Manalyze report for 22c4defda3520ec4e72800dc26675df133d00cbb6c1deb266bea9c8bc3218109

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-29 01:31:55
TLS Callbacks	2 callback(s) detected.

Plugin Output

Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryW`
Safe	VirusTotal score: 0/71 (Scanned on 2026-10-29 01:51:18)	`All the AVs think this file is safe.`

Hashes

MD5	`9180dd0437d8bd22004466d6574324be` 🔍
SHA1	`de67d1d34a2ec4aa3758bad8bc52bd4a8394b3eb` 🔍
SHA256	`22c4defda3520ec4e72800dc26675df133d00cbb6c1deb266bea9c8bc3218109` 🔍
SHA3	`7224d86379a86fa334efecf8d0449698bbc682e2c89db48fbf86a9043b8fd6ce` 🔍
SSDeep	`1536:mJmuNd/NkDVPqN+ud3rNyD0BFNLD8bHY:mJmEgDZqTgDoLD8b4` 🔍
Imports Hash	`1d38d7e4743b11093025b669e726a6de` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`9`
TimeDateStamp	2026-Oct-29 01:31:55
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`2.0`
SizeOfCode	`0xc000`
SizeOfInitializedData	`0x4600`
SizeOfUninitializedData	`0xe00`
AddressOfEntryPoint	`0x00001269 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0xd000`
ImageBase	`0x62c40000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x16000`
SizeOfHeaders	`0x400`
Checksum	`0x1acdc`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d2c12f112dac470e6fc6ac297879d009 🔍`
SHA1	`9bf55fe836bb5c167c12506c00449c9045050bcd 🔍`
SHA256	`1228cfb20a79b8297eedadf68f28f7adb963c58fa93bf483c375a4441c629485 🔍`
SHA3	`bacbd6a9f4ce29b588b07be508e5d82d1dd6f110599dce04c8998358b022396d 🔍`
VirtualSize	`0xbed0`
VirtualAddress	`0x1000`
SizeOfRawData	`0xc000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.05004`

.data

MD5	`901d5ccd946c4eca93549cc1d3303f8d 🔍`
SHA1	`66a5e0d93650eba784c83a869b9a3556a026671c 🔍`
SHA256	`cdfa6707f383c7502f10bbbaf85e8b9fd36295187b03fc600f9535abb112575d 🔍`
SHA3	`8ad2586862355b3b50348f020223fefc1cd6b87d71235fe72dc4b7c58eb340d2 🔍`
VirtualSize	`0x84`
VirtualAddress	`0xd000`
SizeOfRawData	`0x200`
PointerToRawData	`0xc400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.27984`

.rdata

MD5	`0644aab337cbda67b92a8119db17dc65 🔍`
SHA1	`7a7df13839c5244c46448a5a5f3d5c944484a34f 🔍`
SHA256	`a0ff7e55b338892b38f5befc42be44089a641e85bca4808da02e500274ab7fd1 🔍`
SHA3	`7a71976d2f9545e22913292ad688f5129e3c9d9a705dbca69e470a80f85e1a5f 🔍`
VirtualSize	`0xdec`
VirtualAddress	`0xe000`
SizeOfRawData	`0xe00`
PointerToRawData	`0xc600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.37313`

.eh_fram

MD5	`448ffc4fa79392db65380e04bc029350 🔍`
SHA1	`bcead70e58b919ad673b6e4a07ff8ef338621ca9 🔍`
SHA256	`5eeb53bb4dcda5f73c054da5d529d56b21e01438a7df592fb27f136a236c7477 🔍`
SHA3	`941af52b880d5f383497c76c0622b633f3e9e398695b78b1fe72a4df521d0cad 🔍`
VirtualSize	`0x1cac`
VirtualAddress	`0xf000`
SizeOfRawData	`0x1e00`
PointerToRawData	`0xd400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.5012`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0xd48`
VirtualAddress	`0x11000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`907eb2d7ead75eb0353b4ecb041f8125 🔍`
SHA1	`fcf340577167268a4d2b746ca607bc5bec5b3b3d 🔍`
SHA256	`bf333e3252cae1331382fa8db7a6b1a43982c1b4b3228999e433233ff812a795 🔍`
SHA3	`50dec2e79334e7c5fcc90e9ac7565ce7cdec9c50be42f4a6bc618760d68cbcb6 🔍`
VirtualSize	`0x71e`
VirtualAddress	`0x12000`
SizeOfRawData	`0x800`
PointerToRawData	`0xf200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.05044`

.idata

MD5	`c3c129d7a264157d23b9e09d248f4df9 🔍`
SHA1	`a09b5ad17efd786c80013d63d76e4fb2bf5a9d96 🔍`
SHA256	`6378f80a429fc331083e5c076a1273a776aa547fe791abde411694b991afea56 🔍`
SHA3	`47a0f9e3a792023deb87c27b99e72ac6c764d27d21a34293694d8934b07f9b15 🔍`
VirtualSize	`0x634`
VirtualAddress	`0x13000`
SizeOfRawData	`0x800`
PointerToRawData	`0xfa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.31287`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x8`
VirtualAddress	`0x14000`
SizeOfRawData	`0x200`
PointerToRawData	`0x10200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`3d50d117d96c96d07535943dc58ffba6 🔍`
SHA1	`6c605e0dd4094163a07421e1bfd90191c62e17a2 🔍`
SHA256	`fa973bfdea14d60e592c6bb4928116113006ad0a115bb2acf78ae8b89a12cc1e 🔍`
SHA3	`b1f2601fb40201ab4ae9e45ddf2c99959934e7cf2f94f35e2a636397b945f220 🔍`
VirtualSize	`0x5e0`
VirtualAddress	`0x15000`
SizeOfRawData	`0x600`
PointerToRawData	`0x10400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.55508`

Imports

KERNEL32.dll	`CreateDirectoryW` `DeleteCriticalSection` `DisableThreadLibraryCalls` `EnterCriticalSection` `ExitProcess` `FreeLibrary` `GetCPInfo` `GetFileAttributesW` `GetLastError` `GetLocalTime` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleW` `GetProcAddress` `GetSystemDirectoryW` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `MultiByteToWideChar` `Sleep` `TlsGetValue` `VirtualProtect` `VirtualQuery` `WideCharToMultiByte`
msvcrt.dll	`__lc_codepage` `__p__iob` `__p___mb_cur_max` `_amsg_exit` `_errno` `_initterm` `_lock` `_unlock` `_wfopen` `abort` `calloc` `fclose` `fprintf` `fputc` `fputwc` `free` `fwprintf` `localeconv` `malloc` `memcpy` `realloc` `strerror` `strlen` `strncmp` `vfprintf` `wcscat` `wcslen` `wcsrchr`
USER32.dll	`MessageBoxW`

Delayed Imports

D3D11CreateDeviceForD3D12

Ordinal	`1`
Address	`0x1610`

D3DKMTCloseAdapter

Ordinal	`2`
Address	`0x1620`

D3DKMTDestroyAllocation

Ordinal	`3`
Address	`0x1630`

D3DKMTDestroyContext

Ordinal	`4`
Address	`0x1640`

D3DKMTDestroyDevice

Ordinal	`5`
Address	`0x1650`

D3DKMTDestroySynchronizationObject

Ordinal	`6`
Address	`0x1660`

D3DKMTPresent

Ordinal	`7`
Address	`0x1670`

D3DKMTQueryAdapterInfo

Ordinal	`8`
Address	`0x1680`

D3DKMTSetDisplayPrivateDriverFormat

Ordinal	`9`
Address	`0x1690`

D3DKMTSignalSynchronizationObject

Ordinal	`10`
Address	`0x16a0`

D3DKMTUnlock

Ordinal	`11`
Address	`0x16b0`

D3DKMTWaitForSynchronizationObject

Ordinal	`12`
Address	`0x16c0`

EnableFeatureLevelUpgrade

Ordinal	`13`
Address	`0x16d0`

OpenAdapter10

Ordinal	`14`
Address	`0x16e0`

OpenAdapter10_2

Ordinal	`15`
Address	`0x16f0`

CreateDirect3D11DeviceFromDXGIDevice

Ordinal	`16`
Address	`0x1700`

CreateDirect3D11SurfaceFromDXGISurface

Ordinal	`17`
Address	`0x1710`

D3D11CoreCreateDevice

Ordinal	`18`
Address	`0x1720`

D3D11CoreCreateLayeredDevice

Ordinal	`19`
Address	`0x1730`

D3D11CoreGetLayeredDeviceSize

Ordinal	`20`
Address	`0x1740`

D3D11CoreRegisterLayers

Ordinal	`21`
Address	`0x1750`

D3D11CreateDevice

Ordinal	`22`
Address	`0x1760`

D3D11CreateDeviceAndSwapChain

Ordinal	`23`
Address	`0x1770`

D3D11On12CreateDevice

Ordinal	`24`
Address	`0x1780`

D3DKMTCreateAllocation

Ordinal	`25`
Address	`0x1790`

D3DKMTCreateContext

Ordinal	`26`
Address	`0x17a0`

D3DKMTCreateDevice

Ordinal	`27`
Address	`0x17b0`

D3DKMTCreateSynchronizationObject

Ordinal	`28`
Address	`0x17c0`

D3DKMTEscape

Ordinal	`29`
Address	`0x17d0`

D3DKMTGetContextSchedulingPriority

Ordinal	`30`
Address	`0x17e0`

D3DKMTGetDeviceState

Ordinal	`31`
Address	`0x17f0`

D3DKMTGetDisplayModeList

Ordinal	`32`
Address	`0x1800`

D3DKMTGetMultisampleMethodList

Ordinal	`33`
Address	`0x1810`

D3DKMTGetRuntimeData

Ordinal	`34`
Address	`0x1820`

D3DKMTGetSharedPrimaryHandle

Ordinal	`35`
Address	`0x1830`

D3DKMTLock

Ordinal	`36`
Address	`0x1840`

D3DKMTOpenAdapterFromHdc

Ordinal	`37`
Address	`0x1850`

D3DKMTOpenResource

Ordinal	`38`
Address	`0x1860`

D3DKMTQueryAllocationResidency

Ordinal	`39`
Address	`0x1870`

D3DKMTQueryResourceInfo

Ordinal	`40`
Address	`0x1880`

D3DKMTRender

Ordinal	`41`
Address	`0x1890`

D3DKMTSetAllocationPriority

Ordinal	`42`
Address	`0x18a0`

D3DKMTSetContextSchedulingPriority

Ordinal	`43`
Address	`0x18b0`

D3DKMTSetDisplayMode

Ordinal	`44`
Address	`0x18c0`

D3DKMTSetGammaRamp

Ordinal	`45`
Address	`0x18d0`

D3DKMTSetVidPnSourceOwner

Ordinal	`46`
Address	`0x18e0`

D3DKMTWaitForVerticalBlankEvent

Ordinal	`47`
Address	`0x18f0`

D3DPerformance_BeginEvent

Ordinal	`48`
Address	`0x1900`

D3DPerformance_EndEvent

Ordinal	`49`
Address	`0x1910`

D3DPerformance_GetStatus

Ordinal	`50`
Address	`0x1920`

D3DPerformance_SetMarker

Ordinal	`51`
Address	`0x1930`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x62c54000`
EndAddressOfRawData	`0x62c54004`
AddressOfIndex	`0x62c5134c`
AddressOfCallbacks	`0x62c4edd8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x62C429D8` `0x62C42A68`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.