Manalyze report for 5b88e3dd8f848544ad8e814a82f83ca86eafcee34a3c45bd4ada25173a83286f

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-06 15:35:50
TLS Callbacks	2 callback(s) detected.
Debug artifacts	Embedded COFF debugging symbols

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: MinGW.org`
Suspicious	The PE is possibly packed.	`Unusual section name found: /4` `Unusual section name found: /14` `Unusual section name found: /29` `Unusual section name found: /41` `Unusual section name found: /55` `Unusual section name found: /67` `Unusual section name found: /80` `Unusual section name found: /91`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA`
Suspicious	The file contains overlay data.	`16920 bytes of data starting at offset 0x12600.`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`22044d0d701f92dfe432b02d0d22371f` 🔍
SHA1	`4f22b50da17031a132fdf0562718b646851d2119` 🔍
SHA256	`5b88e3dd8f848544ad8e814a82f83ca86eafcee34a3c45bd4ada25173a83286f` 🔍
SHA3	`a5c44dc2c0306748a50e9a9e2885ed690bcfd91d23e8b99ff61d1841ffd6f7b1` 🔍
SSDeep	`1536:u6FgihSsEuNjoJ955bqqaT/kPP3lLuBZhWsSTN5jWsSTN5zwkYKAzD4ClS:nLhquCZZeC3lhsSTGsSTxYKADNS` 🔍
Imports Hash	`ab94c5bc7650466aa1663b77c13bd323` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`15`
TimeDateStamp	2026-Oct-06 15:35:50
PointerToSymbolTable	`0x12600`
NumberOfSymbols	`672`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`2.0`
SizeOfCode	`0x8c00`
SizeOfInitializedData	`0xbe00`
SizeOfUninitializedData	`0xc00`
AddressOfEntryPoint	`0x000012E0 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0xa000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x1d000`
SizeOfHeaders	`0x400`
Checksum	`0x24bfe`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`c0696ef297e9a16ec4c94f3895146061 🔍`
SHA1	`5ef7e9a51398458709e4952e92ac6d53be05f9e0 🔍`
SHA256	`4fd3807388dc56a8beafaf467e5ce44c4f7cd5a1945ec113b8e933d213e8395d 🔍`
SHA3	`e44d1cfd4dc88acce3ae94ccf8508e2f2d3bc5893e1632766624f04d7da4dc20 🔍`
VirtualSize	`0x8b34`
VirtualAddress	`0x1000`
SizeOfRawData	`0x8c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.2995`

.data

MD5	`aadb7ce11a7a14cd9072ef0c79f9f459 🔍`
SHA1	`4811a5c87b26767889eeb144c4ec35ea361cf0c8 🔍`
SHA256	`128d66453f8fe4539e4115266db4783497d5b70bb6970e36a432c44c60f8a6bc 🔍`
SHA3	`47f99c6d5a4bd2553bd0cb4755b7644ad806275b709689d7c398528c8ebe682c 🔍`
VirtualSize	`0x34`
VirtualAddress	`0xa000`
SizeOfRawData	`0x200`
PointerToRawData	`0x9000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.416545`

.rdata

MD5	`b27cd5c9736c3519be69c0c30171c0c1 🔍`
SHA1	`f3fdb750d9a5360da09bf327bbe5fbb978ec68ea 🔍`
SHA256	`615e836b86b5d89277f7e00f8b4f3cc4139be5719729527ec77ed3d65988e6a5 🔍`
SHA3	`7ae38b0c5ae2a42f264133fe1a09a2be29fea1de0a4fbe4aba249a042042acba 🔍`
VirtualSize	`0x8f0`
VirtualAddress	`0xb000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x9200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.93001`

/4

MD5	`67844661b8685408200754d00a2f193a 🔍`
SHA1	`59fb08a048b812044ef5483bafacede4e3638a3a 🔍`
SHA256	`b0e8352c36fddd2f07f7d42834b560371ebc1943449f59ed69ff7cd63b94fd1d 🔍`
SHA3	`dfa29a3aa4d7d541089f87c5a3b83cdadfaea5bbc5b44c1358bd01fb690245a5 🔍`
VirtualSize	`0x184c`
VirtualAddress	`0xc000`
SizeOfRawData	`0x1a00`
PointerToRawData	`0x9c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.73346`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0xa24`
VirtualAddress	`0xe000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`2e35e087008d60cff1344923ef0e8d7a 🔍`
SHA1	`04c43747f80e7d04b354fd6d1277dafc38ed8e36 🔍`
SHA256	`f219667cce3241efbfa80be12bc64a90c87252ad830db36f47e45a9f8af9c546 🔍`
SHA3	`e29134e9d76c3564576cd4ac894753cc015a7ccf0a9e6931e5ad0e2f6073e7d4 🔍`
VirtualSize	`0x7cc`
VirtualAddress	`0xf000`
SizeOfRawData	`0x800`
PointerToRawData	`0xb600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.73782`

.CRT

MD5	`2bff74cc7705108c41de45eae2814c11 🔍`
SHA1	`f498014971e4eadda0b0076037db5d3fd3e3c385 🔍`
SHA256	`3ff1df08cee499485d3e134d5dc1b545b5ec8c55dd6a1c3143937c7f0b45e562 🔍`
SHA3	`eb7c78f2ac5156e04b329e0122fb7f6e8505346fc63a1c48c1e3c34fc38c500f 🔍`
VirtualSize	`0x18`
VirtualAddress	`0x10000`
SizeOfRawData	`0x200`
PointerToRawData	`0xbe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.11837`

.tls

MD5	`137c700390d6add8f1c1b6d6795557a7 🔍`
SHA1	`e84624aa2952dd3d770305367fba8097266bc774 🔍`
SHA256	`7349fbe9e3ac14a707b3da0e2e4394c8c379ea048b38c31ecfbc1812a3d86d00 🔍`
SHA3	`2221d89359e9540f10a358bb11178ad0a34b66f240ad1501da83a7f756751f3a 🔍`
VirtualSize	`0x20`
VirtualAddress	`0x11000`
SizeOfRawData	`0x200`
PointerToRawData	`0xc000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.210826`

/14

MD5	`8ac76bb4c6d225d3a53fe2a5040e25e2 🔍`
SHA1	`7b6b17e0235bc2286d90a32af2f4b545781d2b39 🔍`
SHA256	`23682101dc7f93c806cca21fce3876e5c1eb54f71cc5d5b0d5c54653dd594aba 🔍`
SHA3	`e12698d927dc92407674f9d68770ae8e20e20c1dfbd728492394b51400f558e5 🔍`
VirtualSize	`0x78`
VirtualAddress	`0x12000`
SizeOfRawData	`0x200`
PointerToRawData	`0xc200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.569505`

/29

MD5	`68eb90a7afcfd8f9fde86c816e07ab73 🔍`
SHA1	`e52e7395e9b9538db75733813eb0dffc6217ce81 🔍`
SHA256	`1480adf7d3f82b471ce960a591965504a0cc39f3383d2539f16a20c0e0faebf4 🔍`
SHA3	`d2fab75863475da5e26f82b11466af168fcef40443ea648e07a3b08037ab1b94 🔍`
VirtualSize	`0x449d`
VirtualAddress	`0x13000`
SizeOfRawData	`0x4600`
PointerToRawData	`0xc400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.92234`

/41

MD5	`8a24c407748c006dfc67e50f3426f339 🔍`
SHA1	`9ae91e2c4225a4e6f24ab1ce67ba875e2abc661a 🔍`
SHA256	`6cf5d0ee03a8ab73e45e30cede5fb6a811efa267f70d7c90a10b40069c20dd89 🔍`
SHA3	`f077d539469315cd7d57b7ccb4ece6ef47f4d3ed53e59e4bfbfcf2cb8c05f4b4 🔍`
VirtualSize	`0x4ea`
VirtualAddress	`0x18000`
SizeOfRawData	`0x600`
PointerToRawData	`0x10a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.93661`

/55

MD5	`8119e9e42397907493136752d3d97c2c 🔍`
SHA1	`231d4e0b799575722e92bcb0dfbdd3bab05e7048 🔍`
SHA256	`5d3b896ed44a8feb2586aca0076a538cdfe6ff3f3d106751c1debc4b64e862e5 🔍`
SHA3	`f04022f291fe3dac0a71c082cfb55f5b2fd7d8e090a9afa4e00aafe669cc71cb 🔍`
VirtualSize	`0x533`
VirtualAddress	`0x19000`
SizeOfRawData	`0x600`
PointerToRawData	`0x11000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`4.72886`

/67

MD5	`9f0f0ca28cd32e501c32f970047204e9 🔍`
SHA1	`8026dcde6e5a801a14db8a97a281f58ff87b6f16 🔍`
SHA256	`c9d8ad52d93b73279c2b387550181de1b0e24fc183b3406e0f214a679ef8a4aa 🔍`
SHA3	`86182c452685d6bcd33c70153e5c29c61da48c56c739ec2ba39f31da221b3c6a 🔍`
VirtualSize	`0x38`
VirtualAddress	`0x1a000`
SizeOfRawData	`0x200`
PointerToRawData	`0x11600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.678483`

/80

MD5	`78879d4e3ed6e42e407840df621c49df 🔍`
SHA1	`4957a557fac1f6ac91135ca1558bc28db3cd6d8a 🔍`
SHA256	`96e4e62a619ed72edd9764a28180fa766693b6618df8d219dff77b3b0c9f3837 🔍`
SHA3	`89e670ece73e75a844b9433a07dc8c1d7b6ab68d2db4d32aff2e512133af6ba3 🔍`
VirtualSize	`0xb3d`
VirtualAddress	`0x1b000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x11800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.38948`

/91

MD5	`c7587242fed4601d5805413761dd0877 🔍`
SHA1	`16a3a4dd0bc3d508480268a18ddca9019f03e3e8 🔍`
SHA256	`9d56efd30ea12f30ac9fa57b70a5bd5b693c7f357517aa4f9a7687e920dd7156 🔍`
SHA3	`204ba7f1f48a5aa928b0d51ca651f83078eb6bd0f612978152c84b22a1e92346 🔍`
VirtualSize	`0x70`
VirtualAddress	`0x1c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x12400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.542306`

Imports

KERNEL32.dll	`CloseHandle` `CreateDirectoryA` `CreateThread` `DeleteCriticalSection` `EnterCriticalSection` `ExitProcess` `FindClose` `FindFirstFileA` `FindNextFileA` `FreeLibrary` `GetCommandLineA` `GetCurrentThreadId` `GetLastError` `GetModuleHandleA` `GetProcAddress` `InitializeCriticalSection` `InterlockedExchange` `IsDBCSLeadByteEx` `LeaveCriticalSection` `LoadLibraryA` `MultiByteToWideChar` `SetUnhandledExceptionFilter` `Sleep` `TlsGetValue` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WideCharToMultiByte`
msvcrt.dll	`_strdup` `_stricoll`
msvcrt.dll (#2)	`_strdup` `_stricoll`

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData	`0x411001`
EndAddressOfRawData	`0x41101c`
AddressOfIndex	`0x40e038`
AddressOfCallbacks	`0x410004`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x00401E10` `0x00401DC0`

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Tried to read outside the COFF string table to get the name of section /14!
[*] Warning: Tried to read outside the COFF string table to get the name of section /29!
[*] Warning: Tried to read outside the COFF string table to get the name of section /41!
[*] Warning: Tried to read outside the COFF string table to get the name of section /55!
[*] Warning: Tried to read outside the COFF string table to get the name of section /67!
[*] Warning: Tried to read outside the COFF string table to get the name of section /80!
[*] Warning: Tried to read outside the COFF string table to get the name of section /91!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF symbol's section number is bigger than the number of sections!
[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.