| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Feb-09 16:34:14 |
| TLS Callbacks | 1 callback(s) detected. |
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Feb-09 16:34:14 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x77cc00 |
| SizeOfInitializedData | 0x224c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000077D098 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x9a5000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| crypt32.dll |
CertEnumCertificatesInStore
CertGetCertificateChain CertCloseStore CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateStore CertDuplicateCertificateContext CryptUnprotectData CertDuplicateCertificateChain |
|---|---|
| kernel32.dll |
CopyFileExW
DeviceIoControl GetModuleHandleA WriteFileEx ReadFileEx GetSystemTimePreciseAsFileTime GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetFilePointerEx FindNextFileW GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW DuplicateHandle FlushFileBuffers UnlockFile VirtualQueryEx LockFileEx GetFileInformationByHandleEx SetFileInformationByHandle GetTickCount64 GlobalMemoryStatusEx CreateFileW FindClose FindFirstFileExW GetLogicalDrives GetFinalPathNameByHandleW GetFullPathNameW CreateDirectoryW HeapFree HeapAlloc HeapReAlloc GetProcessHeap WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle LoadLibraryA SetLastError GetLastError SetHandleInformation GetProcAddress GetModuleHandleW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind DeleteFileW WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex GetCurrentProcess lstrlenW WideCharToMultiByte WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW CreateEventW FormatMessageW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCommandLineW GetEnvironmentStringsW GetFileInformationByHandle SwitchToThread QueryPerformanceFrequency CreateThread CompareStringOrdinal SleepEx QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess GetExitCodeProcess WaitForMultipleObjects CreateProcessW FreeEnvironmentStringsW OpenProcess CreateIoCompletionPort ReadProcessMemory SetFileCompletionNotificationModes GetProcessTimes GetSystemTimes GetProcessIoCounters GetQueuedCompletionStatusEx InitializeSListHead SetUnhandledExceptionFilter ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult GetModuleFileNameW DeleteCriticalSection CloseHandle TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AreFileApisANSI HeapCreate GetCurrentDirectoryW GetTempPathW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW UnmapViewOfFile GetComputerNameExW LocalFree CancelIo GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate |
| advapi32.dll |
RegCloseKey
IsValidSid CopySid LookupAccountSidW GetTokenInformation RegOpenKeyExW RegQueryValueExW OpenProcessToken GetLengthSid |
| ntdll.dll |
NtReadFile
NtOpenFile NtCreateNamedPipeFile NtQuerySystemInformation RtlGetVersion NtWriteFile NtQueryInformationProcess NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile |
| ws2_32.dll |
setsockopt
getsockname getpeername send recv WSASocketW shutdown WSAStartup WSACleanup WSAGetLastError WSAIoctl getsockopt bind ioctlsocket closesocket connect freeaddrinfo WSASend getaddrinfo |
| secur32.dll |
LsaFreeReturnBuffer
LsaGetLogonSessionData LsaEnumerateLogonSessions AcquireCredentialsHandleA DeleteSecurityContext FreeCredentialsHandle EncryptMessage InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW ApplyControlToken FreeContextBuffer DecryptMessage |
| bcryptprimitives.dll |
ProcessPrng
|
| oleaut32.dll |
VariantClear
SysAllocString SysFreeString |
| api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
WakeByAddressSingle WakeByAddressAll |
| user32.dll |
MessageBoxA
|
| psapi.dll |
GetPerformanceInfo
GetModuleFileNameExW |
| shell32.dll |
CommandLineToArgvW
|
| netapi32.dll |
NetUserGetLocalGroups
NetUserGetInfo NetUserEnum NetApiBufferFree |
| pdh.dll |
PdhRemoveCounter
PdhCloseQuery PdhAddEnglishCounterW PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue |
| ole32.dll |
CoSetProxyBlanket
CoUninitialize CoInitializeSecurity CoInitializeEx CoCreateInstance |
| powrprof.dll |
CallNtPowerInformation
|
| iphlpapi.dll |
GetIfEntry2
FreeMibTable GetIfTable2 GetAdaptersAddresses |
| VCRUNTIME140.dll |
__current_exception
__C_specific_handler strrchr __current_exception_context memcmp memcpy __CxxFrameHandler3 memset memmove |
| api-ms-win-crt-string-l1-1-0.dll |
strncmp
strcmp strcspn strlen wcslen |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
calloc _msize free malloc realloc |
| api-ms-win-crt-utility-l1-1-0.dll |
_byteswap_uint64
qsort_s qsort _rotl64 _byteswap_ulong |
| api-ms-win-crt-stdio-l1-1-0.dll |
fflush
__p__commode _set_fmode __stdio_common_vfprintf __acrt_iob_func |
| api-ms-win-crt-time-l1-1-0.dll |
clock
_localtime64_s |
| api-ms-win-crt-runtime-l1-1-0.dll |
_c_exit
terminate _register_thread_local_exe_atexit_callback _wassert _beginthreadex _endthreadex _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _register_onexit_function _initialize_onexit_table _cexit |
| api-ms-win-crt-math-l1-1-0.dll |
_dclass
log __setusermatherr |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Feb-09 16:34:14 |
| Version | 0.0 |
| SizeofData | 792 |
| AddressOfRawData | 0x8cf1d0 |
| PointerToRawData | 0x8ce1d0 |
| StartAddressOfRawData | 0x1408cf508 |
|---|---|
| EndAddressOfRawData | 0x1408cf650 |
| AddressOfIndex | 0x140934f90 |
| AddressOfCallbacks | 0x14077ea70 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001404998E0
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140934840 |
| XOR Key | 0x2b156a41 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| Imports (35403) | 2 |
| ASM objects (35403) | 4 |
| C objects (35403) | 10 |
| C++ objects (35403) | 24 |
| Imports (30151) | 19 |
| C objects (35723) | 41 |
| Total imports | 376 |
| Unmarked objects (#2) | 38 |
| Linker (35723) | 1 |