1d9ab089f008cc50449c560eef70dc8940788485d69720a2d61c96edbacecc71
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Oct-09 14:39:47 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
Embedded COFF debugging symbols
|
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to internet browsers:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: /4
Unusual section name found: /19 Unusual section name found: /31 Unusual section name found: /45 Unusual section name found: /57 Unusual section name found: /70 Unusual section name found: /81 Unusual section name found: /97 Unusual section name found: /113 |
| Info | The PE contains common functions which appear in legitimate applications. |
Possibly launches other programs:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 76.2257% of the executable. |
| Suspicious | The file contains overlay data. | 44494 bytes of data starting at offset 0xfc800. |
| Malicious | VirusTotal score: 6/71 (Scanned on 2026-10-10 14:37:36) |
APEX:
Malicious
Bkav: W32.Malware.2CCDC4C0 CrowdStrike: win/malicious_confidence_60% (D) Cylance: Unsafe Elastic: malicious (moderate confidence) McAfeeD: ti!1D9AB089F008 |
Hashes
| MD5 | aeb339cba259486e3eb168e86ebd4e32 🔍 |
|---|---|
| SHA1 | 8839befd08dff39436a61963ba24d681fc1a00ec 🔍 |
| SHA256 | 1d9ab089f008cc50449c560eef70dc8940788485d69720a2d61c96edbacecc71 🔍 |
| SHA3 | 684b0dc2e848aa3cb01ad37c0ce21978e8a7eb7d71df5ae0f0846546e7210a04 🔍 |
| SSDeep | 24576:LU7dUucfMJFxzWd5z1QWJoBLX/XqgLuIFZybVQeX/46y+UfvZig1dDFk:LU7dUuSMJFxzWd5z1QWJoBLX/XqgLuG2 🔍 |
| Imports Hash | 7b4156a7285dfb5045293ae6c35f8b0d 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 20 |
| TimeDateStamp | 2026-Oct-09 14:39:47 |
| PointerToSymbolTable | 0xfc800 |
| NumberOfSymbols | 2079 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x7000 |
| SizeOfInitializedData | 0xd2c00 |
| SizeOfUninitializedData | 0xc00 |
| AddressOfEntryPoint | 0x00000000000013E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x107000 |
| SizeOfHeaders | 0x600 |
| Checksum | 0x108865 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 6551bef2000f2471280b5b200994598e 🔍 |
|---|---|
| SHA1 | 3b4b23c0d257e9e0a23900a60ce7bf0a693f0cf2 🔍 |
| SHA256 | c42dd0df28e2868bc8c0489f3d27fbbdc80f74c7e511211ca6231c579eebd027 🔍 |
| SHA3 | 1c9c77b3d4ae51d5119d8747a550abc194b284212429257a6a9ee9418be60baf 🔍 |
| VirtualSize | 0x6e58 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x7000 |
| PointerToRawData | 0x600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.30589 |
.data
| MD5 | c7e89c2ae51a5f12171d1176a914669a 🔍 |
|---|---|
| SHA1 | 263ac4e3a69f97715e5a3fc22548aa228acec7b2 🔍 |
| SHA256 | 1dd0f65d4f8aaaccc25d6f36c83dd44540140f20423ce3dd2363eecedc726535 🔍 |
| SHA3 | 3cbfd7dac58897934bf639ae4d3aaed655d23b6431ce6b575f81c498d1fd733d 🔍 |
| VirtualSize | 0xc0 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x7600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.834147 |
.rdata
| MD5 | 3ba3ca9258d2332a27e71c8fb4cd0300 🔍 |
|---|---|
| SHA1 | 6bcde2d12de3216c34bb6bd890dbdb19b97a020f 🔍 |
| SHA256 | 7ed3180158631f807fccb3dbf3646c8824d108a9be9204a33ef651c0191c2064 🔍 |
| SHA3 | 79db7b8dccedd3249edfde35b9662b23c97b9d9723dffda86d8a2d22f1190b35 🔍 |
| VirtualSize | 0xf50 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x7800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.68373 |
.pdata
| MD5 | f519617bbf1133a030642f64f0d906f1 🔍 |
|---|---|
| SHA1 | 303c5369cea778791152b733908c0498d5543003 🔍 |
| SHA256 | 53202ced8423cc9633da90b57abcd88e4a961a5a7db0c2a6b405f9870c494f61 🔍 |
| SHA3 | 28239b3f21ededd41e7c6fbc45378866339f29292b2374792b1393443e3fd04a 🔍 |
| VirtualSize | 0x468 |
| VirtualAddress | 0xa000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x8800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.33609 |
.xdata
| MD5 | d96c127eedae9595df93f2ba5d513d44 🔍 |
|---|---|
| SHA1 | 5f534b73b858105c1d82a3b82e8233362fa9c0cd 🔍 |
| SHA256 | c646cd178c0d768abb356411abbee794295c0b1db61296375570aae339172882 🔍 |
| SHA3 | 3894b9340d6a9367d86b5385c0b31751b7ce4e758c9043ebac36af32b65065c7 🔍 |
| VirtualSize | 0x51c |
| VirtualAddress | 0xb000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x8e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.33721 |
.bss
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xb80 |
| VirtualAddress | 0xc000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.idata
| MD5 | 0814b33a04e1037c1baa887e4fc5fbd0 🔍 |
|---|---|
| SHA1 | d5c6d27336fbe67a50f0a09f1a2675e3201d9c58 🔍 |
| SHA256 | 4ee8b07bb81c7303e65c1329d11a68eeb558c8b80b194904d1ac43b404e21a8e 🔍 |
| SHA3 | 34642bde59516eab3dd80bc17b455aa8a8318d6878f83cf1be2cf156f6a510dd 🔍 |
| VirtualSize | 0x910 |
| VirtualAddress | 0xd000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0x9400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.73047 |
.CRT
| MD5 | 1764abbe57368e662a646d2de455f2e5 🔍 |
|---|---|
| SHA1 | dbd369947dde66159eefdaf097d79414d2cc3d43 🔍 |
| SHA256 | 1d559a00540353a6f45edeca7611cab367fce2fa32e640f0881d3daefe161488 🔍 |
| SHA3 | 62f3e26f036a6af67d2d24b7ea58ad2f098eb34b3fde6895254d1d0347871f8b 🔍 |
| VirtualSize | 0x60 |
| VirtualAddress | 0xe000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x9e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.278035 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0xf000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xa000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 7c89229e31152180cd09666f7a835c2c 🔍 |
|---|---|
| SHA1 | 2b022a78924eb5fa2a0a709e6c874f0706d29290 🔍 |
| SHA256 | 2c8241c845fd317c76c00196d326f064b868ccd9802315adc86008361d4955ca 🔍 |
| SHA3 | 01db938bdb196647c6e3c9b8553fd283e130f9519013a373901fa1babec6a67f 🔍 |
| VirtualSize | 0xc8df8 |
| VirtualAddress | 0x10000 |
| SizeOfRawData | 0xc8e00 |
| PointerToRawData | 0xa200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.7415 |
.reloc
| MD5 | ab84efa0a89b986356efe9639c7faa6e 🔍 |
|---|---|
| SHA1 | 71fbb4983adc505fd962577f5537677e82608f65 🔍 |
| SHA256 | 6adc72a2919ba700cc6df42f3ecad011f4b786c34dfc725aecc197ca9b99aa16 🔍 |
| SHA3 | ac1c6bbde2243e773ca1871180817db2130a9cb6a101b9759c2187e5f2c879d8 🔍 |
| VirtualSize | 0x80 |
| VirtualAddress | 0xd9000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xd3000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.51041 |
/4
| MD5 | 9aedaf9f54190e45dc0efb794ed96be8 🔍 |
|---|---|
| SHA1 | 2c395c93cb8da30ab44cce9fe54a7cc536f1832e 🔍 |
| SHA256 | 9ce44d5682e7692d063026f1885a361bb83440f527b564a649bc13bec25f0c2b 🔍 |
| SHA3 | 096e75020c1e7ec0a82a1ca8fdf9de0c25a1c7d4d96aef07784b75b5c5a61693 🔍 |
| VirtualSize | 0x650 |
| VirtualAddress | 0xda000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0xd3200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.51896 |
/19
| MD5 | 16d54ed54f1e6de03f51fbac1f994e50 🔍 |
|---|---|
| SHA1 | 222b241e136afb23a498b98bd533cc4c0a77fbcb 🔍 |
| SHA256 | 9c9ea98597627af97c800511c071e51f9fd3ff3c9f1f5341480c0a9b9f68f26b 🔍 |
| SHA3 | 5dea4f938d435e425785bbede4e4022b4ca8cf6c4a2b280aefb1f5c75600fb45 🔍 |
| VirtualSize | 0x12ecc |
| VirtualAddress | 0xdb000 |
| SizeOfRawData | 0x13000 |
| PointerToRawData | 0xd3a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.82967 |
/31
| MD5 | a9e84b7b20843969c24b86204a1f5b77 🔍 |
|---|---|
| SHA1 | a3408484769df4f07979eaaa7a551a3028fad3ac 🔍 |
| SHA256 | a5a07f8e57a4162178d00ed5843fcce59ebb2783d8f2766f72eaf234fd72c98b 🔍 |
| SHA3 | b0b67613a8aa5fa6f673f08aefe371a8b7ee3c3ad59f57abe350f453c09c35e4 🔍 |
| VirtualSize | 0x3252 |
| VirtualAddress | 0xee000 |
| SizeOfRawData | 0x3400 |
| PointerToRawData | 0xe6a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.78143 |
/45
| MD5 | 88e8affb66556422eec4b8a39d13f94b 🔍 |
|---|---|
| SHA1 | 7c00da653056f94dcc5459f5848a4a63980e7600 🔍 |
| SHA256 | 03741a53842d7e829a464f43e6a7a79af700725bf54a7a5b9861593f9643871f 🔍 |
| SHA3 | fdae31b673572dd82b3b93bebf7ea71486117d108588094ec4443c7219881d15 🔍 |
| VirtualSize | 0x6db7 |
| VirtualAddress | 0xf2000 |
| SizeOfRawData | 0x6e00 |
| PointerToRawData | 0xe9e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.05591 |
/57
| MD5 | aceb867dc35eda75414f8c4bb9afd318 🔍 |
|---|---|
| SHA1 | 4d2a13a9d4db315971e826d17ca0f5852518dfe5 🔍 |
| SHA256 | 0cad1ce88c75ed8bf04753bb9fbf5ae3c4700b66e5a41702081847637d5c4e9c 🔍 |
| SHA3 | 6bfb8853df54434840d0a4d3561a25c66ae1d548bb6e3936b7670c58721c7633 🔍 |
| VirtualSize | 0x1728 |
| VirtualAddress | 0xf9000 |
| SizeOfRawData | 0x1800 |
| PointerToRawData | 0xf0c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.71146 |
/70
| MD5 | 7525f1145b47b06d73d7667bb1386b5f 🔍 |
|---|---|
| SHA1 | c26aa7945adf8e1fa76dde140b4c3fe378bc26bc 🔍 |
| SHA256 | fe747abb204688fe033a09aac79e7c0caec7446142dd56b529079eba7b201d8b 🔍 |
| SHA3 | 5b1ef3bac03e1104aec967b6b85b364c620a7edf05f0695cc470c1866c299c28 🔍 |
| VirtualSize | 0x39d |
| VirtualAddress | 0xfb000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0xf2400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.62339 |
/81
| MD5 | 038c19ff93cc6816826f021ce7cbea3f 🔍 |
|---|---|
| SHA1 | 974efe38be25cf2edb0314a8ff7ffefe5870bafa 🔍 |
| SHA256 | 3a25867ceaf175018f9650e3d00a577d5e5b6eb6f47fd97eac08b277271d8b20 🔍 |
| SHA3 | ec4468ce57c4c2b32d5f67d724c9dce5940b07b31cec463674bb5b39571b3fa5 🔍 |
| VirtualSize | 0x1fec |
| VirtualAddress | 0xfc000 |
| SizeOfRawData | 0x2000 |
| PointerToRawData | 0xf2800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.73527 |
/97
| MD5 | f24ead44b5f58f84588b28b31867fa14 🔍 |
|---|---|
| SHA1 | ef8d85bdb70ab8274fc0e36ab89f19782cf3e808 🔍 |
| SHA256 | 4eb29c45d29783aeb56ddda38816e44040426c812429f63adc1b072ada5859a5 🔍 |
| SHA3 | 968cb02e03d7542a12fc7da4f7aa4c0de3f2331dd9083944da3ae7de3cc4f003 🔍 |
| VirtualSize | 0x7817 |
| VirtualAddress | 0xfe000 |
| SizeOfRawData | 0x7a00 |
| PointerToRawData | 0xf4800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.80951 |
/113
| MD5 | 53fdfe7e6a671402cea822e67a724b88 🔍 |
|---|---|
| SHA1 | 0948846c0eae1cd029d0f8c41c5bffb68033ea44 🔍 |
| SHA256 | 509af297b74a9e559fb2b41e65823b1a1ec4a8751a3208afffccb7b17b9e42ce 🔍 |
| SHA3 | 2f5c78bc272b7a6b5f2047b81571be54c57180c7c26fe41396a39df974997a74 🔍 |
| VirtualSize | 0x550 |
| VirtualAddress | 0x106000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0xfc200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.42173 |
Imports
| KERNEL32.dll |
CloseHandle
CreateDirectoryA CreateFileA DeleteCriticalSection EnterCriticalSection FindResourceA GetFileAttributesA GetLastError GetStartupInfoA GetTempPathA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadResource LockResource MultiByteToWideChar SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte WriteFile __C_specific_handler |
|---|---|
| msvcrt.dll |
___lc_codepage_func
___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _ismbblead _onexit abort calloc exit fprintf fputc free fwrite localeconv malloc memcpy memset signal strerror strlen strncmp vfprintf wcslen |
| SHELL32.dll |
ShellExecuteA
|
| USER32.dll |
MessageBoxA
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2d1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.65352 |
| Detected Filetype | PNG graphic file |
| MD5 | 412c13da82dc4831203d4610069d0661 🔍 |
| SHA1 | aab123354679a9a5330e0b8ac2ce2fff2d4dffc3 🔍 |
| SHA256 | 0a3bb0631d7b4307a352c2bc3ff6e922e95a73f8bd479b9880e8be2b5ac40d7d 🔍 |
| SHA3 | 3ff802f6089a45f7965c9209fe0327cc04550b91068a7df04c47ba4259e2b57c 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x654 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.82932 |
| Detected Filetype | PNG graphic file |
| MD5 | 0a074003377bc6d7e363cf1aa09d27c3 🔍 |
| SHA1 | efa2bab11b632d3d1bf79bed50323d42c487817d 🔍 |
| SHA256 | 3285bbd7e0a357c2fee71b0ded802f4a47e0842727209fcbaace6008a9a9b19c 🔍 |
| SHA3 | 8f2622ec6a5160ce44c44d93a34ca65a0cfdd0e1e91c427be681585144e6db7f 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x9df |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.87848 |
| Detected Filetype | PNG graphic file |
| MD5 | a41a851a747c354e7cc0e12387c93f82 🔍 |
| SHA1 | 2693c6e11c35700f0150d4826220ec49bb907688 🔍 |
| SHA256 | b2d955e7c44cd0d8c0e434340a5c6433b649a3d6d99216ef7ef436fa37429bc9 🔍 |
| SHA3 | 00d1ade976fe72295fb348e4b4db85124040a61adcd74facb6c23d48add2e8a9 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xd9f |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.89879 |
| Detected Filetype | PNG graphic file |
| MD5 | 061dba858a601056571ec5d8a0bb3efd 🔍 |
| SHA1 | c06e7973e2d12908c3f22b436748e4819ea75061 🔍 |
| SHA256 | 5e98781762709c51d2d3c66ba4abe2265f046b69ab67a04e903986d8aa7285c3 🔍 |
| SHA3 | 8bc0f5155a5de517007ef8c31a5a2ddbe900b434329027020076c804328d987b 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x1c44 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.92478 |
| Detected Filetype | PNG graphic file |
| MD5 | 1b0aef5573e8287d5b977e9a29c14766 🔍 |
| SHA1 | 81c00a84aecd3ca4e94bb2c45bf74af7724c44ee 🔍 |
| SHA256 | f03b11953a2c48b3fbb8f9b10895a1d937fedc76dffb1c3a08639194fd281a97 🔍 |
| SHA3 | 92fc9835908092d80979b1c2a75441cbeeec21c5a484a3022b451810eb8cf394 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x47fd |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.9308 |
| Detected Filetype | PNG graphic file |
| MD5 | 5699bc16fd0cb7ff8d76047bdf0ff121 🔍 |
| SHA1 | 93428ebb8666f51065091075dc79be0528b57061 🔍 |
| SHA256 | 34ead252f8a6dd4ff3f7c94d97bb9f4af14c6ebad4e4ff32d6773acbd20883bf 🔍 |
| SHA3 | 8b40626b7c5c79924ac414c97220714d34145a84e7c5449ca54ddde59c3748b6 🔍 |
1 (#2)
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xc06c3 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.47527 |
| MD5 | 949b66f667c2abb7a05a84b746d52fd4 🔍 |
| SHA1 | 7ec40babfd856e01aaae1d94fc9f7e6845264690 🔍 |
| SHA256 | 0d7de619eb3e2f8982deda429c5a02b98f6d67bccb78903696d84e2b4280b6f5 🔍 |
| SHA3 | e0dc23addf802d652c3cc7e9fb1613942f7249e933daa08840a56dfef2f70dc0 🔍 |
1 (#3)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.81593 |
| Detected Filetype | Icon file |
| MD5 | 320f99f6874cb0b0fc31bf72928e3f2d 🔍 |
| SHA1 | 6f0a0288709c8693aa8b6eda62be38bc366f6521 🔍 |
| SHA256 | d22a54b61febacc3fbfb48519366f54396e00913da14fb88fb59de8941bebe84 🔍 |
| SHA3 | 25404dba9a6278c1c9337983c8ce535099b57d61a21db0e27714d469623bad33 🔍 |
Version Info
TLS Callbacks
| StartAddressOfRawData | 0x14000f000 |
|---|---|
| EndAddressOfRawData | 0x14000f008 |
| AddressOfIndex | 0x14000c07c |
| AddressOfCallbacks | 0x14000e038 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000140001910
0x00000001400018E0 |
Load Configuration
RICH Header
Errors
[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Tried to read outside the COFF string table to get the name of section /19!
[*] Warning: Tried to read outside the COFF string table to get the name of section /31!
[*] Warning: Tried to read outside the COFF string table to get the name of section /45!
[*] Warning: Tried to read outside the COFF string table to get the name of section /57!
[*] Warning: Tried to read outside the COFF string table to get the name of section /70!
[*] Warning: Tried to read outside the COFF string table to get the name of section /81!
[*] Warning: Tried to read outside the COFF string table to get the name of section /97!
[*] Warning: Tried to read outside the COFF string table to get the name of section /113!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!
[*] Warning: Section .bss has a size of 0!
Leave a comment
No comments yet.