 04 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 91 1d 00 8c 00 00 00 00 00 00 00 00 00 00 00 b0 5a 48 00 e4 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......`..........#..........(........ [email protected]... ..................................................................ZH..0...............
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 d2 82 d0 60 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 1d 00 c6 00 00 00 28 00 00 00 00 00 00 0a 9a 20 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 85 1f 2d 00 02 00 20 81 00 00 04 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 91 1d 00 8c 00 00 00 00 00 00 00 00 00 00 00 b0 5a 48 00 e4 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......`..........#..........(........ [email protected]... ..................................................................ZH..0...............
Identity
| SHA-256 |
f2b90487ccf966408996bd182314719a9be80a95a6e646cf71b98055be58691e |
| Filename |
file |
| Package |
f2b90487ccf966408996bd182314719a9be80a95a6e646cf71b98055be58691e |
Origin
| Source |
harvest |
| Feed |
malwarebazaar |
| Ecosystem |
windows |
| Domain |
abuse.ch |
Timeline
| First seen |
23 Jul 2026 22:54 UTC |
| First analyzed |
23 Jul 2026 23:33 UTC |
| Last analyzed |
23 Jul 2026 23:33 UTC |
| Last updated |
23 Jul 2026 23:33 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
4c34e |