004f724e6eff8e29953c05a00cd294fceda3c6b346148c7befdbe210f35fa72a

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Oct-27 05:15:44
Debug artifacts D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
CompanyName DllInjector
FileDescription DllInjector
FileVersion 1.0.0.0
InternalName DllInjector.dll
LegalCopyright
OriginalFilename DllInjector.dll
ProductName DllInjector
ProductVersion 1.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • go.microsoft.com
  • https://aka.ms
  • https://go.microsoft.com
  • https://go.microsoft.com/fwlink/?linkid
  • microsoft.com
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryA
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegOpenKeyExW
  • RegGetValueW
  • RegCloseKey
 Possibly launches other programs:
  • ShellExecuteW
Safe VirusTotal score: 0/71 (Scanned on 2026-11-01 02:36:46) All the AVs think this file is safe.

Hashes

MD5 309d53732809f19948214997ee059704 🔍
SHA1 91ff174f090d34562038fe4749f0e3d84ba19a31 🔍
SHA256 004f724e6eff8e29953c05a00cd294fceda3c6b346148c7befdbe210f35fa72a 🔍
SHA3 eb270eda8e87d25d7e4760c88baaf82d05174983a998d7d460f38d38a8ebe225 🔍
SSDeep 1536:19YXnq9YamgiYSoGR6+k84vKqIzjiCBs86Q6LRwqzm4X8fY01NT/Z2bo+W26mhI:EqvmgiYSo4k8uIPzlSRwa/WB26mhIgb 🔍
Imports Hash bb3ac2c21e02c68abcad237dc3fa6d00 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Oct-27 05:15:44
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x16400
SizeOfInitializedData 0xf800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000011AB0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x180000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3ed5512b293aa5ccb14a2730a5a29785 🔍
SHA1 df85598271374ab44b618dd3406484df92cd74ce 🔍
SHA256 b55ea7f36007bb04f989c752a29e245bead9bdfc3913702e9f05cc1b26272d3e 🔍
SHA3 eac0d6142726512bc274619ea3ba58da9a701cbd4d73d4a2d5ed47b15533630a 🔍
VirtualSize 0x1627c
VirtualAddress 0x1000
SizeOfRawData 0x16400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.34417

.rdata

MD5 97f56458aeb5042fc110de6a7f14cf6a 🔍
SHA1 ab490304af2852e10170a79b9630ff6e6d663e11 🔍
SHA256 d33d88b28c92a6263f19e61ae3d4e00ce32d83fa52284044480b3e3a9c06c25e 🔍
SHA3 39afd2c8c38fa0f4c43be7d346d8e15b632cee9b5327339fd3bfcac42dc90c2b 🔍
VirtualSize 0xbd1e
VirtualAddress 0x18000
SizeOfRawData 0xbe00
PointerToRawData 0x16800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.83271

.data

MD5 7b6c4458fadb4c0992b647b6bbfb035f 🔍
SHA1 399086a91700ae08e078a3136cc2e9e8732638f8 🔍
SHA256 32471b54efd7285b3bb22d844af15b906e372c9eb6a08338e84de8980c7bcc79 🔍
SHA3 41397fcfde6a3efa7f307140959fb19e7607c6fd2dc3772f324faa7778dc01e8 🔍
VirtualSize 0x1838
VirtualAddress 0x24000
SizeOfRawData 0xa00
PointerToRawData 0x22600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.38343

.pdata

MD5 c20628de244b4ad26d738fc5023ef5c1 🔍
SHA1 c4b6e73956dda9cc2bfc4b9f53d3cc6e8b6181be 🔍
SHA256 26d28ab08308ebbe19dea4673b4bd8cd46120a4826971710fa82c36ef53f389e 🔍
SHA3 d76843777bf9942d2219f35c7159ac599bcae19ec5b1fe5d9dc464b35914811a 🔍
VirtualSize 0x141c
VirtualAddress 0x26000
SizeOfRawData 0x1600
PointerToRawData 0x23000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.84522

.reloc

MD5 37812f81534460a128d06d0d29b2cb00 🔍
SHA1 8dcae4bb04c6e5e5d5a68d9e1d0bdc85c923ad95 🔍
SHA256 7d1932eae9901ec74760eb2c44a2df4a20f3a8bfb1a595db5dd20e43af7c73cf 🔍
SHA3 fa934fd7324404a9d4dd0c78dee6a4cbae71cf80f9cf2820ab6a74fe3716a019 🔍
VirtualSize 0x338
VirtualAddress 0x28000
SizeOfRawData 0x400
PointerToRawData 0x24600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.80573

.rsrc

MD5 20d6c820b4483b1b4f37d711f50bb8bf 🔍
SHA1 9618c40fe6ca7b976e9419811bb42cc004d5f254 🔍
SHA256 6945c5ed6ce739e545f507a5ce5bf287c605fbd1c4059ffbb18575ae1f1b3c6b 🔍
SHA3 236d24ef2ee9a2b997bdf46c382e5303ee6faddb32bd8943fac5a977bbc4f41a 🔍
VirtualSize 0x518
VirtualAddress 0x29000
SizeOfRawData 0x600
PointerToRawData 0x24a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.73975

Imports

KERNEL32.dll FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
USER32.dll MessageBoxW
SHELL32.dll ShellExecuteW
ADVAPI32.dll RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll _invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0.dll calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0.dll wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0.dll wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0.dll wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0.dll ___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0.dll __setusermatherr

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2d4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.236
MD5 4bb00008382e8c63ae3ae6f577337472 🔍
SHA1 1bd38b9cd69e4b769d77df4c51b9bbe01cebac4d 🔍
SHA256 0029c27d6b12c378e7b9dd537c482c2f244ec0fe9a396aece4eac68e487078aa 🔍
SHA3 a4f9199df9d6c1134d798cd5675d9b1564f363ebb0e47b7829c671d31f618ad0 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1a2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.87613
MD5 5426703c31a90f04f546fbe565f1f069 🔍
SHA1 9914e87e57ab05cb77a429013fa317ac9a079f4b 🔍
SHA256 f37580ee546adced41bbad3149be28c15c89e6f0aa3eac692d1cb07191ea9573 🔍
SHA3 9e5b309e6facdf141920ac13c64247f22aba35ee263ad2b21ed470e7d514f5c7 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName DllInjector
FileDescription DllInjector
FileVersion (#2) 1.0.0.0
InternalName DllInjector.dll
LegalCopyright
OriginalFilename DllInjector.dll
ProductName DllInjector
ProductVersion (#2) 1.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Oct-27 21:40:13
Version 0.0
SizeofData 109
AddressOfRawData 0x2079c
PointerToRawData 0x1ef9c
Referenced File D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2025-Oct-27 21:40:13
Version 0.0
SizeofData 20
AddressOfRawData 0x2080c
PointerToRawData 0x1f00c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Oct-27 21:40:13
Version 0.0
SizeofData 988
AddressOfRawData 0x20820
PointerToRawData 0x1f020

TLS Callbacks

StartAddressOfRawData 0x140020c48
EndAddressOfRawData 0x140020c58
AddressOfIndex 0x140025820
AddressOfCallbacks 0x1400184f0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140024080
GuardCFCheckFunctionPointer 5368808480
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x55c57ab0
Unmarked objects 0
ASM objects (35207) 10
C objects (35207) 12
C++ objects (35207) 87
Imports (VS2008 SP1 build 30729) 16
Imports (33140) 9
Total imports 204
C++ objects (LTCG) (35215) 10
Linker (35215) 1

Errors

Leave a comment

No comments yet.