2712d887a297ae40284380bc80a1171d2300d73c883c4241ba9806ea6589cea4
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Dec-19 06:46:26 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
Embedded COFF debugging symbols
|
| ProductName | MSYS2 |
| FileDescription | MSYS2 UCRT64 shell launcher |
| FileVersion | 1.5 |
Plugin Output
| Info | The PE contains common functions which appear in legitimate applications. |
Possibly launches other programs:
|
| Suspicious | The file contains overlay data. | 2700 bytes of data starting at offset 0x13600. |
| Safe | VirusTotal score: 0/69 (Scanned on 2026-07-01 13:40:32) | All the AVs think this file is safe. |
Hashes
| MD5 | 79b8c61755d7f9d32e99b27a5e5906c0 🔍 |
|---|---|
| SHA1 | a85b46eea59c2119dbb4dd9ff01af25b4548cfef 🔍 |
| SHA256 | 2712d887a297ae40284380bc80a1171d2300d73c883c4241ba9806ea6589cea4 🔍 |
| SHA3 | 28e9a3cc5f6d96a79054c568b3b382d13e1c02f4e5833382109cf4dbe36b675c 🔍 |
| SSDeep | 1536:0ueV2k4M/eoeJz76P7c+Lr84RzYUXrVI06WBq00Ci:9eV3Z/6g7c+Lr8KsU7Vr70n 🔍 |
| Imports Hash | ffa87dad2bdef18df5e7c2c39aede7c6 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 11 |
| TimeDateStamp | 2024-Dec-19 06:46:26 |
| PointerToSymbolTable | 0x13600 |
| NumberOfSymbols | 74 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x8000 |
| SizeOfInitializedData | 0x13200 |
| SizeOfUninitializedData | 0xc00 |
| AddressOfEntryPoint | 0x00000000000013C0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x196c7 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | c14908d8d61e58b610ab7629031f9e0c 🔍 |
|---|---|
| SHA1 | ad152cb760d69df37f9f5e57869c3996e4e580c6 🔍 |
| SHA256 | 368fa8921c422f9bb3ccad90500bf1a4dfbdde5db06084fe65294d4653e416f1 🔍 |
| SHA3 | 6964ecbc641b5ecf36b735f53b6f87d53bb2af45106585c3e0af8a66b2b8b81c 🔍 |
| VirtualSize | 0x7e98 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x8000 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.18227 |
.data
| MD5 | 982b4595771bc5487f3095b14d740cac 🔍 |
|---|---|
| SHA1 | 100c99529057756392e55f09026b37bf783e7e7e 🔍 |
| SHA256 | 57fea1f7fe7520cf12176ce5e26f3f86a8f78d0f47f09ef80c217791866265b3 🔍 |
| SHA3 | 50effdaebf7c1961b641fecd6c1573bac8f8fefa588799fc5a18c92bbccf8b9d 🔍 |
| VirtualSize | 0xc0 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x8400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.825586 |
.rdata
| MD5 | 6b6515b5e7b85b7f9fae014039513730 🔍 |
|---|---|
| SHA1 | 569bbc9923af8fee46915fb8364fc8a5cf2b5d7c 🔍 |
| SHA256 | d2ba752a8840c3a4adfdf38130286339211bb9462bb084620e881ab62dfb4ed3 🔍 |
| SHA3 | 308dcf12b30aaa1213e2a12f28a8c6339ca47023adcd63bc63504769ccfa6d1c 🔍 |
| VirtualSize | 0x1400 |
| VirtualAddress | 0xa000 |
| SizeOfRawData | 0x1400 |
| PointerToRawData | 0x8600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.33174 |
.pdata
| MD5 | d81a3de47ff62c1cb18ec9ce93771cc5 🔍 |
|---|---|
| SHA1 | 5e6f6b70cc75777cd537170d82fce82cd6d72e57 🔍 |
| SHA256 | b4a24cab0c9132cc1a43eed9a7ea3467dcd9b04d895bb751d4576ce7c25947e4 🔍 |
| SHA3 | 4c38badb015ad882c4eedfd5598b0d79a4c180bfdb6cc646eee72a6c9eb514ac 🔍 |
| VirtualSize | 0x498 |
| VirtualAddress | 0xc000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x9a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.41896 |
.xdata
| MD5 | 724caa73630338d4c74593563370396b 🔍 |
|---|---|
| SHA1 | 95275c16caf2eab04bb527d239c186db08acb206 🔍 |
| SHA256 | 220b120a555c98b90abf46015de45d47195382b4cbfb3cdd1473f63ce4af15d6 🔍 |
| SHA3 | 3f19c45a38196473639a22bce8539ba677a2ad820566238148b252755e8cd5be 🔍 |
| VirtualSize | 0x44c |
| VirtualAddress | 0xd000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0xa000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.48584 |
.bss
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xb80 |
| VirtualAddress | 0xe000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.idata
| MD5 | 0467732a7a8fcf930481ac7e2447af36 🔍 |
|---|---|
| SHA1 | 4934033711da42b7509cb46e25a37a1d737e8447 🔍 |
| SHA256 | 7cc2a17f2e9f9e44d19fec689fa83e61225f352f87d87b95aeaff2fe171969c0 🔍 |
| SHA3 | 16c0025307e12a76da123941773bf13453d2482c38dcda313053bf31640a7608 🔍 |
| VirtualSize | 0x988 |
| VirtualAddress | 0xf000 |
| SizeOfRawData | 0xa00 |
| PointerToRawData | 0xa600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.87057 |
.CRT
| MD5 | dba87bdc5a3773088cadc3b251c24678 🔍 |
|---|---|
| SHA1 | ee6008e552260cd39a0870d4e72721ef7ca5f653 🔍 |
| SHA256 | 19e7aab9e49d31894e9dd703db98e8aa2ae76f223002d81b6b240dba2b424a55 🔍 |
| SHA3 | 4aed3ebd7ad6c75681ac2e1005ef03e2a1ac5391926db7a0da6b156b216072ef 🔍 |
| VirtualSize | 0x60 |
| VirtualAddress | 0x10000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xb000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.28656 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x11000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xb200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 8378ed44e4df75fc4a81fc3209f7f4d1 🔍 |
|---|---|
| SHA1 | babd294eff30ee7ffcdbea484a49316e243c202f 🔍 |
| SHA256 | 8b5cb4d032a18fccb2e0962765b3945097881ab1b136643db0729cc01b1280a2 🔍 |
| SHA3 | 366178a63191915c3ad297003a72511b387ba975a812f6f804a1a904d8708bc1 🔍 |
| VirtualSize | 0x7f50 |
| VirtualAddress | 0x12000 |
| SizeOfRawData | 0x8000 |
| PointerToRawData | 0xb400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.35438 |
.reloc
| MD5 | da38a4dccac2871ad47bbd0ddd1015f2 🔍 |
|---|---|
| SHA1 | ecd10b641f152ce852d3c91db706e3d55a4ef45a 🔍 |
| SHA256 | 38bf380ef9eff3479c94446fbbc8da3aeb61ecfcd2ad698712026b15f750e9bf 🔍 |
| SHA3 | d9e34667ac062a6eaa8cc08264aeb776d79e0f53ac30660aa9347e1c5322b9b8 🔍 |
| VirtualSize | 0x80 |
| VirtualAddress | 0x1a000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x13400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.48644 |
Imports
| KERNEL32.dll |
CreateProcessW
DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW FormatMessageW GetCommandLineW GetLastError GetModuleFileNameW InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LocalFree MultiByteToWideChar SetEnvironmentVariableW SetLastError SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery |
|---|---|
| msvcrt.dll |
__C_specific_handler
___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _wcsicmp _wcsdup _wcserror _wfopen abort calloc exit fclose feof fwprintf fgetws fprintf fputwc free fwrite localeconv malloc memcpy memset realloc signal strerror strlen strncmp vfprintf wcschr wcscmp wcscpy wcslen wcsrchr |
| USER32.dll |
MessageBoxW
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x568 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.58843 |
| MD5 | 4a02b77d37c5d92da17e37c93c1968f6 🔍 |
| SHA1 | 5e4e47e92a4984844e41305e1297a679183b3fe7 🔍 |
| SHA256 | ecaef2357ffd0c3b9705c698499faa30f72d9d0c9f74e351976d3dd3687fc65c 🔍 |
| SHA3 | 5a32caf7e6d6de3877fae767d0fbcde05156adaf8f3a9e4fc19634afa482aaba 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x8a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.07338 |
| MD5 | 63f2f0d136428d84bd9a63b9c8500b61 🔍 |
| SHA1 | 5de47c8db3bfc801574034f0e2d8d98df6d0be52 🔍 |
| SHA256 | 53cd1aee72e902f643e9d7a17e96cd29695f429d1b7e29da145be26391e1d98d 🔍 |
| SHA3 | 021cef5b11876fee30b15ebc3ca1913405d229dab095ca1cdd0b658955a4b389 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xea8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.37503 |
| MD5 | cb1511c85180cfc60c18c0475d5c9d41 🔍 |
| SHA1 | e7e91594e84b6913bdebdfcd30e677b1ffba8bf6 🔍 |
| SHA256 | 17d1de8d8e6c7eb5298a409715cc9d53853eb2b756824b6ea71e55f9b0bcd686 🔍 |
| SHA3 | 32c3cd32d760de9a91acb1c76e6a0b07330eb5c4e95841620696e39ab59485c8 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x1628 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.62545 |
| MD5 | 6a98eb0b317da18e77d1d69417baa601 🔍 |
| SHA1 | efbda5f471dd1a8ce57bc984896eae97dbd080af 🔍 |
| SHA256 | 3ba10e0393c4111e79ecf525f2bbcb42eb87a6a0fdb7f96ce18c083605f5ec10 🔍 |
| SHA3 | dd00a5d90b58bb02f25eaffaa164249b04f64ddd60bc15bd410fe999934fe0f4 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2ca8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.17142 |
| MD5 | c6c1eaab08846a28ede7fb77d435a647 🔍 |
| SHA1 | 4af23ee1eac7707a965cc442cb37cfe33db6bc26 🔍 |
| SHA256 | 9287ac3b1a98e7803598b6b5d48c0c8e1b2727cdb741f7fc69553e24480bca94 🔍 |
| SHA3 | 1798819bd28ee02063ab1f7fae3ef579b6777b74e7ebc81e053db4eaa5d7a059 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x170d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.94609 |
| Detected Filetype | PNG graphic file |
| MD5 | ccd0b0b31e36d2597c2293bed087bdfd 🔍 |
| SHA1 | 8981754e90079fa6f02f08a11196a30608285806 🔍 |
| SHA256 | cfe30158a10167e3f9e91394ab19a4342ee31633db286855c7616de41889ae50 🔍 |
| SHA3 | 2727b1907bf00183c9d17b879d2a26b0576c6346cd0a26f317a5638b540df5c7 🔍 |
ID
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.83521 |
| Detected Filetype | Icon file |
| MD5 | 4a596996fa27885a40b6a5440381ff2d 🔍 |
| SHA1 | 4628f71bcc98b764902d584add862fdf6660b843 🔍 |
| SHA256 | e023078316837f5a7720cb00706d39b99ee9b0809a374bcb83605f5d7c206fdb 🔍 |
| SHA3 | cf79b21f06b7ce085c7fb19a1965a80f1113fcd2ad2c627ad4f905b90342b6b2 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x190 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.17179 |
| MD5 | c4c2270b67983d03edab08c84510ffa3 🔍 |
| SHA1 | b911a9b03f88d8ab20b27e1bc1aa318c11c9629d 🔍 |
| SHA256 | 56526b9266fb317202a0dab772df11a092c20b2bdcf9aa8f6d7a5fd93d04c386 🔍 |
| SHA3 | f5807b91c7df137add4a759a382883cd1dbe3dc7be12172fe6b18649b2d636a5 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x48f |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.13793 |
| MD5 | 5aa04ce935e78505e230765e85c34355 🔍 |
| SHA1 | 6c93b8c5fde8be4b2231dca6b8ec513cdc82c991 🔍 |
| SHA256 | a73f26a8d504043f785d7360e8febf2eeb8522ec873a0d4dd5d1d4bfd1e67d3d 🔍 |
| SHA3 | 149467cafc03ba34b33cd8076fc2771413760822357952de205dbae2b5cb8059 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.5.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs | (EMPTY) |
| FileType |
VFT_UNKNOWN
|
| Language | English - United States |
| ProductName | MSYS2 |
| FileDescription | MSYS2 UCRT64 shell launcher |
| FileVersion (#2) | 1.5 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x140011000 |
|---|---|
| EndAddressOfRawData | 0x140011008 |
| AddressOfIndex | 0x14000e07c |
| AddressOfCallbacks | 0x140010038 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x00000001400022B0
0x0000000140002280 |
Load Configuration
RICH Header
Errors
[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!
[*] Warning: Section .bss has a size of 0!
Leave a comment
No comments yet.