Manalyze report for 58ff40a7fa1ba7d19989521ed435856e6d08921b96d8dfc341baf5ee8ce8a7e0

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2058-Jun-17 15:07:05
TLS Callbacks	2 callback(s) detected.
Debug artifacts	GPM2 Port Tool.pdb

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: .buildid` `Unusual section name found: /4`
Info	The PE contains common functions which appear in legitimate applications.	`Can access the registry: RegCloseKey RegDeleteValueA RegOpenKeyExA`
Suspicious	The file contains overlay data.	`512 bytes of data starting at offset 0x4d400.`
Malicious	VirusTotal score: 6/71 (Scanned on 2026-11-05 01:38:56)	`APEX: Malicious` `Bkav: W32.Malware.9FC4ED87` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `McAfeeD: Real Protect-LS!417A263468FD` `Symantec: ML.Attribute.HighConfidence`

Hashes

MD5	`417a263468fdb91c21cdbd3d348ecf36` 🔍
SHA1	`4f0393176762d248f475a228c38a673b411326ba` 🔍
SHA256	`58ff40a7fa1ba7d19989521ed435856e6d08921b96d8dfc341baf5ee8ce8a7e0` 🔍
SHA3	`7dc7a1625e40c73f95d30b2d0c7070de710079fca463567273b60264c77f915a` 🔍
SSDeep	`6144:2f1bKoJOGYBhLzUFTAHfglSaQKA2ISFyxd2+u0Z3ALy/UIWaBCUo5Utmmd:2f1lJOGYBh/UFT6glSaQKAIF8HuEALr` 🔍
Imports Hash	`41df80dc318fdc04d78bf5c2c9f7db8c` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x78`
e_cp	`0x1`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x78`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`7`
TimeDateStamp	2058-Jun-17 15:07:05
PointerToSymbolTable	`0x4d400`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x31c00`
SizeOfInitializedData	`0x1b400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000023C0 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x53000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x1000000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`7d7a3560c2a8f3fab6625cdfd0c3cb6e 🔍`
SHA1	`334b32688e8d7b864da9a7fadbe415c7fb68624b 🔍`
SHA256	`432fdc2a84a9b22090c9a4d26e40a06ddc183c2fddf6964f020cd080660ae563 🔍`
SHA3	`0b906ea5ff425a50a282329042f7a779fcf15defd4231ca9050bac965d00580f 🔍`
VirtualSize	`0x31b12`
VirtualAddress	`0x1000`
SizeOfRawData	`0x31c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.43685`

.rdata

MD5	`0c2ea6a8c6666ba9c51a07ad82a2da15 🔍`
SHA1	`224cb4b6d6f027cbca296dfce6c80280a24c8959 🔍`
SHA256	`93f4baefa7e2c3f53191f34babcae33d7bb3981b011cf45599b67d608b35390b 🔍`
SHA3	`03e5b2dc4e55bbd5177bad7e012e5f4df15a155a9932a6a9ffeb297a48d5cad3 🔍`
VirtualSize	`0x16124`
VirtualAddress	`0x33000`
SizeOfRawData	`0x16200`
PointerToRawData	`0x32000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.2586`

.buildid

MD5	`c44ca017b6ad57505a2b922172cf18ae 🔍`
SHA1	`bf79b57773ab9cc2c29d6f0608f89473c90cbfb0 🔍`
SHA256	`683dd1e5638fcd21496078a020f83b28a262d87ceef8bca28980af5b845d1f0c 🔍`
SHA3	`e7a436782c7665aa47c4327b5011352dd59220aa5c4a962f3fc598165a13eea5 🔍`
VirtualSize	`0x63`
VirtualAddress	`0x4a000`
SizeOfRawData	`0x200`
PointerToRawData	`0x48200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.05457`

.data

MD5	`aecdf70d8319c7cbc2ff227f2e371bdd 🔍`
SHA1	`b4d2e26ac17610a8788de483523a63bafe46b3a7 🔍`
SHA256	`0c8f7a39ffbac7c9003a7eaedd5f5689e42117172ed406b057999bdd554ad333 🔍`
SHA3	`a44ede3d490b1d0df2b4d615c12106da0664101223ce7f32e18b627a92003938 🔍`
VirtualSize	`0x11e8`
VirtualAddress	`0x4b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x48400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.530922`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x8`
VirtualAddress	`0x4d000`
SizeOfRawData	`0x200`
PointerToRawData	`0x48600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`e6db25a23c2ce27e8c5aee2e7d2a1388 🔍`
SHA1	`0b24ae92e617a798390db2adaac2c51388a6a013 🔍`
SHA256	`c9b43e617824bcd438b4d969c43d84680d6f7d52cde082f6d1051e100a065727 🔍`
SHA3	`3056fd921abbdfe11a03aef9373b712312b534500dc9dc577ed603ab8d347249 🔍`
VirtualSize	`0xf5c`
VirtualAddress	`0x4e000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x48800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.52792`

/4

MD5	`413bf9b92a4832a0f89fe6dc15e8d77f 🔍`
SHA1	`2e11a7b54352b3ebfa8c7aad066645829d43c6f6 🔍`
SHA256	`5e9505b0dd6be9eb84ca27a29c2dd0e4a1d30cb77e3cd4c302aca50771034382 🔍`
SHA3	`36eebde987d879079a564430a7324a6043a3a99971bbd7a9dc7c5310759199d0 🔍`
VirtualSize	`0x3ac4`
VirtualAddress	`0x4f000`
SizeOfRawData	`0x3c00`
PointerToRawData	`0x49800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`4.3764`

Imports

SHELL32.dll	`CommandLineToArgvW` `SHBrowseForFolderA` `SHGetFolderPathA` `SHGetPathFromIDListA`
ole32.dll	`CoCreateInstance` `CoInitialize` `CoTaskMemFree`
ADVAPI32.dll	`RegCloseKey` `RegDeleteValueA` `RegOpenKeyExA`
USER32.dll	`AdjustWindowRect` `CreateWindowExA` `DefWindowProcA` `DispatchMessageA` `GetDC` `GetMessageA` `GetWindowTextA` `GetWindowTextLengthA` `IsDialogMessageA` `LoadCursorA` `PostQuitMessage` `RegisterClassA` `ReleaseDC` `SendMessageA` `SetProcessDPIAware` `SetWindowTextA` `SystemParametersInfoA` `TranslateMessage`
GDI32.dll	`CreateFontIndirectA` `GetDeviceCaps`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-private-l1-1-0.dll	`strrchr`
api-ms-win-crt-runtime-l1-1-0.dll	`__p___argc` `__p___argv` `__p__acmdln` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_initialize_narrow_environment` `_initterm` `_initterm_e` `_set_app_type` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `__stdio_common_vsprintf` `fclose` `fflush` `fopen` `fputc` `fputs` `fwrite`
KERNEL32.dll	`BeginUpdateResourceA` `CloseHandle` `CopyFileA` `CreateFileA` `DeleteCriticalSection` `EndUpdateResourceA` `EnterCriticalSection` `FindClose` `FindFirstFileA` `FindNextFileA` `GetCommandLineW` `GetFileAttributesA` `GetFileAttributesExA` `GetLastError` `GetModuleFileNameA` `GetModuleHandleA` `GetStartupInfoA` `InitializeCriticalSection` `LeaveCriticalSection` `MoveFileA` `MulDiv` `MultiByteToWideChar` `ReadFile` `SetFileAttributesA` `SetFilePointer` `SetUnhandledExceptionFilter` `Sleep` `TlsGetValue` `UpdateResourceA` `VirtualProtect` `VirtualQuery` `WideCharToMultiByte` `lstrcatA` `lstrcmpiW` `lstrcpynA`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-multibyte-l1-1-0.dll	`_ismbblead`
api-ms-win-crt-string-l1-1-0.dll	`strncmp`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2058-Jun-17 15:07:05
Version	`0.0`
SizeofData	`43`
AddressOfRawData	`0x4a038`
PointerToRawData	`0x48238`
Referenced File	GPM2 Port Tool.pdb

UNKNOWN

Characteristics	`0`
TimeDateStamp	2058-Jun-17 15:07:05
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x44d000`
EndAddressOfRawData	`0x44d004`
AddressOfIndex	`0x44b1a4`
AddressOfCallbacks	`0x448468`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`0x00402620` `0x004026A0`

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!

Leave a comment

No comments yet.