Manalyze report for 4d5d7315c73e323c731b1287548a7829ac105a27831ca06b34155e491a3576a2

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	1970-Jan-01 00:00:00
TLS Callbacks	3 callback(s) detected.

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: .xdata`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryW` `Leverages the raw socket API to access the Internet: WSAGetLastError WSAStartup htons inet_pton recv sendto socket` `Enumerates local disk drives: GetVolumeInformationA` `Manipulates other processes: OpenProcess`
Suspicious	VirusTotal score: 1/68 (Scanned on 2026-07-23 04:39:12)	`Bkav: W32.Malware.3BD10B76`

Hashes

MD5	`2e950beb09b39ebe86153de6bc528c8f`
SHA1	`c3a58ae122478f1bf305f9ba98c806e75ad4953f`
SHA256	`4d5d7315c73e323c731b1287548a7829ac105a27831ca06b34155e491a3576a2`
SHA3	`8dccb23d2d30f2fa531479b0a0a411f6cd5f11341ba0df4ab5576eecc56500cf`
SSDeep	`12288:39Iam9nW9ccSk+u2mIwky7kCSLkomNpwX75G7uGa:39Iam9tEL2Ak3cpwXA7u`
Imports Hash	`967100d9df5f3d5c4790235494e012e4`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x74200`
SizeOfInitializedData	`0x2e400`
SizeOfUninitializedData	`0x1e00`
AddressOfEntryPoint	`0x00000000000011AD (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x3bd7b0000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xac000`
SizeOfHeaders	`0x400`
Checksum	`0xa4b19`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`09e45c83d734351459b611f0f2b5dce9`
SHA1	`583ba1b032b5f530ce055edd019888bc39b03464`
SHA256	`b4a67acff58f92afe49a0a5fe59163f1e5799cb7c3a800768ba10e2dc69afeec`
SHA3	`0d9752750672b08dd91dd930fac420aa8f3afdbbb20f52c27dd5a0c8a2154658`
VirtualSize	`0x74020`
VirtualAddress	`0x1000`
SizeOfRawData	`0x74200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.15008`

.data

MD5	`3c65fe3bdd4d3537c51d8cd27d78848e`
SHA1	`4a5c13c81c50f13efc88e40bd17c5a04be434069`
SHA256	`d450e412fb1c5f528138bea9d994ba3ae92cdd91473597f6d5eb4d9ef66bc787`
SHA3	`df9424d6546f9e509d6f0cff49db96a769be9386cb8c332ae9cfd83688c2b082`
VirtualSize	`0x2100`
VirtualAddress	`0x76000`
SizeOfRawData	`0x2200`
PointerToRawData	`0x74600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.561094`

.rdata

MD5	`c4ba746adb230b00319c8eea0bd6b4d3`
SHA1	`4f3de4d0ff610c6148214e9aefad7703b7a1c2d7`
SHA256	`52650ea8d4dc8031c6d58cf25c9d4fc2888c0b91bf236d60cbd2332b09cdc30c`
SHA3	`1bdf2956ef47c42fd6b5619c32ee6e8265825a08876cee701dea2f3fb7ad21d8`
VirtualSize	`0xf550`
VirtualAddress	`0x79000`
SizeOfRawData	`0xf600`
PointerToRawData	`0x76800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.67794`

.pdata

MD5	`73c6cdd4558c67924bded3ed889a5d76`
SHA1	`7ec5e2bdcfdb733a69445b08a0723e02613db9df`
SHA256	`1bc17881756f48360707df60f33b57e8e55462511100d273842ab911fc680684`
SHA3	`36d2a3e66ff2caaa831cff21a0795ee6a899083bff9aaa65b6de57ec2917956b`
VirtualSize	`0xc78c`
VirtualAddress	`0x89000`
SizeOfRawData	`0xc800`
PointerToRawData	`0x85e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.90736`

.xdata

MD5	`45bac523959b55eabed2d8054eba980d`
SHA1	`4052195996160bcbc49d173f815abe2b96c44156`
SHA256	`73673f0ddbba096d04178475cdb81debb1a2c5dce745afee4119b8ea91dd5cc0`
SHA3	`355cf066ab7e66271bd9a90317b3f85b6ed0e27ef47ddfe28b47366029388944`
VirtualSize	`0xd640`
VirtualAddress	`0x96000`
SizeOfRawData	`0xd800`
PointerToRawData	`0x92600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.52733`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x1ce0`
VirtualAddress	`0xa4000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`821e1b8b93da707bc1a9dc6c66c9effe`
SHA1	`0ffbfb71df3505b2ebbcd182bcce6ff1832eab0c`
SHA256	`a1b978ad8cc06b3f58b6bf06bc500e1e6bedb9ea9e96afc0b72cb7178a484036`
SHA3	`3453c724067e39f698dbc5fa8bf8fc14d01b58cbf9c936f8a20225515f8beefc`
VirtualSize	`0x59`
VirtualAddress	`0xa6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x9fe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.944903`

.idata

MD5	`834feffdb398d335579afeef3221d438`
SHA1	`ae66f1f4433cc7bb26a44ca5ffb513e48f39b3f6`
SHA256	`5b7fa425032052beff7ef7bbc57e463d6d5432a99369e7b67b6ecf5d32ce1986`
SHA3	`48329a7c719e96f900d19306c3c4459f0b774ed976c0bda883d0bc331f1019f8`
VirtualSize	`0x115c`
VirtualAddress	`0xa7000`
SizeOfRawData	`0x1200`
PointerToRawData	`0xa0000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.9167`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59`
VirtualSize	`0x10`
VirtualAddress	`0xa9000`
SizeOfRawData	`0x200`
PointerToRawData	`0xa1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`e3b06fdefafcb2d069ec9db00db006df`
SHA1	`c6badb9d08462648cd4f80c627debe3ecd2ea890`
SHA256	`d3ede33ba0550a177d5025def1a9eac777f8324c5100e3814dc18ceabec71111`
SHA3	`e1cfe316b47c71bae3d5783231930c1114462d3f8b5f177af739888d1d43ed95`
VirtualSize	`0x1580`
VirtualAddress	`0xaa000`
SizeOfRawData	`0x1600`
PointerToRawData	`0xa1400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.41416`

Imports

KERNEL32.dll	`CloseHandle` `CreateEventA` `CreateSemaphoreA` `DeleteCriticalSection` `DuplicateHandle` `EnterCriticalSection` `FormatMessageA` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetHandleInformation` `GetLastError` `GetLocalTime` `GetModuleHandleA` `GetProcAddress` `GetProcessAffinityMask` `GetSystemTimeAsFileTime` `GetThreadContext` `GetThreadPriority` `GetTickCount` `GetVolumeInformationA` `InitializeCriticalSection` `IsDBCSLeadByteEx` `IsDebuggerPresent` `LeaveCriticalSection` `LoadLibraryW` `LocalFree` `MultiByteToWideChar` `OpenProcess` `OutputDebugStringA` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `ReleaseSemaphore` `ResetEvent` `ResumeThread` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetEvent` `SetLastError` `SetProcessAffinityMask` `SetThreadContext` `SetThreadPriority` `Sleep` `SuspendThread` `TlsAlloc` `TlsGetValue` `TlsSetValue` `TryEnterCriticalSection` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WaitForSingleObject` `WideCharToMultiByte`
msvcrt.dll	`___lc_codepage_func` `___mb_cur_max_func` `__iob_func` `_amsg_exit` `_assert` `_beginthreadex` `_endthreadex` `_errno` `_initterm` `_lock` `_setjmp` `_unlock` `_vscprintf` `_vsnprintf` `_vsnwprintf` `abort` `calloc` `fclose` `fflush` `fgets` `fgetwc` `fopen` `fprintf` `fputc` `fputs` `free` `getc` `getenv` `iswctype` `localeconv` `longjmp` `malloc` `memchr` `memcmp` `memcpy` `memmove` `memset` `realloc` `setlocale` `strchr` `strcmp` `strcoll` `strcpy` `strerror` `strftime` `strlen` `strncmp` `strtoul` `strxfrm` `towlower` `towupper` `vfprintf` `wcscoll` `wcsftime` `wcslen` `wcsxfrm` `_strdup` `_read`
WS2_32.dll	`WSAGetLastError` `WSAStartup` `htons` `inet_pton` `recv` `sendto` `socket`

Delayed Imports

GetVer

Ordinal	`1`
Address	`0x1d70`

Init

Ordinal	`2`
Address	`0x1d80`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x3bd859000`
EndAddressOfRawData	`0x3bd859008`
AddressOfIndex	`0x3bd85514c`
AddressOfCallbacks	`0x3bd838520`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x00000003BD7B75BF` `0x00000003BD7B75B0` `0x00000003BD7C13BA`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.