2bd423e6851059aeceb6a9103c467dfff8c1512864ad0f57d179e8e7e477607d
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-May-18 09:42:55 |
| Detected languages |
Chinese - PRC
English - United States |
| Debug artifacts |
C:\Users\YMH\source\repos\c\Project2\x64\Release\é¼ ä¸æ¦.pdb
|
Plugin Output
| Malicious | The PE contains functions mostly used by malware. |
Uses functions commonly found in keyloggers:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
Hashes
| MD5 | f829e1b7f1ac05449d4c87261bc7d0e5 🔍 |
|---|---|
| SHA1 | 8271e9412481756ecdd4fd844c567209296807c7 🔍 |
| SHA256 | 2bd423e6851059aeceb6a9103c467dfff8c1512864ad0f57d179e8e7e477607d 🔍 |
| SHA3 | ef3d586851214e69535dff039608ad394f09c5e0f292cf275507a4578aad29b2 🔍 |
| SSDeep | 384:eo+l0+HXRiHMZOD1PYSYETRHQ5HffwRxEfK52RuZoijtBKYkOlCtNRuZoijtBKY:WBi6ZCsffwgEgotp531Pv4Do9wGd/ 🔍 |
| Imports Hash | 7fcf99486bb107513d0587825124f347 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2025-May-18 09:42:55 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x3600 |
| SizeOfInitializedData | 0x11000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000003810 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x19000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 34569eef1bc3024134d8195ef8f389a0 🔍 |
|---|---|
| SHA1 | 876862a05639b9ec46f174acf7596eee3ee7d660 🔍 |
| SHA256 | 0fa9b128e2fe6689f1ba95b7a1a011098c0ac16630fadbe527debfe02cbb3022 🔍 |
| SHA3 | 7bc962002523b7d0abe46f89843ad0823b56aa3ef8f40b2bc4f5710108f9ac20 🔍 |
| VirtualSize | 0x344c |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x3600 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.07899 |
.rdata
| MD5 | 41d33955d9508ba657bb513266e5b60a 🔍 |
|---|---|
| SHA1 | 97f2f6b3d45ecbee923452f940360ff9f64d02a9 🔍 |
| SHA256 | 177c805844c8c83e78f13ae3da96ca9235ed7bceaf28019c97fdfb1b0f5e5d80 🔍 |
| SHA3 | 8f390c0cb94318f45c14360705554d53c3795e10fdd2ec7ab4f7b955cfac424e 🔍 |
| VirtualSize | 0x4710 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x4800 |
| PointerToRawData | 0x3a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.90517 |
.data
| MD5 | e71005af9f6d6bf674c3b7b0ce04da99 🔍 |
|---|---|
| SHA1 | 70a72af8cfe9f7659446349d8d6af53456b959f6 🔍 |
| SHA256 | 7a1dccb1fede80c967824e9eeb916628a92e235bf6f995173100708b3a0f67d4 🔍 |
| SHA3 | 91a8ba0c4c2bdc06a70e95a34c7cb3b2e0611e85044597328b20353c651183e9 🔍 |
| VirtualSize | 0xb90 |
| VirtualAddress | 0xa000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x8200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.11298 |
.pdata
| MD5 | 72d0b2d72d20523bba27888079fe68b8 🔍 |
|---|---|
| SHA1 | 71f986390f4bc7735fc4c4deb1b7cd3205fce979 🔍 |
| SHA256 | fad10feae6d40f69407ad460d7ad3d7f9c26d0f80ccae4321e3996e921f5f2f5 🔍 |
| SHA3 | 23128f41bea186fe4ffd389f9da0c7522f55906010b5d7568121faec80cb1e4a 🔍 |
| VirtualSize | 0x3e4 |
| VirtualAddress | 0xb000 |
| SizeOfRawData | 0x400 |
| PointerToRawData | 0x8400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.09156 |
.rsrc
| MD5 | 907ba914179aec7a92e11d489fc8776f 🔍 |
|---|---|
| SHA1 | 5e3ae8e42e37f2551a8c4f0290343a374a173659 🔍 |
| SHA256 | 4f3f9c022e44b9d315c172724849331bc9223ac07ebef2d6b7a44215c6d72295 🔍 |
| SHA3 | 8d1b71e7aee41130063ea57c598a258008d328b3a9cbe86e7a7b92c9416b787c 🔍 |
| VirtualSize | 0xb578 |
| VirtualAddress | 0xc000 |
| SizeOfRawData | 0xb600 |
| PointerToRawData | 0x8800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.87971 |
.reloc
| MD5 | 9b43d25252dacf000282eff73870ff88 🔍 |
|---|---|
| SHA1 | 9febfadbbc490cba8b2a412af2dccd3c80c91f38 🔍 |
| SHA256 | ac442ddf519b124c4d12a1ef219495fffba8001b7e00afb37619cdf07dba5354 🔍 |
| SHA3 | 253230b54cfc825cb0abd941e0cb8b9fede1c26073b07f16b932e2deffb45358 🔍 |
| VirtualSize | 0x64 |
| VirtualAddress | 0x18000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x13e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 1.31606 |
Imports
| KERNEL32.dll |
GetModuleHandleW
RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess OutputDebugStringW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead DeleteCriticalSection GetLastError GetTickCount64 FormatMessageW Sleep InitializeCriticalSection IsProcessorFeaturePresent RtlCaptureContext |
|---|---|
| USER32.dll |
GetCursorInfo
GetForegroundWindow UnhookWindowsHookEx TrackPopupMenu RegisterClassExW CreatePopupMenu CallNextHookEx GetIconInfo GetMessageW DefWindowProcW keybd_event DispatchMessageW DestroyMenu TranslateMessage LoadIconW LoadCursorW SetWindowsHookExW AppendMenuW PostQuitMessage SetForegroundWindow GetCursorPos SendInput GetWindowTextW CreateWindowExW |
| GDI32.dll |
DeleteObject
|
| SHELL32.dll |
Shell_NotifyIconW
|
| MSVCP140.dll |
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z _Thrd_id ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_join |
| gdiplus.dll |
GdiplusStartup
GdiplusShutdown |
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
memcmp
memcpy memset __current_exception_context __C_specific_handler _CxxThrowException __std_exception_destroy __current_exception __std_exception_copy memmove |
| api-ms-win-crt-utility-l1-1-0.dll |
rand
srand |
| api-ms-win-crt-string-l1-1-0.dll |
wcscpy_s
towlower |
| api-ms-win-crt-runtime-l1-1-0.dll |
_register_onexit_function
_crt_atexit terminate _seh_filter_exe _set_app_type _initialize_onexit_table _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _initialize_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _beginthreadex _invoke_watson _cexit |
| api-ms-win-crt-time-l1-1-0.dll |
_time64
|
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
free _callnewh _set_new_mode |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__p__commode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0xb13 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.44324 |
| Detected Filetype | PNG graphic file |
| MD5 | 1ce23e64f672075f8f7c400c9bd6041b 🔍 |
| SHA1 | 3bdfc1e03558f957642e628cf4162b31003f79c9 🔍 |
| SHA256 | 59606f95415218da016b3035d6db01aef99009c32cbb9225295161e9cbde599e 🔍 |
| SHA3 | add26c08f3ffbc637c4b77007e818d8d951c1b17b6f61de14dc7e5170e954bfe 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0xea8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.1435 |
| MD5 | 189290b41b0200d3db39f5b3ec36651c 🔍 |
| SHA1 | 9ae2e42a0ab1331b8f3e2e548b3f5817a163afec 🔍 |
| SHA256 | 9282ef76bd7caf21b082ec5372036737a274f4dcde6754b44a14e82f7fc44250 🔍 |
| SHA3 | b82a835b1d7c7e766eede21ce7ea55cd9bd22012387e2c294b38e4fba8ba7f93 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x8a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.94956 |
| MD5 | fb95a365a1ee49110e485a8108cc7031 🔍 |
| SHA1 | 7bad9c9c7cfb9633e3dbacea46f93a8b7ed10b0b 🔍 |
| SHA256 | 0f21d4638acea2a29935821118a405870571395ae6ade17d42acdfd14d926d48 🔍 |
| SHA3 | e08eec78c4059597ea3f2ba587f1ed76d40b17a7c2ad2a48d87883580dff2f5e 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x568 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.24329 |
| MD5 | d047fe5b5de7804fd51e94c0ebe5eb85 🔍 |
| SHA1 | 86534c95921c9d7de830d794a9ce7a323bc1f1f7 🔍 |
| SHA256 | 3cf96c4d0f81d50f1ecde1534f7945a48ff5b19c8d0b271647385b0dda219919 🔍 |
| SHA3 | fabba4df69274549d2b97a14c7141d8dd00639bc1376c9eeb1975f41fe913c34 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0xc4a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.48246 |
| Detected Filetype | PNG graphic file |
| MD5 | 75d0bb3e12ffa3e006b986a9fedd2831 🔍 |
| SHA1 | e1ba09265cbed09b97b21663216f4e909e04564b 🔍 |
| SHA256 | 0b47c4dbebef9b67af29ce925d575a67b12c998e8d6790f938b262477fd75a74 🔍 |
| SHA3 | aca08adf8b975e6d95af5b91f1114911d9f7f553ee48f5f73eea11273494fd14 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.58277 |
| MD5 | 11757d954e40b2315f3bb6a9cb1c943e 🔍 |
| SHA1 | ce29a68a5e3026476109b0701099622b29b7e1f7 🔍 |
| SHA256 | c47e69dfa46836e856531e341cbbe649d011400e16e1af2bc1a854d648937fe1 🔍 |
| SHA3 | 6124710d6e2307157adf58dfe73084aa1a796f4198e668a53aa6280b969dc18e 🔍 |
7
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.68512 |
| MD5 | a211f3bb1218cbee5c7945f786562bbf 🔍 |
| SHA1 | f34612364f9dcbefad2b8ef655e8817f4596e0f1 🔍 |
| SHA256 | e133a3834f112a6b436ca01cf5be9762b09ef5903c3a3b4ee713687dbc77e12c 🔍 |
| SHA3 | 32c9b25b935fb3377a6a15867156e96761481dbfd03ee1791889cd69d3431a3a 🔍 |
8
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.69717 |
| MD5 | 13bf0ad224aa92959c290695ee6e0489 🔍 |
| SHA1 | b3f04aa1794966baa46100db7e78913efaad0a5d 🔍 |
| SHA256 | 8d33b5052feadd6b5970af4783ee1ec4a9d24942b7732e98ec7e9f8aaf983533 🔍 |
| SHA3 | 79c87823fa5fa081f0cbffd82f1374277484d3547b9d9d5446513bcfe2c92b6c 🔍 |
9
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.87024 |
| MD5 | 73b3723dc6f30ffe65a51dcd831b6bb3 🔍 |
| SHA1 | f58f88de5d012d614aba5c93eab0a5af40738af5 🔍 |
| SHA256 | 1f5e6628a542770910dddfe17bdc51fe41afbe5c00318202f56854f51746f7e8 🔍 |
| SHA3 | e29c76056b319d2f9823399069dd1fff5fdd79fd9c1fa60d91c5295cea551011 🔍 |
101
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x84 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.82974 |
| Detected Filetype | Icon file |
| MD5 | 294ab360df500fd60631028b4cc015ae 🔍 |
| SHA1 | fc8dbab961cff601576daac34033564bc38eecd9 🔍 |
| SHA256 | ad57f89a9b22d0efe84c013775dc0b4aac1101172d241e2dad833c4c1150f0b3 🔍 |
| SHA3 | 6bec613cc96c6865e5e0bbad3ac5b995b94a1548fd3b29d665eaafa404746f89 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-May-18 09:42:55 |
| Version | 0.0 |
| SizeofData | 87 |
| AddressOfRawData | 0x8000 |
| PointerToRawData | 0x6a00 |
| Referenced File | C:\Users\YMH\source\repos\c\Project2\x64\Release\é¼ ä¸æ¦.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-May-18 09:42:55 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x8058 |
| PointerToRawData | 0x6a58 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-May-18 09:42:55 |
| Version | 0.0 |
| SizeofData | 780 |
| AddressOfRawData | 0x806c |
| PointerToRawData | 0x6a6c |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-May-18 09:42:55 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14000a040 |
RICH Header
| XOR Key | 0xce5a5b20 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| ASM objects (34918) | 3 |
| C objects (34918) | 10 |
| C++ objects (34918) | 28 |
| Imports (34918) | 6 |
| Imports (33140) | 11 |
| Total imports | 128 |
| C++ objects (LTCG) (35207) | 1 |
| Resource objects (35207) | 1 |
| 151 | 1 |
| Linker (35207) | 1 |
Errors
Leave a comment
No comments yet.