0558adcb80aea88d2bec051467c54763

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2023-Sep-16 23:45:17

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 5749108 bytes of data starting at offset 0x4e200.
The overlay data has an entropy of 7.99727 and is possibly compressed or encrypted.
Overlay data amounts for 94.7274% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 0558adcb80aea88d2bec051467c54763
SHA1 06b8bcd8430e0f5723b5978a3b65f7c2413b2e8c
SHA256 227e163ff6d644eb3d1876419b24ba18bc62ba570bc4c260f0714c8cf9767a33
SHA3 7f9e17ac88e6a046e66553b3230bbd73a9f5a92d81b939c3a39897f958302e8a
SSDeep 98304:Dm8s0DLb+sX1ZvbeAyJZmdJolTlPNs2PKToa1FptF07TUFpMndH2EHrqR7zL:DmL0DLCsXDjDyfmdJolpPgToa10/UFO
Imports Hash ba5546933531fafa869b1f86a4e2a959

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2023-Sep-16 23:45:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x28a00
SizeOfInitializedData 0x25400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000A6A0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x63000
SizeOfHeaders 0x400
Checksum 0x5d8cd3
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7c71956ea75242f33df45f4d2c19a4d8
SHA1 0096271c79c3d968f613d77cadf00b501654732d
SHA256 947fbbc6d688de5513fc10e2118d19903604523d6ad509c82b03a31d076c2746
SHA3 7363fad7d91dcb677ced43f8d56bdf0d23c7468eedbc1b013287083741fb1e1d
VirtualSize 0x28890
VirtualAddress 0x1000
SizeOfRawData 0x28a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48998

.rdata

MD5 57a144f193494f9169022c83ea28f6a3
SHA1 4cd2572908631f88eddf935823671a7a15d13ee9
SHA256 5684c11901519d74267f1e9e59b6b1eb6ccab74d6970d9949f503d04140707ba
SHA3 963804228eb35b33c803e7c38ca6253c8ded68256075069a9571894364f000c1
VirtualSize 0x1271a
VirtualAddress 0x2a000
SizeOfRawData 0x12800
PointerToRawData 0x28e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.8462

.data

MD5 9bd2cebaa3285e8e266c4c373a15119d
SHA1 f2aa811253ab892e71f1b7504c587bf82745a97d
SHA256 13878d07209c0151066a7989eb52c9c525fdcd6026c746507293fbe575373207
SHA3 141f4caa29f203d52f830668bd6836286ce851198180260d3016eb590957b11a
VirtualSize 0x103f8
VirtualAddress 0x3d000
SizeOfRawData 0xe00
PointerToRawData 0x3b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.80892

.pdata

MD5 f2a57235499cb8c84daf2de6f18a85eb
SHA1 766a44657256d34a9f078520111dc930b12eab3d
SHA256 651efb28c80a3b260994198fce5c04ca53fbb29bea349e254ad550ea36238bbb
SHA3 3deeebfea7939ce277b733c8cf3eff362d4a8bd5e7e166ada2d1764bd2897ff6
VirtualSize 0x20e8
VirtualAddress 0x4e000
SizeOfRawData 0x2200
PointerToRawData 0x3c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.33097

_RDATA

MD5 32c20bb907888de565d4d8836d097016
SHA1 3fc974a4d946f337bd627c48ae2f1a7f995fb5e1
SHA256 a21b11e53bbb839225a21b1e4183f09ffccf7b65f0dcfd4b04a0ab70cf9b1974
SHA3 bbfe09bd9a0918a882cc13db6431cf11a4cafde9c439bd522596ca2c100af2d0
VirtualSize 0x15c
VirtualAddress 0x51000
SizeOfRawData 0x200
PointerToRawData 0x3e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.79535

.rsrc

MD5 d9d6db785a18ff1b25aff9d3c6e02e7a
SHA1 86261830a4197ee8b83559d76e028a6ddefaaa50
SHA256 105a3a0f1a9d9bf278f409381bd8a879ac4822e48297f0e2011432e8cc78644b
SHA3 faed339ec5ccc62bac241ca092638fe0eff0eaef5338ebaa4d352f7f0af2966e
VirtualSize 0xf008
VirtualAddress 0x52000
SizeOfRawData 0xf200
PointerToRawData 0x3e800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.35625

.reloc

MD5 b7279c82d58eeae8dc663879402c6f2e
SHA1 63cd7f76452e70da0d19e5f98896f2b8ef442b80
SHA256 0d93f2fc3a2729853909fac2608390da10dac5c4a605c07ec64e7bd7d75565c2
SHA3 20e086f79d1010671e68069f379da65f4b44eab2742d57855ed2a14e9633026e
VirtualSize 0x75c
VirtualAddress 0x62000
SizeOfRawData 0x800
PointerToRawData 0x4da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.23889

Imports

KERNEL32.dll GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x58c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28325
MD5 ba243b0715559125da9dfa3afe48ba6e
SHA1 a498b3a383420ccdf20eb9adb2cf2077d2a8f2be
SHA256 c6786bfe91b746bb69a54e7534dcc26aa730e6790de8fe2f9df27b0cee55645b
SHA3 fa8196a9e5628435749dc2d009100ca90a6d2f22bd260c0ffcafeaa2e32a68e2

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2023-Sep-16 23:45:17
Version 0.0
SizeofData 772
AddressOfRawData 0x39884
PointerToRawData 0x38684

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003d018
GuardCFCheckFunctionPointer 5368882000
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xd7d0c88f
Unmarked objects 0
ASM objects (30795) 7
C++ objects (30795) 190
C objects (30795) 10
253 (VS 2015-2022 runtime 31823) 3
C++ objects (VS 2015-2022 runtime 31823) 40
C objects (VS 2015-2022 runtime 31823) 17
ASM objects (VS 2015-2022 runtime 31823) 9
Imports (30795) 5
Total imports 117
C objects (31943) 20
Linker (31943) 1

Errors

<-- -->