13b276dcf812e7a98b6995018f8cec83eb315bf4ef20d3cb4fb4ee35e3840cb5

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Aug-20 23:11:12

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Suspicious The PE is possibly packed. Unusual section name found: .ctfid
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 c2e76f85c118eacb5b6df1425f3b0156 🔍
SHA1 988d68bedffb0e867194919f29050f67f96d154c 🔍
SHA256 13b276dcf812e7a98b6995018f8cec83eb315bf4ef20d3cb4fb4ee35e3840cb5 🔍
SHA3 a37d690860285f3327b3ac46fd40f50f6a3606112e9cbeb9083ea71c89be12d2 🔍
SSDeep 6144:GsGE1cg5vgxY7hgzCcqbxWzph0lhSMXlBXBWfIU/9Ml:G9x0gzC30zph0lhSMXl+Jq 🔍
Imports Hash 20be1c3db1b58f6f5f930a1594a8eecf 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-20 23:11:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2e200
SizeOfInitializedData 0x3a200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000010EE0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x6e000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 69466a787a822123f43fac6fe198d7fa 🔍
SHA1 b1cca41dc69bc11931e6d52f9c77d853d8e177e9 🔍
SHA256 e46cb8c6a9421c47874ec3a795cc3903b29aff55172a0c875b810c229f8263e6 🔍
SHA3 af1d7f3cf74aeea47ab08c298ef6ebe4a46103252610183992a42488b614b011 🔍
VirtualSize 0x2e07c
VirtualAddress 0x1000
SizeOfRawData 0x2e200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50367

.rdata

MD5 4839308a5b65101d7f8e8c40db19ce85 🔍
SHA1 5bc2d483f5acb8838fcdfeb423aecd0d07b8a1ac 🔍
SHA256 12b0630c74d94ecb900e8260784fe645fe68e4922bb57e87faa430b4e56275c8 🔍
SHA3 99848b7a759de47bc70f3091061fe5812db18b0ce70a6bee3562818943312429 🔍
VirtualSize 0x34b16
VirtualAddress 0x30000
SizeOfRawData 0x34c00
PointerToRawData 0x2e600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.3332

.data

MD5 bab5f7f6303966bdef14c92d3408800f 🔍
SHA1 6b3600df0abaa3b13f6f15804506628378dfe8dc 🔍
SHA256 a6a8c7aa602f0fdf11a23a05af695972212c93c9c1b7b4c5dfee6bb40d32b164 🔍
SHA3 3f74db35db3c863f8917869bc540acc5deb0d995861491aa58a13fb2337407d7 🔍
VirtualSize 0x20f8
VirtualAddress 0x65000
SizeOfRawData 0x1200
PointerToRawData 0x63200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.7405

.pdata

MD5 4173ca01e6f2820668ea157cd8d4dd71 🔍
SHA1 5dad99f0a2859e7aa75a5a1059a3d74cecc18852 🔍
SHA256 18d4860a7adfa3dfec9a00593f44fb9e4bebd66fa5f2a4db1ab6f5c178a3605d 🔍
SHA3 2b9a61936d3dad002140bca337538e597095d8471f75f9bdd37b298bc455a666 🔍
VirtualSize 0x2754
VirtualAddress 0x68000
SizeOfRawData 0x2800
PointerToRawData 0x64400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.39602

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x6b000
SizeOfRawData 0x200
PointerToRawData 0x66c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 ead3c3f394dc204e6d0d01ef2da613ba 🔍
SHA1 a6c52638b3ded50ca93f8a7883a23402c3e2395a 🔍
SHA256 0386a71537259406efe7206a776b0bc5ddeb7c2c533f93645495ee0c011e6ee3 🔍
SHA3 bf9e15dba8309f2eb5c274ce752861e5e201c86e515d371a4fd7916cc7560b62 🔍
VirtualSize 0x8d8
VirtualAddress 0x6c000
SizeOfRawData 0xa00
PointerToRawData 0x66e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.16549

.ctfid

MD5 0cb2afbc04c82d3bd009d0659cc91129 🔍
SHA1 7f4a637f082b208284fcbfdcd302bc60dd8e994a 🔍
SHA256 e926649276c9179c8b6b48a270c1146d4372e70665940ba53e0e59afb22d0c23 🔍
SHA3 436e9acaacfe2dbb7a73f2dc146d6a9c41a8cff42e21410a6bf54e0cef91a2de 🔍
VirtualSize 0x29
VirtualAddress 0x6d000
SizeOfRawData 0x200
PointerToRawData 0x67800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.704209

Imports

KERNEL32.dll FindClose
FindFirstFileExW
FindNextFileW
CloseHandle
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureStackBackTrace
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentProcessId
FreeLibrary
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsProcessorFeaturePresent
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
FlushFileBuffers
HeapSize
CreateFileW

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-20 23:11:12
Version 0.0
SizeofData 880
AddressOfRawData 0x60c48
PointerToRawData 0x5f248

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140065040

RICH Header

XOR Key 0xae38e859
Unmarked objects 0
C++ objects (VS2017 v15.0 compiler 25017) 158
C objects (VS2017 v15.0 compiler 25017) 18
ASM objects (VS2017 v15.0 compiler 25017) 7
Imports (VS2017 v15.0 compiler 25017) 3
Total imports 119
ASM objects (VS2017 v15.0 compiler 25017) (#2) 10
C objects (VS2017 v15.0 compiler 25017) (#2) 16
C++ objects (VS2017 v15.0 compiler 25017) (#2) 80
C++ objects (VS2017 v15.0 compiler 25017) (#3) 1
Linker (VS2017 v15.0 compiler 25017) 1

Errors

Leave a comment

No comments yet.