| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jan-19 02:31:27 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\Administrador\source\repos\Testando\x64\Debug\Testando.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Suspicious | The PE is possibly packed. |
Section .textbss is both writable and executable.
Unusual section name found: .msvcjmc |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 5/65 (Scanned on 2026-05-06 01:39:06) |
CrowdStrike:
win/malicious_confidence_90% (W)
DeepInstinct: MALICIOUS Google: Detected Ikarus: Trojan.Win64.Krypt MaxSecure: Trojan.Malware.300983.susgen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 2026-Jan-19 02:31:27 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xcc600 |
| SizeOfInitializedData | 0x31000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000063446 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x165000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetCurrentThreadId
VirtualProtect CloseHandle AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetCurrentProcessId OpenThread GetThreadContext SetThreadContext CreateToolhelp32Snapshot Thread32First Thread32Next FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryA LoadLibraryW SetDllDirectoryW VirtualQuery GetSystemInfo VirtualAlloc VirtualFree GetLastError HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree Sleep GetCurrentProcess SuspendThread ResumeThread FlushInstructionCache GetModuleHandleW GetSystemTimeAsFileTime QueryPerformanceCounter GetProcessHeap GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException IsDebuggerPresent WideCharToMultiByte MultiByteToWideChar CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI GetTempPathW SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead |
|---|---|
| MSVCP140D.dll |
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0_Lockit@std@@QEAA@H@Z |
| VCRUNTIME140D.dll |
__std_exception_copy
__std_exception_destroy _CxxThrowException memmove memcpy memset memchr memcmp strstr __C_specific_handler __current_exception __current_exception_context __C_specific_handler_noexcept __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW __std_type_info_destroy_list |
| VCRUNTIME140_1D.dll |
__CxxFrameHandler4
|
| ucrtbased.dll |
_get_initial_narrow_environment
_initterm _initterm_e _exit _set_fmode __p___argc __p___argv _c_exit _seh_filter_exe _configthreadlocale _set_new_mode __p__commode _wmakepath_s _wsplitpath_s wcscpy_s _open __setusermatherr _read _write __stdio_common_vsprintf_s strcat_s strcpy_s terminate _CrtDbgReportW _cexit _crt_at_quick_exit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _close _callnewh _malloc_dbg _free_dbg abort ___lc_codepage_func _rotl strerror _errno _lseeki64 _wopen wcstombs malloc free __stdio_common_vsprintf strtoul strlen ceilf _calloc_dbg strtol calloc wcslen tolower __stdio_common_vfprintf __acrt_iob_func _CrtDbgReport exit _invoke_watson _set_app_type _register_thread_local_exe_atexit_callback _wcsicmp |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jan-19 02:31:27 |
| Version | 0.0 |
| SizeofData | 92 |
| AddressOfRawData | 0x142068 |
| PointerToRawData | 0xdfa68 |
| Referenced File | C:\Users\Administrador\source\repos\Testando\x64\Debug\Testando.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jan-19 02:31:27 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x1420c4 |
| PointerToRawData | 0xdfac4 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1401502c0 |
| XOR Key | 0xe2d8c91d |
|---|---|
| Unmarked objects | 0 |
| 253 (35207) | 4 |
| ASM objects (35207) | 4 |
| C objects (35207) | 11 |
| C++ objects (35207) | 35 |
| Imports (35207) | 6 |
| Imports (33140) | 5 |
| Total imports | 191 |
| C++ objects (35217) | 4 |
| C objects (35217) | 20 |
| Resource objects (35217) | 1 |
| Linker (35217) | 1 |
No comments yet.