Architecture |
IMAGE_FILE_MACHINE_AMD64
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
Compilation Date | 2024-May-05 06:22:42 |
TLS Callbacks | 1 callback(s) detected. |
Debug artifacts |
1pplus43.pdb
|
Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xf8 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections | 5 |
TimeDateStamp | 2024-May-05 06:22:42 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xf0 |
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic | PE32+ |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0x19400 |
SizeOfInitializedData | 0xac00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0000000000018460 (Section: .text) |
BaseOfCode | 0x1000 |
ImageBase | 0x140000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.0 |
ImageVersion | 0.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x29000 |
SizeOfHeaders | 0x400 |
Checksum | 0 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
WakeByAddressAll WakeByAddressSingle |
---|---|
KERNEL32.dll |
SetUnhandledExceptionFilter
UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead CloseHandle GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee WaitForSingleObject QueryPerformanceCounter RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCurrentProcess GetStdHandle GetCurrentProcessId HeapFree HeapReAlloc lstrlenW ReleaseMutex GetProcessHeap HeapAlloc GetConsoleMode GetModuleHandleW FormatMessageW MultiByteToWideChar WriteConsoleW GetCurrentThread IsProcessorFeaturePresent GetModuleHandleA GetProcAddress WaitForSingleObjectEx LoadLibraryA CreateMutexA GetSystemTimeAsFileTime GetCurrentThreadId |
ntdll.dll |
RtlNtStatusToDosError
NtWriteFile |
VCRUNTIME140.dll |
__current_exception
__current_exception_context __C_specific_handler _CxxThrowException memcmp memmove memset memcpy __CxxFrameHandler3 |
api-ms-win-crt-runtime-l1-1-0.dll |
_initterm_e
exit _exit _initterm _get_initial_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv __p___argc _initialize_onexit_table _initialize_narrow_environment _register_onexit_function _crt_atexit terminate _set_app_type _seh_filter_exe |
api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__p__commode |
api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode |
Characteristics |
0
|
---|---|
TimeDateStamp | 2024-May-05 06:22:42 |
Version | 0.0 |
SizeofData | 37 |
AddressOfRawData | 0x206f4 |
PointerToRawData | 0x1eef4 |
Referenced File | 1pplus43.pdb |
Characteristics |
0
|
---|---|
TimeDateStamp | 2024-May-05 06:22:42 |
Version | 0.0 |
SizeofData | 20 |
AddressOfRawData | 0x2071c |
PointerToRawData | 0x1ef1c |
Characteristics |
0
|
---|---|
TimeDateStamp | 2024-May-05 06:22:42 |
Version | 0.0 |
SizeofData | 816 |
AddressOfRawData | 0x20730 |
PointerToRawData | 0x1ef30 |
StartAddressOfRawData | 0x140020a80 |
---|---|
EndAddressOfRawData | 0x140020ae0 |
AddressOfIndex | 0x140025268 |
AddressOfCallbacks | 0x14001b328 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
Callbacks |
0x000000014000A870
|
Size | 0x140 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x1400250c0 |
XOR Key | 0xf96db8eb |
---|---|
Unmarked objects | 0 |
Imports (VS2008 SP1 build 30729) | 12 |
Imports (33218) | 2 |
C++ objects (33218) | 23 |
C objects (33218) | 9 |
ASM objects (33218) | 3 |
Imports (29395) | 8 |
Total imports | 174 |
Unmarked objects (#2) | 14 |
Linker (33523) | 1 |