349d04717f051421a2d33af56cb18241
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2025-Aug-26 07:33:47 |
| Detected languages |
English - United States
|
| Debug artifacts |
E:\Projects\shiroTools\hashlink\src\x64\Release\hl.pdb
|
Plugin Output
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2025-Aug-26 07:33:47 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x19a00 |
| SizeOfInitializedData | 0x60e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000019FC0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x82000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
.reloc
Imports
| libhl.dll |
hl_alloc_dynamic
hl_to_virtual hlt_dyn hl_alloc_virtual hl_assert hl_dyn_casti64 hl_alloc_buffer hl_field_name hl_buffer_content hl_dyn_call hl_socket_recv hl_socket_listen hl_get_thread hl_socket_bind hl_gc_threads_info hl_remove_root hl_dyn_setf hl_thread_start hl_sys_sleep hl_socket_send hl_socket_init hl_setup_reload_check hl_socket_accept hl_add_root hl_closure_stack_capture hl_pad_struct hl_socket_close hl_alloc_init hl_from_utf8 hlt_void hl_zalloc hl_hash_gen hl_free hl_detect_debugger hl_malloc hl_global_init hl_sys_time hl_dyn_setd hlt_f64 hl_dyn_call_safe hl_print_uncaught_exception hl_global_free hl_setup_profiler hl_init_virtual hl_obj_field_fetch hl_same_type hl_free_executable_memory hl_gc_set_dump_types hl_setup_vtune hl_setup_exception hl_to_utf8 hl_fatal_fmt hl_make_dyn hl_flush_proto hl_alloc_obj hl_prim_not_loaded hl_init_enum hl_hash_utf8 hl_dyn_geti64 hl_is_dynamic hl_dyn_castf hl_dyn_getf hl_setup_callbacks2 hl_alloc_dynobj hl_dyn_call_obj hl_dyn_compare hl_sys_init hl_type_size hl_buffer_str hl_dyn_getd hl_dyn_geti hl_rethrow hl_alloc_strbytes hl_alloc_closure_ptr hl_register_thread hl_dyn_castp hl_dyn_setp hl_throw hl_setup_longjump hlt_bytes hl_dyn_seti hl_dyn_casti hl_dyn_castd hl_alloc_dynbool hl_dyn_getp hl_dyn_seti64 hl_sys_getpid hl_fatal_error hl_alloc_executable_memory hl_get_obj_rt hl_socket_new hl_alloc_enum hl_utf8_length |
|---|---|
| USER32.dll |
MessageBoxA
|
| KERNEL32.dll |
RtlLookupFunctionEntry
LoadLibraryA GetProcAddress SuspendThread ResumeThread CloseHandle GetThreadContext OpenThread GetEnvironmentVariableA LoadLibraryExA GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind QueryPerformanceCounter RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId FreeLibrary |
| VCRUNTIME140.dll |
__C_specific_handler
__intrinsic_setjmp __current_exception __current_exception_context memset memcmp strstr memcpy |
| api-ms-win-crt-stdio-l1-1-0.dll |
__acrt_iob_func
__p__commode _set_fmode fwrite fopen __stdio_common_vswprintf fflush fread _wfopen fseek __stdio_common_vfwprintf fclose ftell __stdio_common_vsprintf __stdio_common_vfprintf |
| api-ms-win-crt-heap-l1-1-0.dll |
free
malloc _set_new_mode |
| api-ms-win-crt-runtime-l1-1-0.dll |
_register_onexit_function
_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit _crt_atexit __p___argc _exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe terminate __p___wargv exit |
| api-ms-win-crt-math-l1-1-0.dll |
fmod
__setusermatherr fmodf |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_wstat32
|
| api-ms-win-crt-convert-l1-1-0.dll |
wcstol
wcstombs |
| api-ms-win-crt-environment-l1-1-0.dll |
getenv
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
Delayed Imports
AmdPowerXpressRequestHighPerformance
| Ordinal | 1 |
|---|---|
| Address | 0x200ac |
NvOptimusEnablement
| Ordinal | 2 |
|---|---|
| Address | 0x200a8 |
1
2
3
4
5
6
7
8
9
1 (#2)
1 (#3)
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Aug-26 07:33:47 |
| Version | 0.0 |
| SizeofData | 79 |
| AddressOfRawData | 0x1d1a0 |
| PointerToRawData | 0x1bfa0 |
| Referenced File | E:\Projects\shiroTools\hashlink\src\x64\Release\hl.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Aug-26 07:33:47 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x1d1f0 |
| PointerToRawData | 0x1bff0 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Aug-26 07:33:47 |
| Version | 0.0 |
| SizeofData | 660 |
| AddressOfRawData | 0x1d204 |
| PointerToRawData | 0x1c004 |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Aug-26 07:33:47 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
Load Configuration
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140020078 |
RICH Header
| XOR Key | 0x4ae8557e |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| Imports (30034) | 2 |
| 253 (28518) | 1 |
| C++ objects (30034) | 18 |
| C objects (30034) | 9 |
| ASM objects (30034) | 2 |
| C objects (VS2022 Update 1 (17.1.4-5) compiler 31106) | 1 |
| Imports (33140) | 4 |
| Imports (30159) | 3 |
| Total imports | 176 |
| C objects (LTCG) (30159) | 6 |
| Exports (30159) | 1 |
| Resource objects (30159) | 1 |
| Linker (30159) | 1 |
Errors
[*] Warning: Please edit the configuration file with your VirusTotal API key.
[!] Error: Could not load yara_rules/bitcoin.yara!
[!] Error: Could not load yara_rules/monero.yara!
[!] Error: Could not load yara_rules/compilers.yara!
[!] Error: Could not load yara_rules/findcrypt.yara!
[!] Error: Could not load yara_rules/suspicious_strings.yara!
[!] Error: Could not load yara_rules/domains.yara!
[!] Error: Could not load yara_rules/peid.yara!