3c4aec9f17f8082b4a51da5230646cfabf54b13aeef8fa06220bf0ac21ebc882

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Detected languages English - United States
CompanyName Operation Skira
FileDescription Automated seeding companion for Squad
FileVersion 1.2.10.0
InternalName SkiraSeedHelper
LegalCopyright Copyright (c) 2026 Operation Skira
OriginalFilename SkiraSeedHelper.exe
ProductName Skira Seed Helper
ProductVersion 1.2.10.0

Plugin Output

Suspicious PEiD Signature: XWD graphics format
HQR data file
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentVersion\Run
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • StatAtoi.com
  • github.com
  • golang.org
  • https://go.dev
  • https://stats.operationskira.com
  • https://stats.operationskira.com/api/public/seed/statusPending
  • https://stats.operationskira.comStart
  • operationskira.com
  • stats.operationskira.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .symtab
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
Suspicious VirusTotal score: 2/70 (Scanned on 2026-09-16 22:39:48) Bkav: W32.Malware.BA3E3D5
Sangfor: Trojan.Win32.Save.a

Hashes

MD5 4e47f2e694e858e7d24c3a246c938771 🔍
SHA1 8778d3e812a3fe1e761757fc8eeb2ecb059cd441 🔍
SHA256 3c4aec9f17f8082b4a51da5230646cfabf54b13aeef8fa06220bf0ac21ebc882 🔍
SHA3 08b0ce0bdf2bf3c7ed79d5d4be7b7ad4cea32b2fd60754e80c8ce4dcbf9a4885 🔍
SSDeep 49152:RfEVW+v8nIf4J+BUnEcqBP2ub5CNYPSesPYtWpxKGIWtpjFr+pjc+8PDPrK6K5K:RcUAw+BCesvGWvpFDPc/u2a+SYE 🔍
Imports Hash 4e2bd2c481372f7ab13b83b63b424e97 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0x8b
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0x779600
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 3.0
SizeOfCode 0x34d200
SizeOfInitializedData 0x9fe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000089F20 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion A.0
ImageVersion 1.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0x2819000
SizeOfHeaders 0x600
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0f810c8499ecdc794a9e8ab4e4d4b297 🔍
SHA1 da33660e768addc83f469bc53f48f4613b362dda 🔍
SHA256 439d772b1fe4a7decac4034a5d6d8ff91cde152b15dca7159fba3928ba00077c 🔍
SHA3 ef9de3a0fffed25cd3bb8fb3f1037b391ea7c3b7aed88e9e26c834cc71444152 🔍
VirtualSize 0x34d051
VirtualAddress 0x1000
SizeOfRawData 0x34d200
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.20815

.rdata

MD5 df13004162bf5de20ffad48d2345e4c9 🔍
SHA1 e3610ced8a991401f14e5444aed5ea5f75af6924 🔍
SHA256 8880ed18649d1400adbc05a5d28042cfb3308e8ad06ea9494f0ff75261b7fa24 🔍
SHA3 707ef641769a300b4d3559408dbb9c2eca4faed8b5901ff02491762e09b5d28d 🔍
VirtualSize 0x3685b0
VirtualAddress 0x34f000
SizeOfRawData 0x368600
PointerToRawData 0x34d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.72864

.data

MD5 0600c62bfb016747ae5e589b6aa5aa5e 🔍
SHA1 72c4d2e5a6a99eabb8fe313d8785dfb978b0fcc0 🔍
SHA256 0b1ed63ae67a8f4a919414774c605b87468fe48c3607e5480a197265a188f8d0 🔍
SHA3 7c6f779111c92a0fdd3e7048822925c431d83dc3cfaec2349cc366bf0e191bf4 🔍
VirtualSize 0x20f6dd8
VirtualAddress 0x6b8000
SizeOfRawData 0x9fe00
PointerToRawData 0x6b5e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.92458

.pdata

MD5 ffd7da9d72d83db3691c01b62c971d89 🔍
SHA1 ffc6522d1a0dae4d0897cfc3a27d4ac04e9e817e 🔍
SHA256 407ef7e7484c3b7ae4d7f7f47e0b6f39e253d0778419c0856e3744765a057b15 🔍
SHA3 8fded32ed212934880a3eda7c96d23357b73c65057c373bb09365e904953271e 🔍
VirtualSize 0x12dbc
VirtualAddress 0x27af000
SizeOfRawData 0x12e00
PointerToRawData 0x755c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.64596

.xdata

MD5 201e5143bc889288c4083e584b54c207 🔍
SHA1 fa8eb5d24862252971ee8f547dd82e1cdf8728fb 🔍
SHA256 076dee168a8aa864a7bafe6ade22789c9fcecf01c2f1445eca825655783b432b 🔍
SHA3 2c19feef24cab3bc70a5606c1adabe037071bab01358f6ea429143f230125a36 🔍
VirtualSize 0xb4
VirtualAddress 0x27c2000
SizeOfRawData 0x200
PointerToRawData 0x768a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.78173

.idata

MD5 eb78cba0d34289a6eab1f91fb826f5f2 🔍
SHA1 4c0eb8f6078c82d22a3d5487e941674dc336421d 🔍
SHA256 afd08d78e5688c5c2982d81d424a34fbce594b2e59a8dbdb6ec7f3b9105be3a7 🔍
SHA3 090aad00e1b6fcdfba40e2388bb0fe59662b8d4133213e40cfdb3de736fe55f0 🔍
VirtualSize 0x57c
VirtualAddress 0x27c3000
SizeOfRawData 0x600
PointerToRawData 0x768c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.30985

.reloc

MD5 3add3a789f26a51176c5a9f25880f7ed 🔍
SHA1 e9de15cf1a3442f376f692c7762b994d119dbba6 🔍
SHA256 82083521a1a33b40dce86539fbc62bbc70387ecb5e8a0f3055ccbf4f05766f22 🔍
SHA3 c8018e0a46f007d627cf5c98c8a7abfd1ff0db844faa6c46a2c324ce507fe4de 🔍
VirtualSize 0x10270
VirtualAddress 0x27c4000
SizeOfRawData 0x10400
PointerToRawData 0x769200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.45304

.symtab

MD5 07b5472d347d42780469fb2654b7fc54 🔍
SHA1 943ae54f4818e52409fbbaf60ffd71318d966b0d 🔍
SHA256 3e67f4a7d14b832ff2a2433e9cf0f6f5720821f67148a87c0ee2595a20c96c68 🔍
SHA3 a70a3e18515c06557b62676f2a8eb6d7d41962d8c9c7c49f4641c429cc65b977 🔍
VirtualSize 0x4
VirtualAddress 0x27d5000
SizeOfRawData 0x200
PointerToRawData 0x779600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0203931

.rsrc

MD5 5ad7f589ec8e122560e79f37ada106c5 🔍
SHA1 a04f6ba1e38b2f04069756cf0493dd81cc86fbe8 🔍
SHA256 9644419e8024d62693ff20c7413e08091900745c2ceb80091dafa99801d67878 🔍
SHA3 6f25bfb16bdb9f3cf368890963b68f51a2b0d344daba1d8fb1d80c652a0718b1 🔍
VirtualSize 0x42960
VirtualAddress 0x27d6000
SizeOfRawData 0x42a00
PointerToRawData 0x779800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.81178

Imports

kernel32.dll WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
GetProcAddress
LoadLibraryExW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x42108
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.75307
MD5 dc4ce7e08ed5a4cea7023b47067e293f 🔍
SHA1 c585be548014ea6e4d853836d1e35eabd13070d2 🔍
SHA256 71583409c6a16c129b5bb5158f0997c7c39748908f3c113172e6958d97b5cce7 🔍
SHA3 2cd84893c99db98fdbde13f0905e2e921e53b82de120e724fcdfaadae3ef966b 🔍

APP

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.77095
Detected Filetype Icon file
MD5 6c493adbaf26f027e1d72e3cbb09f61f 🔍
SHA1 ba60811370c6529e7daf5fe1a28280bc1e8900e5 🔍
SHA256 c4c7969f75b3e1f78fae7e5b7d8f276b9fb5ad50a6ce9b80014818357224b876 🔍
SHA3 f32faf460da64ca77d96ae354190ee9e886b802743dae8bd086eab779b186d54 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x33c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39587
MD5 d9cfd09bb1b231233796971c42f9eba3 🔍
SHA1 e292dd98a90fe25cd0340cbf7407970af045d935 🔍
SHA256 63f0636a35fe1bc977be15dbacb02607192f76a9d568895458d96ef886b0e147 🔍
SHA3 74a05b0cb1774eb0919f2620567737b9a10c76bb74353a4baa60583e6563d364 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x3c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.05667
MD5 edf5047315843df92f2367efaaa8455b 🔍
SHA1 5c29b47a345acbe90c37b0e009995b5a114dd828 🔍
SHA256 2d5ff97c779f6d8119de169ca0bf9d74ffdfe490a0d45ac53e90c6f3aa4322f3 🔍
SHA3 7882b10bfcbf6661eaa73cbf7d23d84f0a7def25eab328d9ff66ed294ec5b8ea 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.2.10.0
ProductVersion 1.2.10.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Operation Skira
FileDescription Automated seeding companion for Squad
FileVersion (#2) 1.2.10.0
InternalName SkiraSeedHelper
LegalCopyright Copyright (c) 2026 Operation Skira
OriginalFilename SkiraSeedHelper.exe
ProductName Skira Seed Helper
ProductVersion (#2) 1.2.10.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0

RICH Header

Errors

Leave a comment

No comments yet.