| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jun-07 00:45:39 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains a XORed PE executable:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses constants related to RC5 or RC6 Uses known Mersenne Twister constants Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Jun-07 00:45:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x44c600 |
| SizeOfInitializedData | 0x214800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000040C3A8 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x666000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| d3dx9_43.dll |
D3DXCreateTextureFromFileInMemoryEx
|
|---|---|
| WS2_32.dll |
getsockopt
send recv setsockopt WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSASetLastError WSAIoctl closesocket WSAGetLastError htons socket ntohs WSAStartup WSACleanup accept bind connect getpeername ioctlsocket __WSAFDIsSet shutdown getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname gethostname select sendto recvfrom freeaddrinfo getaddrinfo listen htonl getsockname |
| CRYPT32.dll |
CertFreeCTLContext
CertFindExtension CertGetNameStringW CryptQueryObject CertGetCertificateContextProperty CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertCreateCertificateChainEngine CertAddCertificateContextToStore CertOpenSystemStoreW CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext |
| Secur32.dll |
InitSecurityInterfaceW
|
| ADVAPI32.dll |
OpenSCManagerA
RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation GetUserNameA RegOpenKeyExA RegQueryValueExA CloseServiceHandle EnumServicesStatusA ConvertSidToStringSidA CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegCloseKey |
| IPHLPAPI.DLL |
GetAdaptersInfo
if_nametoindex |
| KERNEL32.dll |
ExitProcess
GetConsoleCP GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleOutputCP SetFilePointerEx GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetExitCodeProcess CreateProcessW GetTimeZoneInformation ReadConsoleInputW HeapReAlloc SetStdHandle SetEndOfFile FreeLibraryAndExitThread GetDateFormatW CreateFileW CloseHandle DeviceIoControl CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId VirtualAlloc VirtualFree SetUnhandledExceptionFilter GetLastError GetCurrentProcess GetSystemDirectoryW VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile K32GetModuleInformation GetModuleFileNameW GetStdHandle GetEnvironmentVariableA CreateDirectoryA DeleteFileA GetFileAttributesA SetFileAttributesA GetVolumeInformationA CreateMutexA IsValidCodePage TerminateProcess CreateThread GetCurrentThread SetThreadPriority SetPriorityClass OpenProcess GlobalMemoryStatusEx GetSystemInfo GetSystemTime GetLocalTime GetTickCount GetTickCount64 GetWindowsDirectoryA GetNativeSystemInfo VirtualProtect GetModuleFileNameA GetModuleHandleW GlobalSize LocalAlloc LocalFree QueryFullProcessImageNameA GetComputerNameA FreeConsole GetConsoleMode SetConsoleMode SetConsoleCtrlHandler SetConsoleCP SetConsoleOutputCP GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA SetCurrentConsoleFontEx GetConsoleWindow ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection FormatMessageW SleepEx GetFullPathNameW MoveFileExW WaitForSingleObjectEx GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx WriteFile RtlVirtualUnwind InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemTimeAsFileTime GetEnvironmentVariableW RtlUnwind InitializeCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA FormatMessageA LoadLibraryW SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW ReadConsoleA ReadConsoleW DeleteFileW LoadLibraryExW InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetProcessHeap WriteConsoleW HeapSize Sleep GetACP InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx SleepConditionVariableSRW TryAcquireSRWLockExclusive |
| USER32.dll |
ShowWindow
DestroyWindow IsWindow GetSystemMetrics OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyState SetWindowPos GetForegroundWindow IsWindowVisible GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorW GetLastInputInfo MessageBoxW GetUserObjectInformationW GetProcessWindowStation EnumDisplayMonitors GetMonitorInfoA LoadIconW GetWindow GetWindowThreadProcessId EnumWindows GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW MessageBoxA GetWindowRect SendMessageW |
| ole32.dll |
CreateStreamOnHGlobal
GetHGlobalFromStream |
| d3d9.dll |
Direct3DCreate9Ex
|
| IMM32.dll |
ImmGetContext
ImmReleaseContext ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow |
| ntdll.dll |
RtlLookupFunctionEntry
RtlCaptureContext |
| WININET.dll |
HttpQueryInfoA
InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle |
| gdiplus.dll |
GdipDisposeImage
GdipSaveImageToStream GdipCloneImage GdipGetImageEncodersSize GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipFree GdipCreateBitmapFromHBITMAP GdipAlloc |
| bcrypt.dll |
BCryptGenRandom
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-07 00:45:39 |
| Version | 0.0 |
| SizeofData | 1068 |
| AddressOfRawData | 0x58e598 |
| PointerToRawData | 0x58cf98 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-07 00:45:39 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x14058ea10 |
|---|---|
| EndAddressOfRawData | 0x1405920f4 |
| AddressOfIndex | 0x14061f370 |
| AddressOfCallbacks | 0x14044ee90 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_16BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14060e7c0 |
| XOR Key | 0x36f65e4b |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 211 |
| C objects (33145) | 45 |
| ASM objects (33145) | 25 |
| 253 (35207) | 3 |
| C objects (35207) | 19 |
| ASM objects (35207) | 12 |
| C++ objects (35207) | 100 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 2 |
| Imports (33145) | 30 |
| Unmarked objects (#2) | 42 |
| C objects (35223) | 970 |
| Imports (21202) | 3 |
| Total imports | 411 |
| C++ objects (35223) | 18 |
| Resource objects (35223) | 1 |
| Linker (35223) | 1 |
No comments yet.