05af8cf841ec6dbfe1580f2feb2adeb9a1ef838c5a8958fd4e63a8f2afdad7c6

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-17 06:03:50
Detected languages English - United States
Debug artifacts waled.pdb
LegalCopyright Copyright (C) 2016-2019 Credi Digital
FileVersion 9.7.6.11780
FileDescription Waled Agent
OriginalFilename waled.exe
ProductName Waled
ProductVersion 9.7.6.11780
InternalName waled.exe
CompanyName Credi Digital

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • 0pwHX.DPH5.uk
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
 Uses Windows's Native API:
  • NtReadFile
  • NtWriteFile
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 0613a321b86c4c7508289ad147b0987e 🔍
SHA1 d0ecdb292c6e9bd707eef45a118d2e06798f3664 🔍
SHA256 05af8cf841ec6dbfe1580f2feb2adeb9a1ef838c5a8958fd4e63a8f2afdad7c6 🔍
SHA3 c242628f969d70c411d81610e0e3d33d902112396289475b9ca8e297cffbcbe8 🔍
SSDeep 12288:bLupNyySFLVrKkbgRr3g4gnFQ4u7MkIpzsTllGOgS0k6vrdRFzH4O8stJO/5BJk:OTKFLoWN6THGRSsrdjzH4OTA/5UnS+ 🔍
Imports Hash d3d483be25a602fe8e0852af0f5648fb 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Sep-17 06:03:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x25800
SizeOfInitializedData 0xe1800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000017500 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x10d000
SizeOfHeaders 0x400
Checksum 0x1079d6
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 fcd402088a08d981433f8e92828c939c 🔍
SHA1 9bb278248eb33923da1fe6dc8afbaaf149e111af 🔍
SHA256 012e6dcaf7559f7b18c2a35ecf1eae35ca182779802f1e00562b7e4c5d1359b3 🔍
SHA3 d9a22ae0b344b7071c3076a3b7cddf427d801e906bfe10a4dbf478156565e06d 🔍
VirtualSize 0x25751
VirtualAddress 0x1000
SizeOfRawData 0x25800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48848

.rdata

MD5 714adaff3541d624c9200703576cfc65 🔍
SHA1 016b7d8392e3443cb63371caa2019abc5b93517b 🔍
SHA256 70fba5923675a6ea4fd98d14586d13126bf90cb4ee8a57032c246ef1c36db181 🔍
SHA3 1ae910e32a020a3adcb831f93dcda659fdce22da367a9b5ada4d65226410a949 🔍
VirtualSize 0x98c0c
VirtualAddress 0x27000
SizeOfRawData 0x98e00
PointerToRawData 0x25c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.04939

.data

MD5 0a71f4716de65a4f049bd3b0d8c97638 🔍
SHA1 d2e7ce33615fa00367aefe8a53bcf573e1011a74 🔍
SHA256 7ef7d4480569e8e3568e66aaf82a1054bc88b706de35aa010b646d9b6900028b 🔍
SHA3 61672f52e70e20a7794746d3e325c01d4fdd5328442ae1a616d88ec864d2088c 🔍
VirtualSize 0x2df0
VirtualAddress 0xc0000
SizeOfRawData 0x2200
PointerToRawData 0xbea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.80694

.pdata

MD5 b384e3ae1f78b77cc3011a430f000f25 🔍
SHA1 3d79ae1829912a0bee8f076f8acb1dbf992cf046 🔍
SHA256 5f3f035f82f3db0db84dfb255e77641df6b8d25f621771184aecf72a2105d200 🔍
SHA3 64153d3e7d6f0ffefd9b21e177e605f2b266b8dd7eb0f7e62b1867d7a536762e 🔍
VirtualSize 0x13bc
VirtualAddress 0xc3000
SizeOfRawData 0x1400
PointerToRawData 0xc0c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.44055

.tls

MD5 94c95f08da43f4a87727e9c7425c881a 🔍
SHA1 075b028ae75d5e221e62c1d2a942496a970e2575 🔍
SHA256 3d1e35b874b33ea8e1691d6c63a40fc844d649f676905357fc2b08e16b0e80b9 🔍
SHA3 c483cbb4c91ba45aa3bb384cc9f40b52d5c5b78d9bf8b01155f84436dcb2ec03 🔍
VirtualSize 0xe1
VirtualAddress 0xc5000
SizeOfRawData 0x200
PointerToRawData 0xc2000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.65974

_RDATA

MD5 59d873b73080043767c4c7657e3e2d74 🔍
SHA1 5d4e7bccea323d1e9927378bbe398e6a37119401 🔍
SHA256 fb0ddcf3a304f9a30e3646d2c4d98fb19a9737967f9444984d269049774d8778 🔍
SHA3 b7c56bcc9037ec23e9e2784b9d3df443f993f24d83233d0d7a9b34ca11640694 🔍
VirtualSize 0x444
VirtualAddress 0xc6000
SizeOfRawData 0x600
PointerToRawData 0xc2200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.93657

.rsrc

MD5 410a2aca8b3e0cda235e7cf52c4ae59d 🔍
SHA1 a3916738bd91c32c3194282eec0eb648dea6de8a 🔍
SHA256 1ec11eef548b5d7e15df697e164243539f553e0be9935126fc33a13d9d57b76e 🔍
SHA3 daac6a5cb00f2744b543bedfb7f48285ac7d3a14094d192ba4e8a06fbd8013eb 🔍
VirtualSize 0x443e0
VirtualAddress 0xc7000
SizeOfRawData 0x44400
PointerToRawData 0xc2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.61579

.reloc

MD5 30bcf5c2172f75a282dc4227fab8e012 🔍
SHA1 75be246306fbcc1618f7e4bca2922c26eb7e9331 🔍
SHA256 1be6274fe2acb4bb32b50c114c6ee180ed72b0bcebd35c9f43697c31a926fc7d 🔍
SHA3 00ab3252cb6456e15809f0c37bbfbdc69f05e4ebc5955acea7cf7e37cf1fc11c 🔍
VirtualSize 0x734
VirtualAddress 0x10c000
SizeOfRawData 0x800
PointerToRawData 0x106c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.21024

Imports

kernel32.dll CloseHandle
CompareStringW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetLogicalDrives
GetMaximumProcessorCount
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetVersion
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsThreadAFiber
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
user32.dll GetCaretBlinkTime
GetSysColor
GetSystemMetrics
ntdll.dll NtReadFile
NtWriteFile
WINMM.dll midiInGetNumDevs
timeGetTime

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x457
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 5.24952
MD5 334b0db900f89d3eba4d91824e77c34a 🔍
SHA1 477a0cdd4d14d1ecbcb5818faf7c739eea1b63aa 🔍
SHA256 0b45aea34073cf8466ce884b858c2350ca45ee20df02489da7a7ac5b66370594 🔍
SHA3 0bd63c3c7178af69477ec46216558d688ea934b4561e16d6048d020172b354be 🔍

1 (#2)

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x40158
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 5.56039
Detected Filetype PNG graphic file
MD5 f960f771bfcbc0ef6450f6b9d20e083d 🔍
SHA1 18dbe07f211e00211abf6c86f8775b47bb98ce33 🔍
SHA256 c905969b278bc0baed8a0e9b9e6bb59a46835565b9ec3ad8696bbb079f2a8dca 🔍
SHA3 b6530af38f84d4946fdaae44aadcddbd9c4809a7c5a503835d70dc8e3e9f990b 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2474
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 5.717
Detected Filetype PNG graphic file
MD5 5c6f6320d27b781f06eb23f693e30398 🔍
SHA1 8b1d0dff393025f015212028ce59a6891112083b 🔍
SHA256 f1f11737781bb6c9951795204e4d07dba7f94bf28fdc4696d381fbfa04a9945f 🔍
SHA3 d2c0d9608e355b9cf10eb18e63ce74b17c07d1e7a1b56883b5d605023e8ec0fa 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1064
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 5.84465
Detected Filetype PNG graphic file
MD5 c9e36763c2e451c8672b7799373ba0cf 🔍
SHA1 712d3b7e778aa0ebfe42ff066d706c62cb099762 🔍
SHA256 962f9f6642bd0cef130969dec7d367aa4c55750c71cd8771a599b41cae11ce66 🔍
SHA3 f03efd83e7b56a8842819003058f020ebef7589cfb0c44ed602b446dddc308cc 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x454
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 5.9347
Detected Filetype PNG graphic file
MD5 02f1df6b573ddafb7cc51a1591fca942 🔍
SHA1 83498d1aac64711fe52c2923bd6cf29800cd0050 🔍
SHA256 b0bf23b3d03dce2ecfa7bcd7d227375d99ccdacd57ac495496050fa304428c7e 🔍
SHA3 9574681bcbde39bce2f1da07da0c273785ff304b52f0a09da9cdaf07568ddfc6 🔍

1 (#3)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 2.46418
Detected Filetype Icon file
MD5 dfa900010343b02eb96e5b32707d3786 🔍
SHA1 a6f8a7624ca9685bd0cf747b55c93453d3395ce2 🔍
SHA256 fefea84cf6710ac491667865afedacc8a490970b764ef96a9947f9ae360202a4 🔍
SHA3 f520ba117c339cdf02a3cd6576ea74040113290aed37d4d462db0a885c92c2d2 🔍

1 (#4)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2d8
TimeDateStamp 2026-Sep-17 06:03:50
Entropy 3.45238
MD5 ce1b792cbc7c1525e3772adf3e53bcb4 🔍
SHA1 888ae39e7b504f576707d0cf2914f9853d682ad7 🔍
SHA256 2b1ec57560aa1382ecbbe1a3477d54f774d83a09daa483e7f646a330122f445d 🔍
SHA3 35083f2411fff6ccccd8394a9141dae550b097fef8a521f8040e48121321d72d 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 9.7.6.11780
ProductVersion 9.7.6.11780
FileFlags (EMPTY)
FileOs (EMPTY)
FileType VFT_UNKNOWN
Language English - United States
LegalCopyright Copyright (C) 2016-2019 Credi Digital
FileVersion (#2) 9.7.6.11780
FileDescription Waled Agent
OriginalFilename waled.exe
ProductName Waled
ProductVersion (#2) 9.7.6.11780
InternalName waled.exe
CompanyName Credi Digital
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Sep-17 06:03:50
Version 0.0
SizeofData 34
AddressOfRawData 0xbd80c
PointerToRawData 0xbc40c
Referenced File waled.pdb

TLS Callbacks

StartAddressOfRawData 0x1400c5000
EndAddressOfRawData 0x1400c50e0
AddressOfIndex 0x1400c2308
AddressOfCallbacks 0x1400bd8c8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 2026-Sep-17 06:03:50
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1400c1780

RICH Header

Errors

Leave a comment

No comments yet.