3f0325be29610d3cb5530d6ee07ea53cf989ad549e0b80cd0254a121acfa7e5b

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Sep-14 10:04:03

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA256
Uses constants related to AES
Uses constants related to Blowfish
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Manipulates other processes:
  • OpenProcess
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 d6c685d420c42f9886dc6c280cb7eefe 🔍
SHA1 2a02a157a68f73b457c144b8ee64ad1958732d6c 🔍
SHA256 3f0325be29610d3cb5530d6ee07ea53cf989ad549e0b80cd0254a121acfa7e5b 🔍
SHA3 04d06fa05aaea394b351c3e40df4ea405951bb6f52e1195e773365800b3944a2 🔍
SSDeep 196608:zMyDBgUKCp/rxfK31qyC+s9sWJFgp56yp8DzbuiOuqq:zMy9gQ/Gq973JFu+TKbq 🔍
Imports Hash 1eda8dec81f9e2b3a55313b798e5343a 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-14 10:04:03
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x23c00
SizeOfInitializedData 0x6d0c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000CF6C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x723000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ec585774fb5333501ee407dcd5b140e0 🔍
SHA1 79fe6601b8c00c9cf6871f7f37cd014e1ffdf8a2 🔍
SHA256 f48e0133e3021431014ab42db238be1861ec86edb389d95a6e2b436e126e4d08 🔍
SHA3 f65eb1041017c98f2773ff3bbb4450b2fe5e3bccb7238dcd02533cb3e269b2e8 🔍
VirtualSize 0x23ba0
VirtualAddress 0x1000
SizeOfRawData 0x23c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51884

.rdata

MD5 1bc7526ca0ba5e293f82d2393a6ece96 🔍
SHA1 2face33c1a9551cdbf46a88e6b3e39dff4611b98 🔍
SHA256 4dd640b2ba4c0c425282394ed0b997eb165dac6223d8aa891d0720c306d867a6 🔍
SHA3 9d1cfe5c8c3c2aaeaecb77fa408d83133d79578b47c80933dd57f95841c24360 🔍
VirtualSize 0x6cd482
VirtualAddress 0x25000
SizeOfRawData 0x6cd600
PointerToRawData 0x24000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99665

.data

MD5 a0ea5ea56673ee2cfbe01b67ebd1b238 🔍
SHA1 7ea142f0de0b8073cb3f99e8059d29ffab87d17c 🔍
SHA256 df7bccde11c9dc6872d69559417371d23804964933760c0922b9a5b963019ec1 🔍
SHA3 2879ef2e2bcd42c292a53f92f15f69ed143f51db044c537bdb7f52c595cd4681 🔍
VirtualSize 0x2a570
VirtualAddress 0x6f3000
SizeOfRawData 0xc00
PointerToRawData 0x6f1600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.96066

.pdata

MD5 5dab4999f3bfae6b69dc8ee35480d5c4 🔍
SHA1 6ae1a7d143aaaf4fc58d7e9957329183bc3e99d3 🔍
SHA256 6a05f8c60b2c916e2fbeee4733038becca573ab848539089311ed5cb81892f33 🔍
SHA3 2bc8e5bfaed7075485e9cd8f5d0d9533b0f7c2b062a899a8ff9de5bc0e51f5c7 🔍
VirtualSize 0x19a4
VirtualAddress 0x71e000
SizeOfRawData 0x1a00
PointerToRawData 0x6f2200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.33227

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x720000
SizeOfRawData 0x200
PointerToRawData 0x6f3c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 1690e7124615d98404e9f753e4577b98 🔍
SHA1 c663321ddaa0ea4fefcb450e93b997631791adf1 🔍
SHA256 fc5ef71f6debf39b410266c2df3e8a5f0974cd5c222965c304ae353d31695abe 🔍
SHA3 b51fa514b6468d7f78256b436031147e2ba677f00f638c4db0544f72b5678b5d 🔍
VirtualSize 0x54c
VirtualAddress 0x721000
SizeOfRawData 0x600
PointerToRawData 0x6f3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.53278

.reloc

MD5 e48380ce2bde74740c8e7cd1c20ebf5d 🔍
SHA1 04b450a25a99cf4f195127e581300a2f7b810e1a 🔍
SHA256 f02308441739eeda5a5fb3b5b0cd02e0f1dbd0b902fddb5dbaf1d556c1dd9b1e 🔍
SHA3 0a917a1adc73c94fac968f09ce44f57c2660bbfa1629c11886b907955291d751 🔍
VirtualSize 0x690
VirtualAddress 0x722000
SizeOfRawData 0x800
PointerToRawData 0x6f4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.98624

Imports

SHELL32.dll SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
KERNEL32.dll WriteConsoleW
HeapReAlloc
CreateDirectoryW
SetConsoleCtrlHandler
AddDllDirectory
GetCommandLineW
GetFullPathNameW
GetStdHandle
WriteFile
GetShortPathNameW
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
K32GetModuleFileNameExW
GetEnvironmentVariableW
GetTempPathW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
OpenProcess
Sleep
GetLastError
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GetSystemTimeAsFileTime
FormatMessageA
QueryPerformanceCounter
SetDllDirectoryW
LoadLibraryExW
GetExitCodeProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
HeapSize
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapAlloc
MultiByteToWideChar
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetFileType
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx

Delayed Imports

1

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4f1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27584
MD5 9175a1fabff80fec23018fdfc1dc274b 🔍
SHA1 be8f32edef4e9f4aa514fa34f36ca9ee0204139b 🔍
SHA256 94b146eac0a80f5089ac9e57303515ddf9087d9d88fd4d47f27df8f3cf14cbb4 🔍
SHA3 934768e038a5727d347f31840aaab3de69c96e1d4bca3c9e726bae6be020edf3 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-14 10:04:03
Version 0.0
SizeofData 800
AddressOfRawData 0x6efb68
PointerToRawData 0x6eeb68

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1406f3000

RICH Header

XOR Key 0xa191d112
Unmarked objects 0
C++ objects (33145) 147
C objects (33145) 12
ASM objects (33145) 9
253 (35207) 2
ASM objects (35207) 9
C objects (35207) 16
C++ objects (35207) 40
Imports (33145) 5
Total imports 120
Unmarked objects (#2) 1
C objects (LTCG) (35228) 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.