0e4356aabe6789e2d979c0d486d1cd1961fa2c05f29726c7f4949fd4b2674b3e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-May-16 01:27:37
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • adobe.com
  • http://ns.adobe.com
  • http://ns.adobe.com/photoshop/1.0/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
  • http://purl.org
  • http://www.w3.org
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • ns.adobe.com
  • www.w3.org
Suspicious The PE is possibly packed. Unusual section name found: .buildid
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
Suspicious The PE is possibly a dropper. Resources amount for 87.808% of the executable.
Safe VirusTotal score: 0/71 (Scanned on 2026-10-17 16:29:23) All the AVs think this file is safe.

Hashes

MD5 a995aa527b70fc70ec6a4693b2c900f5 🔍
SHA1 e155cc81174d7bcc13b8877afd77199d7edc85b7 🔍
SHA256 0e4356aabe6789e2d979c0d486d1cd1961fa2c05f29726c7f4949fd4b2674b3e 🔍
SHA3 e757b077c92df5cf4caa272f7c42b13b1c22c04e61af77bfd069d58d850e6d7e 🔍
SSDeep 3072:gQ4UqVwcOo6kXrhDP1LjnMJ/iUOX4QYzIX/u:NqlbrhD2aDOCm 🔍
Imports Hash 8d88ee3d02e50123906bab082925025d 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-May-16 01:27:37
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1a00
SizeOfInitializedData 0x17a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001160 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x23000
SizeOfHeaders 0x400
Checksum 0x23064
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x800000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e350e5d12b865f27b329760233d88fdc 🔍
SHA1 0a5636c2cc88eff9cd8516bcf375a5823c8a5ec2 🔍
SHA256 c5bbb5f255c2e70e1e75e98e5f03f22cffe4db8f53be123cf345856fc17e7eb5 🔍
SHA3 9b2d28a3e3a3cd27bfd31b324eff44ee6fd855feba5fe37c9d5837e76c5f7498 🔍
VirtualSize 0x1976
VirtualAddress 0x1000
SizeOfRawData 0x1a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.88586

.rdata

MD5 a2acda28d16f9ba7c49956324cbc9fb3 🔍
SHA1 09e4d71d975500abb731a9f4f714065ab77508d3 🔍
SHA256 6e15ad3714bbd7f821479206a0c92f7e35bb261f02965352411784636f85853f 🔍
SHA3 0419ac4dc84d2c6e37b2235a53fd8eb620788d5212687716b4610b2a5f790264 🔍
VirtualSize 0x10e0
VirtualAddress 0x3000
SizeOfRawData 0x1200
PointerToRawData 0x1e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.15833

.buildid

MD5 833096e875a78618682e0bef286e59e3 🔍
SHA1 fbf35c283fa8979b6f492bfaa08d57a6108f67ab 🔍
SHA256 2d9c86077db63c0f9bf99b6705d3eeac8b8c6914ca75c0a70c6325ccd7260363 🔍
SHA3 f9676108ec992efdbc3efd971cbd8e796d213b2e0da6c0bd9b430e25bcb27945 🔍
VirtualSize 0x35
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.604661

.data

MD5 a55b2b5b5992ee63766a195ad0506662 🔍
SHA1 bd06875afb641b095f71d71abba1c1a729a897ed 🔍
SHA256 8d92b355f9b7066015a80bb6ef849a380911026a1b98b8e070e3eaca0b049b1e 🔍
SHA3 9c1e93f6640bc2d0c3a2963e73c66ade186fd29d4527a6d43d0198c7d87b4ea4 🔍
VirtualSize 0x120
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x3200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.644065

.pdata

MD5 f6366b4e43edde63802c654974735b2a 🔍
SHA1 bc0e7f1b3ae59748ebf7cff39be19f426e08a9c0 🔍
SHA256 5f891542771b1b0413f66178c558ab67c52f0a22ab54d5c8591e2e70f2b7cd63 🔍
SHA3 83266372045ce97e826b31c98958926de0d42d571b0ae4cdfc972550336f3653 🔍
VirtualSize 0x138
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.52704

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 4cbe2b14940e0c0fe228d9dd5fe81c74 🔍
SHA1 3f5301e198b6ed746d430467d00031c6e9441348 🔍
SHA256 91fa19e94b4838da7568b4385aeec59f4a6950fc7514431db02aae1b6fbd32cf 🔍
SHA3 44affff553145aecd3daca4dcab6d1c7cc8fbc429de4c26ecda977170970b2b4 🔍
VirtualSize 0x19bda
VirtualAddress 0x9000
SizeOfRawData 0x19c00
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.98997

Imports

api-ms-win-crt-private-l1-1-0.dll __C_specific_handler
memcpy
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vswprintf
fwrite
api-ms-win-crt-runtime-l1-1-0.dll __p___argc
__p___wargv
_cexit
_configure_wide_argv
_crt_atexit
_exit
_initialize_wide_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
calloc
free
malloc
api-ms-win-crt-string-l1-1-0.dll _wcsdup
memset
strlen
strncmp
wcslen
USER32.dll MessageBoxW
KERNEL32.dll DeleteCriticalSection
EnterCriticalSection
GetLastError
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
SetDllDirectoryW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-environment-l1-1-0.dll __p__wenviron

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x19821
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99235
Detected Filetype PNG graphic file
MD5 817c785c85bac332c4fffd1c6fb4eed1 🔍
SHA1 c93296dca1c2af982f345695e2d3dc317fffd80c 🔍
SHA256 92b5aeacdc7395efe90820c6d016ff547872b68ab2f3f4051a7be5d197706473 🔍
SHA3 3b56263e699967765e2980865faca70dc2d2a869a897efed50f63c4b31814010 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.59047
Detected Filetype Icon file
MD5 76dd313503ee9ac6a12fde20dae711a5 🔍
SHA1 eddc4415c60699d8fec7bb6ecbf3242b3cbf970f 🔍
SHA256 c25685f174506cde08a8faea2a878fe4db41401c2ca6900afb8194afaf3d4625 🔍
SHA3 2a4adb3315485dee21f67b6ca6ae6055fff8b74e0de64fa36beeae941cf58abf 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x2bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.82693
MD5 67d470b193d92eaedadc0bb58838f5f1 🔍
SHA1 f3d3d4f28c3635167a46e075d490c33bdbb01496 🔍
SHA256 7a7ce637fc4e50b945d45254545c848c8350184f51ee13abca9188621c9bad25 🔍
SHA3 87048578496162e372472f4afe5412b15ce526e1ab77d805f4e73f0a59a0c7f1 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-May-16 01:27:37
Version 0.0
SizeofData 25
AddressOfRawData 0x501c
PointerToRawData 0x301c

TLS Callbacks

StartAddressOfRawData 0x140008000
EndAddressOfRawData 0x140008008
AddressOfIndex 0x140006078
AddressOfCallbacks 0x1400036b8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x0000000140001580
0x0000000140001600

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0

RICH Header

Errors

[!] Error: Could not read an IMAGE_BASE_RELOCATION!
Leave a comment

No comments yet.