51aaf86aab631f33cb1c6b3a57a5f8eef76c0b343f05f4377d7869e89baf3ed8

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-15 11:18:15
Detected languages English - United States
Comments DLL support by Alessandro Iacopetti & Gilles Vollant
FileDescription zlib data compression and ZIP file I/O library
FileVersion 1.3.0.1
InternalName zlib
LegalCopyright (C) 1995-2023 Jean-loup Gailly & Mark Adler
OriginalFilename zlibwapi.dll
ProductName ZLib.DLL
ProductVersion 1.3.0.1

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .may0
Unusual section name found: .may1
Unusual section name found: .may2
The PE only has 2 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Manipulates other processes:
  • WriteProcessMemory
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 e5a17d41e605a8a80af900d3d0c0289b
SHA1 42320987cbe0854bb587b4829e5cf1cae4e38afc
SHA256 51aaf86aab631f33cb1c6b3a57a5f8eef76c0b343f05f4377d7869e89baf3ed8
SHA3 213dfc0ffdb6a3874ff80fe98a7e6fd7ddd36597a1db7c5d8cd567d04192cf5d
SSDeep 393216:hSkzyqjgFPZLGN7acIM4RBJpYZ0YocdEA4:8kzjjgFPZLGlt4LJY3y
Imports Hash 9394f491a7eeacaa7018bfd2a895d27b

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Apr-15 11:18:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.3
SizeOfCode 0x24200
SizeOfInitializedData 0x15c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000B4B7BE (Section: .may2)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 1.3
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1c24000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x24103
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x101ae
VirtualAddress 0x26000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x2b80
VirtualAddress 0x37000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1d64
VirtualAddress 0x3a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xfc
VirtualAddress 0x3c000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.may0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xb00a19
VirtualAddress 0x3d000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.may1

MD5 4b79fc877fdb460102356f1997ad7287
SHA1 dd5e95cfe286935c5d9114f812d4c90a547aa536
SHA256 42be633aaa45e01d80c131820b6397fbc814b7021903d8ddd010f23d0ea401ba
SHA3 848553ef02c2d8273e55acc54da01d6124a5ef42c773a97f42ad8e33d65c7432
VirtualSize 0x58
VirtualAddress 0xb3e000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.220113

.may2

MD5 0a6959e56286ab0170194200ac6f494d
SHA1 9450e47fe5f03e724dd06368f1c10e9817201deb
SHA256 3b9fff822cd9b65f817da4c5eaa962de6a17248c853ed695e02dc61b0e804ec6
SHA3 317d7378dffaa45e2671f00dada247aff44521e905212deffa71625651683dd9
VirtualSize 0x10e2d60
VirtualAddress 0xb3f000
SizeOfRawData 0x10e2e00
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.8546

.rsrc

MD5 fdadd68f3b753dddbe21f8c2f38c5579
SHA1 68f56ab50d40d48e95bf63e40363f411249e4c74
SHA256 6a5061ea214bf250fceafc2bbffcb99af89c1720724e8fdffaa602d493178a0f
SHA3 5f5e7edd16a3fb7cc5804b8693b4365de3adc0c9034c576ae230b30930904fe4
VirtualSize 0x4a1
VirtualAddress 0x1c22000
SizeOfRawData 0x600
PointerToRawData 0x10e3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.08715

.reloc

MD5 5e316d2ed584aade5d32844f478cad3a
SHA1 e4e4383d9eb697679e90bd6fded35c94b43dfb4d
SHA256 fff92f78eb0898e34dc4ec352bccb08c1367ab55be3300bce74705d78bfa5ae2
SHA3 f958c4930196c5ccce219ad147d162dcf9d01202a1c42a8c10382b3d2f67e021
VirtualSize 0x108
VirtualAddress 0x1c23000
SizeOfRawData 0x200
PointerToRawData 0x10e3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.60142

Imports

KERNEL32.dll WriteProcessMemory
USER32.dll MessageBoxA

Delayed Imports

adler32

Ordinal 1
Address 0x17f40

compress

Ordinal 2
Address 0x18320

crc32

Ordinal 3
Address 0x18460

deflate

Ordinal 4
Address 0x197d0

deflateCopy

Ordinal 5
Address 0x1a260

deflateEnd

Ordinal 6
Address 0x1a450

deflateInit2_

Ordinal 7
Address 0x1a580

deflateInit_

Ordinal 8
Address 0x1a800

deflateParams

Ordinal 9
Address 0x1a840

deflateReset

Ordinal 10
Address 0x1aaf0

deflateSetDictionary

Ordinal 11
Address 0x1abc0

gzclose

Ordinal 12
Address 0x1c3b0

gzdopen

Ordinal 13
Address 0x1bf70

gzerror

Ordinal 14
Address 0x1c010

gzflush

Ordinal 15
Address 0x1d500

gzopen

Ordinal 16
Address 0x1c0e0

gzread

Ordinal 17
Address 0x1cda0

gzwrite

Ordinal 18
Address 0x1d9e0

inflate

Ordinal 19
Address 0x1da60

inflateEnd

Ordinal 20
Address 0x1f440

inflateInit2_

Ordinal 21
Address 0x1f560

inflateInit_

Ordinal 22
Address 0x1f660

inflateReset

Ordinal 23
Address 0x1f750

inflateSetDictionary

Ordinal 24
Address 0x1f8c0

inflateSync

Ordinal 25
Address 0x1f9b0

uncompress

Ordinal 26
Address 0x20dc0

zlibVersion

Ordinal 27
Address 0x20f90

gzprintf

Ordinal 28
Address 0x1d5f0

gzputc

Ordinal 29
Address 0x1d620

gzgetc

Ordinal 30
Address 0x1cbd0

gzseek

Ordinal 31
Address 0x1c160

gzrewind

Ordinal 32
Address 0x1c100

gztell

Ordinal 33
Address 0x1c2f0

gzeof

Ordinal 34
Address 0x1bff0

gzsetparams

Ordinal 35
Address 0x1d790

zError

Ordinal 36
Address 0x20f40

inflateSyncPoint

Ordinal 37
Address 0x1fb00

get_crc_table

Ordinal 38
Address 0x18900

compress2

Ordinal 39
Address 0x18340

gzputs

Ordinal 40
Address 0x1d700

gzgets

Ordinal 41
Address 0x1cc60

inflateCopy

Ordinal 42
Address 0x1f290

inflateBackInit_

Ordinal 43
Address 0x20ca0

inflateBack

Ordinal 44
Address 0x1fd60

inflateBackEnd

Ordinal 45
Address 0x20c50

compressBound

Ordinal 46
Address 0x18440

deflateBound

Ordinal 47
Address 0x1a100

gzclearerr

Ordinal 48
Address 0x1bf30

gzungetc

Ordinal 49
Address 0x1ce10

zlibCompileFlags

Ordinal 50
Address 0x20f80

deflatePrime

Ordinal 51
Address 0x1aa10

deflatePending

Ordinal 52
Address 0x1a9c0

adler32_combine

Ordinal 140
Address 0x17f50

crc32_combine

Ordinal 142
Address 0x18470

deflateSetHeader

Ordinal 144
Address 0x1adc0

deflateTune

Ordinal 145
Address 0x1ae60

gzbuffer

Ordinal 146
Address 0x1bef0

gzclose_r

Ordinal 147
Address 0x1ca60

gzclose_w

Ordinal 148
Address 0x1d430

gzdirect

Ordinal 149
Address 0x1cb10

gzoffset

Ordinal 150
Address 0x1c060

inflateGetHeader

Ordinal 156
Address 0x1f520

inflateMark

Ordinal 157
Address 0x1f670

inflatePrime

Ordinal 158
Address 0x1f6e0

inflateReset2

Ordinal 159
Address 0x1f780

inflateUndermine

Ordinal 160
Address 0x1fb40

gzgetc_

Ordinal 161
Address 0x1cc50

inflateResetKeep

Ordinal 163
Address 0x1f820

deflateResetKeep

Ordinal 164
Address 0x1ab20

gzopen_w

Ordinal 165
Address 0x1c0f0

inflateGetDictionary

Ordinal 166
Address 0x1f490

gzvprintf

Ordinal 167
Address 0x1d850

inflateCodesUsed

Ordinal 168
Address 0x1f250

inflateValidate

Ordinal 169
Address 0x1fb70

uncompress2

Ordinal 170
Address 0x20de0

gzfread

Ordinal 171
Address 0x1cb50

gzfwrite

Ordinal 172
Address 0x1d570

deflateGetDictionary

Ordinal 173
Address 0x1a500

adler32_z

Ordinal 174
Address 0x18040

crc32_z

Ordinal 175
Address 0x18500

crc32_combine_gen

Ordinal 176
Address 0x184c0

crc32_combine_gen64

Ordinal 177
Address 0x184d0

crc32_combine_op

Ordinal 178
Address 0x184e0

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x36c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.47517
MD5 903564c80367434eecaddf0634a0a5b1
SHA1 0cd31e8dfe05cf0f3e5b995c83167cb56035278c
SHA256 2e8cb0ec40dbc64de9f6546e4c159ff6561ab5db9cb083b93460bde0486da302
SHA3 f6938c66c47506022a24bbcd76210a53315a4cf24a4009c707a8d62b8de11793

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8858
MD5 f7ad1eab748bc07570a57ec87787cf90
SHA1 0b1608da9fef218386e825db575c65616826d9f4
SHA256 d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04
SHA3 6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.3.0.1
ProductVersion 1.3.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
Comments DLL support by Alessandro Iacopetti & Gilles Vollant
FileDescription zlib data compression and ZIP file I/O library
FileVersion (#2) 1.3.0.1
InternalName zlib
LegalCopyright (C) 1995-2023 Jean-loup Gailly & Mark Adler
OriginalFilename zlibwapi.dll
ProductName ZLib.DLL
ProductVersion (#2) 1.3.0.1
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180037008

RICH Header

Errors

[*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section _RDATA has a size of 0! [*] Warning: Section .may0 has a size of 0! [*] Warning: 95 invalid export(s) not shown.
Leave a comment

No comments yet.