5f1c69f54ae0d4852278429d075dd4297c87780612c9561c81843817278fd944

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-22 12:35:42
Detected languages English - United States
CompanyName whiteeyeXcope
FileDescription gg/whiteeyr for best tools
FileVersion 1.0.0.0
ProductName multicat
ProductVersion 1.0.0.0

Plugin Output

Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 f0f84781e47be87cc1aae49d61223d5f 🔍
SHA1 cc4b7f5918d77b326badfab642aa91f046a39b07 🔍
SHA256 5f1c69f54ae0d4852278429d075dd4297c87780612c9561c81843817278fd944 🔍
SHA3 a754023189456d30d0513a984557a4ae10af16e1e313227473c839ddb2788808 🔍
SSDeep 6144:LJERpuUPQ6W1u5JIvmkzCqENxx7a+60p7A5kcY80S5u:LJERpUaC2BL3bA5kcRU 🔍
Imports Hash e81d90b230abc81b286482b9dba12e35 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Sep-22 12:35:42
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x3400
SizeOfInitializedData 0x40e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x4b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c9193edf4011ad50cc5b510ecb5de382 🔍
SHA1 5c2a4697b21ad25c4d6b88887720244d4f797d29 🔍
SHA256 33ac6c0312d1dbb954e9c5d4729266be3bd046572449907bc30422749b3492b3 🔍
SHA3 082bcdecbe6d5c245e1f391f55605b93d4fef3c888b2470c90ffad03939b7b8d 🔍
VirtualSize 0x3326
VirtualAddress 0x1000
SizeOfRawData 0x3400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.27082

.rdata

MD5 09a9016c7d2c1e7340d82a22ea58f8cd 🔍
SHA1 40b24416d0c18b47a9b4a2f261c7cb72e73e98bf 🔍
SHA256 c54f51e71a9a65fd4b8b9dda23850681bf055a4dd4b4ac4f04788aebda9b5976 🔍
SHA3 92cef3e9cf6d7ed2eb9c67314d2f9db505293433779152d5edeb4d9c917237db 🔍
VirtualSize 0x3fed0
VirtualAddress 0x5000
SizeOfRawData 0x40000
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.98451

.data

MD5 1d7d80e8b5ce8c86e7c833467964b6ae 🔍
SHA1 88aa1601feff36c623fb15fca9cf29af496ec9b2 🔍
SHA256 eac0bc584b30b30f3172f645fd2103caa322244e85a3ec4fb1c345f0c4314c94 🔍
SHA3 a8483a22d7281a11677adbc110fa0c305d06a1ff41bfda4e197443b8b6a3b8e5 🔍
VirtualSize 0x4
VirtualAddress 0x45000
SizeOfRawData 0x200
PointerToRawData 0x43800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0659144

.pdata

MD5 761694ec8f8c7d4878bbb85ab3f5c4be 🔍
SHA1 b0a8c33587ca4cb1902b929bc06dc031c7c3cd5d 🔍
SHA256 519905f7fd9a0770dfbf606ea781263a1522c6b0a606d945f85589a147c94a15 🔍
SHA3 fedc130fffa894d2ee272c4959847599a772c115a69e9b4091378e361afcbba6 🔍
VirtualSize 0xf0
VirtualAddress 0x46000
SizeOfRawData 0x200
PointerToRawData 0x43a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.23944

.CRT

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x47000
SizeOfRawData 0x200
PointerToRawData 0x43c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x2
VirtualAddress 0x48000
SizeOfRawData 0x200
PointerToRawData 0x43e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 cd23f67ad15ea2409f73188960dd0e9c 🔍
SHA1 eee72c919e9ecdf490741c8c0b8a399252ef9c1a 🔍
SHA256 c6d63124fe1a1c3b92162c15e11732f1c3abe569e688a3d571dfe56d577ceb53 🔍
SHA3 17b4bebca4ba1cdcc187ee4dec5c64e523a0ded356df5772a626d3551784487a 🔍
VirtualSize 0x270
VirtualAddress 0x49000
SizeOfRawData 0x400
PointerToRawData 0x44000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.06728

.reloc

MD5 f74b0cc29715143d511ef3b73c2cea83 🔍
SHA1 7fa963851ae407529139abacccda16e56e396a3f 🔍
SHA256 4b398b6ebb17f68335363ce0e4cf05c36849dcccf8bb83918100f81593b09e1b 🔍
SHA3 a16601f41cea3472977ceddc5d3c5e376fac0618ee7c30da0828c7b4a94b6d1c 🔍
VirtualSize 0x20
VirtualAddress 0x4a000
SizeOfRawData 0x200
PointerToRawData 0x44400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.404389

Imports

ntdll.dll RtlExitUserProcess
KERNEL32.dll CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
GetLastError
GetTempPathW
GetTickCount
VirtualAlloc
VirtualFree
WriteFile

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x210
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25227
MD5 dcd1fa3176a4a8316f6b13131f8e9aff 🔍
SHA1 e70712273224573b732dec7eb824d42e02b56312 🔍
SHA256 034406a99dcb37f22612daf6f27ca814f876dc100f062918f4982737ed37e060 🔍
SHA3 c7cac3ad6f0d8358d5934d51f9cc85c50724b36adbf3843848209e6881db937e 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName whiteeyeXcope
FileDescription gg/whiteeyr for best tools
FileVersion (#2) 1.0.0.0
ProductName multicat
ProductVersion (#2) 1.0.0.0
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x448000
EndAddressOfRawData 0x448001
AddressOfIndex 0x445000
AddressOfCallbacks 0x447000
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_1BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.