f734dcd6647ad2b136d40229906719ea

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2024-May-04 04:55:38

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 9087920 bytes of data starting at offset 0x60600.
The overlay data has an entropy of 7.9981 and is possibly compressed or encrypted.
Overlay data amounts for 95.8371% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 f734dcd6647ad2b136d40229906719ea
SHA1 7b725d14b26341ee00e2f1f979d25adb5677cfb4
SHA256 21329eb5c6190665c3e5495b57b934aaa7cf1683df15f7f50554346a7c6617cc
SHA3 bd3dcba1f65cff87c1accbb68f9b40b9e6a5c866d9f6ed88f54c0ce51d478618
SSDeep 196608:AsMY3X6voDwGcsAgeHtcGfcY3gtAHH1PJNVKqv7:WYH/k3meNcGfd73uqv7
Imports Hash 023abd09c65289e3a2df4aa2b19cccec

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2024-May-04 04:55:38
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2b200
SizeOfInitializedData 0x35000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000B9E0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x68000
SizeOfHeaders 0x400
Checksum 0x90cb8f
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 1ffe948fda8287176b84b7a3b237172e
SHA1 5030762a2c7b9e8244cb98e3a841dad9af12bddb
SHA256 c9356a59a442d1125bc43ea2c0b5018bf95a8560944335d1946d8e55c9830f8c
SHA3 588854b2c08962bf40670795ae513489f1e4727a01ae72f5b4316060385f8874
VirtualSize 0x2b150
VirtualAddress 0x1000
SizeOfRawData 0x2b200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50453

.rdata

MD5 34e8bc522e57d998d89ef3cdb7427dfe
SHA1 7b4e26b8aef404f174b3e5ba95d8e6bbc8016b16
SHA256 03a9effb6a2cc9bc31e5662d82be59f12eddd1fa49b2f3da1895c5c7a2376eab
SHA3 0af03c419a97def588009032e312f7bb9be1eab76ef1aab545e606918a156b23
VirtualSize 0x12c26
VirtualAddress 0x2d000
SizeOfRawData 0x12e00
PointerToRawData 0x2b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.83885

.data

MD5 0714d4ddb9a1211592095e1351376cf2
SHA1 5aa4b317e22e3d51d25a43c83314955564eb4a3e
SHA256 05159bcd4959a8d464c90edcf47cb9893c644abfd268ccc74ed683b87e417df7
SHA3 21730c939468b019126f8795696d40321f121c606a77b0456ebe7f6c5e826194
VirtualSize 0x33b8
VirtualAddress 0x40000
SizeOfRawData 0xe00
PointerToRawData 0x3e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.81756

.pdata

MD5 83c41aa29e95d587861d91bdbdbcb3d6
SHA1 ef8176853647112b5daddfe42ae3c299647ef41a
SHA256 b530339cbc39fe02df2b9e3d652635de67b41f98659224b6cceb5d58bcfcf45d
SHA3 70ee947c4ba5cda9c4f8ef8ca704ceadd60a4613515fcdc7616f298a139f1771
VirtualSize 0x2364
VirtualAddress 0x44000
SizeOfRawData 0x2400
PointerToRawData 0x3f200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.40871

_RDATA

MD5 7c7efebb897cc4ea38b70ce8f0efef3f
SHA1 4440dcc4642667be6a67c5c84f8b4680eacfb597
SHA256 0f8534366cc1cde92c324721ee5adf116e08ddb4c9840cef4cd59db305c8edeb
SHA3 08bcb025d4543f006248cb47673d9403632b340e31e38a5a4bf9e4a8793c328e
VirtualSize 0x1f4
VirtualAddress 0x47000
SizeOfRawData 0x200
PointerToRawData 0x41600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.66755

.rsrc

MD5 c23703f1c44ad08fa834b188c1967744
SHA1 696da3b011b842bb952978df408ee0a1d045b49a
SHA256 18c15e9035e873a4d71f9fe74f2141e613e4b3f06ece0d819febb6c0bd137652
SHA3 fdcc0f2bff7d2e46a83e6bf8f37ec79a70487f135e3b3024a60c83c3aa8379a8
VirtualSize 0x1e498
VirtualAddress 0x48000
SizeOfRawData 0x1e600
PointerToRawData 0x41800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.89387

.reloc

MD5 6492d58c46d0b94c9dcff3d29f4e25f2
SHA1 6e5b545c20fad2811376b7e15a105eb231094d98
SHA256 c181a38a664cb756ff3c0f23137cd119e10787f66ef4022e22f3d373fe8e9333
SHA3 11c2c516295df4280ee261799d0c0ddc606b7cece043a01cd1c29f4d13c55190
VirtualSize 0x75c
VirtualAddress 0x67000
SizeOfRawData 0x800
PointerToRawData 0x5fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.25078

Imports

USER32.dll GetWindowThreadProcessId
ShowWindow
KERNEL32.dll CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
SetDllDirectoryW
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
GetCurrentProcess
GetCurrentProcessId
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
HeapSize
GetLastError
WriteConsoleW
SetEndOfFile
GetExitCodeProcess
TlsGetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.01165
MD5 c9a91b794d70f463be32aa62638611bb
SHA1 46688dfcfbfc98dbd6afd052de272b8671b8634a
SHA256 f27e68c86193865e98e161dee0f3ab513eccc0d3a3ed434e501cc5ba4369a1d6
SHA3 4d51f711187cd97a5db4661e25432be1dbe0722e6a515dd862c3cd4b42469d6b

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.106
MD5 bf61eb6c2f1c0305d84bea19fdcfccc9
SHA1 881bf82dd624a0d12a75ff3456ba4182b94547a1
SHA256 2dc96310b766ef2b16f88fe0febee3ea87e568739bdf580133353b6e283f1c0e
SHA3 d91f5c2a1bf361179753e40b0fe863098ffb73f974671dcbdabf3bf356735f87

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.12454
MD5 21d02c98f713b0b5084581171209f065
SHA1 75621885f4defc34d551ce1691aa73f292c1dc9f
SHA256 a74f7842bf5cc53a656178e526fcd42218e3c26823f39674ced63af010e02d6d
SHA3 003bafc93aa989be9f999946ae1572ff8ac21938388fa2002743d464531419d6

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.08964
MD5 911425fe1beb05e1c6b4fcd5368c7f76
SHA1 c84fbbdd7e40246960c5ea24cfeb6bbb52f2c77e
SHA256 ee840666a75019ff31b4fa214ada53849a9104c6adf2bc9f71dd5497e455ed99
SHA3 bafd5607f0096a7ac98e977f50bc91fa3d5cfc3740d56ff3b18557ecb3b6e480

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x19954
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98904
Detected Filetype PNG graphic file
MD5 8da259b84f878ece624e8a227cd73827
SHA1 a39201a216a02e76c7b6b42aca2441d9efa43941
SHA256 d6320cdb98efd08a77cb880e7d7042c8f6c21c99be00d0f53e7888406ce8d36c
SHA3 d5881c31d1b83f76497d8d800c42d98bb5d7e589901d5aae0a30980b59906c3b

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67841
Detected Filetype Icon file
MD5 a026561d1054c56ce7567ad58188d4f7
SHA1 ffe47f94fcc585daefa9eeb10ce7b6895d51582f
SHA256 699709190827b746468907c9a5e2c4e66485db553f4c819161f350be61ac88c1
SHA3 2c0894d305c59d06b14b27f418d9d1acdc4c615d667f8bdda87be23bfbc2b234

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-May-04 04:55:38
Version 0.0
SizeofData 812
AddressOfRawData 0x3ca0c
PointerToRawData 0x3b00c

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140040040
GuardCFCheckFunctionPointer 5368894336
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xbfc33c47
Unmarked objects 0
ASM objects (30795) 8
C++ objects (30795) 187
C objects (30795) 10
Unmarked objects (#2) 1
253 (VS 2015-2022 runtime 33030) 4
C++ objects (VS 2015-2022 runtime 33030) 40
C objects (VS 2015-2022 runtime 33030) 17
ASM objects (VS 2015-2022 runtime 33030) 17
Imports (30795) 7
Total imports 121
C objects (33135) 21
Linker (33135) 1

Errors

<-- -->