Manalyze report for 2133f04da66bfb1358900f8c4eca661f67648bb0ed020959fc0f47f6028a6b8a

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-16 13:29:19

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Info	Interesting strings found in the binary:	`Contains domain names: api.open-meteo.com geocoding-api.open-meteo.com https://api.open-meteo.com https://api.open-meteo.com/v1/forecast?latitude https://geocoding-api.open-meteo.com https://geocoding-api.open-meteo.com/v1/search?name meteo.com open-meteo.com`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Has Internet access capabilities: WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpCrackUrl`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`3b86509dda95a1464a38bbc2a0149724` 🔍
SHA1	`93c47c08957c4b49808b6963469d76a72a9b82aa` 🔍
SHA256	`2133f04da66bfb1358900f8c4eca661f67648bb0ed020959fc0f47f6028a6b8a` 🔍
SHA3	`c3efbfaa46ba6e9d9fdfe21ab0fcf69b5adbdc328bd1d8d54066af7130180143` 🔍
SSDeep	`6144:BAaeITzhYH2X0L17cVX+uUZTrjYOjXj3v3uUo:B9fTzy2EJ7corjpj3G` 🔍
Imports Hash	`0aa442a7c3349fa9a6cb037e29064306` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2026-Oct-16 13:29:19
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x3f600`
SizeOfInitializedData	`0x13800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0001DAC0 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x41000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x56000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`4926ebfc275015e62dfe0e4f314fc465 🔍`
SHA1	`93be2c1940a516cba9f039dcc0ac990b13d06403 🔍`
SHA256	`1261757003fbb707ccb94daf35977c35f9fef88a08e6826c715147b552729bdb 🔍`
SHA3	`721a0bf41bc280f021868371909122c34fb6dbb6b6875483d0808d49baba33b4 🔍`
VirtualSize	`0x3f42a`
VirtualAddress	`0x1000`
SizeOfRawData	`0x3f600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.42252`

.rdata

MD5	`3cf90fe87e20200ed2aff77b60772f24 🔍`
SHA1	`9c92643652dd62e06dbbd5bc7b5800c3aaf046b5 🔍`
SHA256	`14b6b09a2356cf6d2b43411b64ad41ed3a873bbdc6de1a4ceb8f81ff2309af00 🔍`
SHA3	`09722c08fca7078ca2baab39abed33690646a3687426323d056269816c824a3d 🔍`
VirtualSize	`0xef8e`
VirtualAddress	`0x41000`
SizeOfRawData	`0xf000`
PointerToRawData	`0x3fa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.25295`

.data

MD5	`56419315723783f69e74e5d889cd2f81 🔍`
SHA1	`efdb0b3d44ee626091cb72d330b79c4805761339 🔍`
SHA256	`eae08a56e3e8f255b94375526582c148b6d5d5c4765af7910497c4629f1aaf33 🔍`
SHA3	`94984d22dff26606d9785a9f108ef915605e88c48dbbffedd5598bb6a60da769 🔍`
VirtualSize	`0x1d3c`
VirtualAddress	`0x50000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x4ea00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.18127`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x80`
VirtualAddress	`0x52000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4fe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`504e95b111f409045469b75ca62151ab 🔍`
SHA1	`ff05725de0c0e6286b1a0be556593b665e49d2b4 🔍`
SHA256	`f12de4e4e691ee59b22b2d8f2de0b573c355b5804ac2c7de9d8311c5b8e69d14 🔍`
SHA3	`4cc0296d10eeca96aee64d650c1be409b1f739647312424fd8b3ca4e5f5a5614 🔍`
VirtualSize	`0x26b0`
VirtualAddress	`0x53000`
SizeOfRawData	`0x2800`
PointerToRawData	`0x50000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.47122`

Imports

WINHTTP.dll	`WinHttpOpen` `WinHttpQueryHeaders` `WinHttpReceiveResponse` `WinHttpSendRequest` `WinHttpOpenRequest` `WinHttpSetTimeouts` `WinHttpQueryDataAvailable` `WinHttpReadData` `WinHttpConnect` `WinHttpCloseHandle` `WinHttpCrackUrl`
KERNEL32.dll	`ExitProcess` `CreateFileW` `HeapSize` `GetProcessHeap` `SetStdHandle` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `FindNextFileW` `FindFirstFileExW` `FindClose` `GetLastError` `MultiByteToWideChar` `WideCharToMultiByte` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `EncodePointer` `DecodePointer` `LCMapStringEx` `GetStringTypeW` `GetCPInfo` `IsProcessorFeaturePresent` `QueryPerformanceCounter` `GetCurrentProcessId` `GetCurrentThreadId` `GetSystemTimeAsFileTime` `InitializeSListHead` `SetUnhandledExceptionFilter` `GetStartupInfoW` `GetModuleHandleW` `RaiseException` `RtlUnwind` `SetLastError` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `GetStdHandle` `WriteFile` `GetModuleFileNameW` `GetCurrentProcess` `WriteConsoleW` `TerminateProcess` `FreeLibrary` `GetModuleHandleExW` `GetProcAddress` `GetCommandLineA` `GetCommandLineW` `IsDebuggerPresent` `UnhandledExceptionFilter` `HeapFree` `HeapAlloc` `GetFileType` `VirtualProtect` `LoadLibraryExW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `IsValidCodePage` `GetACP` `GetOEMCP` `CloseHandle` `FlushFileBuffers` `GetConsoleOutputCP` `GetConsoleMode` `ReadFile` `GetFileSizeEx` `SetFilePointerEx` `ReadConsoleW` `HeapReAlloc`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Oct-16 13:29:19
Version	`0.0`
SizeofData	`832`
AddressOfRawData	`0x4d480`
PointerToRawData	`0x4be80`

TLS Callbacks

Load Configuration

Size	`0xc0`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x450180`
SEHandlerTable	`0x44d204`
SEHandlerCount	`105`

RICH Header

XOR Key	`0x4339e0d1`
Unmarked objects	`0`
ASM objects (33145)	`17`
C++ objects (33145)	`170`
C objects (33145)	`23`
ASM objects (35721)	`22`
C objects (35721)	`17`
C++ objects (35721)	`79`
Imports (33145)	`5`
Total imports	`100`
C++ objects (36260)	`2`
Linker (36260)	`1`

Errors

Leave a comment

No comments yet.