Manalyze report for 645d8b107528dedf2380fde8316459df2d0f4fea0a13521250e87a3cc4710efe

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Nov-14 17:46:05
Detected languages	English - United States
TLS Callbacks	1 callback(s) detected.

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: gcc.gnu.org https://gcc.gnu.org https://gcc.gnu.org/bugs/`
Suspicious	The PE contains functions most legitimate programs don't use.	`Manipulates other processes: OpenProcess` `Can take screenshots: BitBlt CreateCompatibleDC`
Suspicious	VirusTotal score: 1/69 (Scanned on 2026-11-14 19:04:37)	`Ikarus: Trojan-Ransom.FileCrypter`

Hashes

MD5	`9cd3e78f0ec3c08732dcc48adabd9619` 🔍
SHA1	`c9350a0ffac6ffaad08c3d8a590d9faf7c77a969` 🔍
SHA256	`645d8b107528dedf2380fde8316459df2d0f4fea0a13521250e87a3cc4710efe` 🔍
SHA3	`1795b5595bb5142ccad58ee5bb5ea437b8509b5d5c357e39a0846dedef593e31` 🔍
SSDeep	`6144:ez9ciD2TKnqeNa9oIGMpPyr7gShdUULZz1/DYnSxM087:ez9c/Tf9oVMa7gAbZzJXxM087` 🔍
Imports Hash	`5f4243c3585f69644b3bad599cddcd25` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	2026-Nov-14 17:46:05
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x35a00`
SizeOfInitializedData	`0x14400`
SizeOfUninitializedData	`0xc00`
AddressOfEntryPoint	`0x0000000000001460 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x51000`
SizeOfHeaders	`0x400`
Checksum	`0x4c054`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`aa198d50ee9b75c0c6c0065b9cc18e96 🔍`
SHA1	`54b11b2be4c3969ac12eefae60f66887a5e7b9eb 🔍`
SHA256	`dac67255fff668204ce9ae07531a028b3fa882a5b3dbbb6a6ea283a6e8874806 🔍`
SHA3	`fbfb1038f9bfe5afa1e73e06888471b079be14c5d172c2958a7aba94b3cf5aff 🔍`
VirtualSize	`0x35930`
VirtualAddress	`0x1000`
SizeOfRawData	`0x35a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.1968`

.data

MD5	`8bccd728ea18ac27264bf64b94a54b4c 🔍`
SHA1	`b206df4144a656da19339513dad59dd1f0ba92c8 🔍`
SHA256	`0912c81dbd95cc43b7f48f0a9c6ca8c01b15f0a2a0c49e7a6fd34290f993b65e 🔍`
SHA3	`6d7cd0a33b497dba23dcd798247f3af1d4b636580cb8e79184905a524c32bfee 🔍`
VirtualSize	`0x500`
VirtualAddress	`0x37000`
SizeOfRawData	`0x600`
PointerToRawData	`0x35e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.70271`

.rdata

MD5	`3e6a9dc9a5a434cfdb119e33ed77640d 🔍`
SHA1	`96e106b6a3e022106794cf11d682f17c79f2b7e1 🔍`
SHA256	`0f96bf8e31a570ab708d6c842a0cf8f39baf0687c015c41ddcaf1fdd8a9f9dc2 🔍`
SHA3	`f1f42dfe7012133422f39c703e354828869f9ff2e175088b35b02111944564f1 🔍`
VirtualSize	`0x5520`
VirtualAddress	`0x38000`
SizeOfRawData	`0x5600`
PointerToRawData	`0x36400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.03551`

.pdata

MD5	`5b8ac2fd60bf3c9de1f41a023620aa6f 🔍`
SHA1	`74b8f744a45d178275e8bedcc8e534242f0e8a02 🔍`
SHA256	`3bec45e70b6fb3612e04c79bc158ae901c362fc6ae398cc569a2099622ffcf59 🔍`
SHA3	`031e7d1aba8f88d8605ae5b2fe60327b9ad5bc7436eb7c54336e0074bbe75779 🔍`
VirtualSize	`0x3888`
VirtualAddress	`0x3e000`
SizeOfRawData	`0x3a00`
PointerToRawData	`0x3ba00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.50271`

.xdata

MD5	`5806d3b9ab6271817a75423cf6139a96 🔍`
SHA1	`db7787b95901c7a135ac37cbf85a965b317b9a1f 🔍`
SHA256	`571b4f1c3526295038c477017a00c8eb2ee97f13c5a846dcf9c0c91dff5004b4 🔍`
SHA3	`9313a11aafecb787af85bd9ce7f76524bb48a1b0f5db4ed84f7f1e678d9a4c13 🔍`
VirtualSize	`0x2f18`
VirtualAddress	`0x42000`
SizeOfRawData	`0x3000`
PointerToRawData	`0x3f400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.12918`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0xb38`
VirtualAddress	`0x45000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`9a30ad60b22286ca248326cf588ddaea 🔍`
SHA1	`ac63575aec2242a6f02aaee375686240587e9f7f 🔍`
SHA256	`5d8a71f8c28ba812a596effe64260f2347dd2cfed981838cec725b9c81bf97c6 🔍`
SHA3	`a1d5f5555ac4174141dae683a9778ed836d0ec53e882b59075829e6a81bb377c 🔍`
VirtualSize	`0x23f4`
VirtualAddress	`0x46000`
SizeOfRawData	`0x2400`
PointerToRawData	`0x42400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.57797`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x20`
VirtualAddress	`0x49000`
SizeOfRawData	`0x200`
PointerToRawData	`0x44800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`71261058e84000e620129df288140de5 🔍`
SHA1	`29caf891963fc238ae4cebcd7f9e8c5a116f1093 🔍`
SHA256	`98a6055f2db5f02ea212197f2fbd7e854bf52d2b24fc43496c89cf59ef63e1b6 🔍`
SHA3	`ca1a1f248cc76d3297202e1f8808a9f847eb898df9ab5aae0d61818c8eacee8e 🔍`
VirtualSize	`0x5178`
VirtualAddress	`0x4a000`
SizeOfRawData	`0x5178`
PointerToRawData	`0x44a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.8987`

.reloc

MD5	`61fc240e5599a499598bc3fa5bacec6e 🔍`
SHA1	`6723091690289f4e8d9103b5912a724a0d4e7067 🔍`
SHA256	`0ef76de8371c31223a4adb64188e11f6b95d65a2408fbeaff89769914c9038b0 🔍`
SHA3	`e25697783be4d2c33a4c335e706fd17512c7d06d0c0ab7ac9606fce256ffac0a 🔍`
VirtualSize	`0x470`
VirtualAddress	`0x50000`
SizeOfRawData	`0x600`
PointerToRawData	`0x49c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`4.59366`

Imports

COMCTL32.dll	`InitCommonControlsEx`
comdlg32.dll	`GetOpenFileNameW` `GetSaveFileNameW`
GDI32.dll	`BitBlt` `CreateCompatibleBitmap` `CreateCompatibleDC` `DeleteDC` `DeleteObject` `GetStockObject` `SelectObject` `SetStretchBltMode` `StretchBlt`
gdiplus.dll	`GdipAlloc` `GdipCloneBrush` `GdipCloneImage` `GdipCreateBitmapFromFile` `GdipCreateBitmapFromFileICM` `GdipCreateFont` `GdipCreateFontFamilyFromName` `GdipCreateFromHDC` `GdipCreateSolidFill` `GdipCreateStringFormat` `GdipDeleteBrush` `GdipDeleteFont` `GdipDeleteFontFamily` `GdipDeleteGraphics` `GdipDeleteStringFormat` `GdipDisposeImage` `GdipDrawImageRect` `GdipDrawString` `GdipFree` `GdipGetImageEncoders` `GdipGetImageEncodersSize` `GdipGetImageHeight` `GdipGetImageWidth` `GdipGetPropertyItem` `GdipGetPropertyItemSize` `GdipGraphicsClear` `GdipSaveImageToFile` `GdipSetStringFormatAlign` `GdipSetStringFormatLineAlign` `GdiplusShutdown` `GdiplusStartup`
KERNEL32.dll	`CloseHandle` `CreateEventA` `CreateEventW` `CreateSemaphoreA` `DeleteCriticalSection` `DuplicateHandle` `EnterCriticalSection` `FindClose` `FindFirstFileW` `FindNextFileW` `FormatMessageA` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetFileAttributesExW` `GetFileAttributesW` `GetLastError` `GetModuleHandleA` `GetProcAddress` `GetProcessAffinityMask` `GetStartupInfoW` `GetSystemTimeAsFileTime` `GetThreadContext` `GetThreadPriority` `GetTickCount` `InitializeCriticalSection` `IsProcessorFeaturePresent` `LeaveCriticalSection` `LocalFree` `OpenProcess` `OutputDebugStringA` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `ReleaseSemaphore` `ResetEvent` `ResumeThread` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetEvent` `SetLastError` `SetProcessAffinityMask` `SetThreadContext` `SetThreadPriority` `SetUnhandledExceptionFilter` `Sleep` `SuspendThread` `TerminateProcess` `TlsAlloc` `TlsGetValue` `TlsSetValue` `TryEnterCriticalSection` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WaitForSingleObject`
MFPlat.DLL	`MFShutdown` `MFStartup`
MFPlay.DLL	`MFPCreateMediaPlayer`
api-ms-win-crt-convert-l1-1-0.dll	`mbrtowc` `mbsrtowcs` `strtoul` `wcrtomb`
api-ms-win-crt-environment-l1-1-0.dll	`__p__wenviron` `getenv`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc` `realloc`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale` `localeconv`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-private-l1-1-0.dll	`__intrinsic_setjmp` `longjmp` `memchr` `memcmp` `memcpy` `memmove` `strchr`
api-ms-win-crt-runtime-l1-1-0.dll	`__p___argc` `__p___wargv` `__p__wcmdln` `_assert` `_beginthreadex` `_cexit` `_configure_wide_argv` `_crt_atexit` `_endthreadex` `_errno` `_exit` `_seh_filter_exe` `_initialize_wide_environment` `_initterm` `_initterm_e` `_set_app_type` `_set_invalid_parameter_handler` `abort` `exit` `strerror`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `__stdio_common_vsprintf` `__stdio_common_vswprintf_s` `_read` `_write` `fflush` `fputc` `fputs` `fwrite` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`_strdup` `_wcsicmp` `memset` `strcmp` `strlen` `strncmp` `strnlen` `wcscmp` `wcslen` `wcsncpy_s` `wcsnlen`
api-ms-win-crt-utility-l1-1-0.dll	`rand_s`
ole32.dll	`CoInitializeEx` `CoTaskMemFree` `CoUninitialize`
SHELL32.dll	`DragAcceptFiles` `DragFinish` `DragQueryFileW` `SHBrowseForFolderW` `SHGetPathFromIDListW`
SHLWAPI.dll	`PathFileExistsW` `PathFindExtensionW` `PathFindFileNameW`
USER32.dll	`AppendMenuW` `BeginPaint` `CreateMenu` `CreatePopupMenu` `CreateWindowExW` `DefWindowProcW` `DestroyWindow` `DispatchMessageW` `EndPaint` `FillRect` `GetClientRect` `GetKeyState` `GetMessageW` `GetWindowRect` `InvalidateRect` `KillTimer` `LoadCursorW` `LoadIconW` `MessageBoxW` `MoveWindow` `PostQuitMessage` `RegisterClassW` `ReleaseCapture` `SendMessageW` `SetCapture` `SetCursor` `SetTimer` `SetWindowTextW` `ShowWindow` `TranslateMessage` `UpdateWindow`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2f0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.68632`
Detected Filetype	PNG graphic file
MD5	`d2da9d800d9d053aa59ac0097b509a3d 🔍`
SHA1	`d433a4a7dae784cdbd0dc0588acf91ec13b99f77 🔍`
SHA256	`7b931c98800b6577c0e10a1d8e0ebfe9df6433dfd595bd09d524aa6fc53d45ee 🔍`
SHA3	`80892141a41d2e1ef09b947b1584240b13572cebae5398123018134e99d41db1 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6dc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.89524`
Detected Filetype	PNG graphic file
MD5	`88a942594c1ca4daadad6d3b62f178ff 🔍`
SHA1	`706a83da2de62f281397265e848ddfb9248b9ac4 🔍`
SHA256	`52d7c30c3fd9edd7d8584c1b3b87e61d8e0821271f55755e93ee2fbe32837d1c 🔍`
SHA3	`c5990f5e6f7b425daab5caa1688ffaef18d944876dbb1dc0670632e764d1a484 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xb0d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.91606`
Detected Filetype	PNG graphic file
MD5	`38e6d2ea2f9053933bf54f9840809f85 🔍`
SHA1	`13a2c4bc83e2d518014ef7475c59c5bd219409f4 🔍`
SHA256	`31027907405abe9aefd0abde83bd41004ece41fa16f0f39e1ff6c830edbee90d 🔍`
SHA3	`d4dc795f4c5bb1d7d77bea420413f42d86278026edff341d834d9e3ac84f193c 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xed6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9364`
Detected Filetype	PNG graphic file
MD5	`1a65b98fd4de0527ce41891fadbbf7a2 🔍`
SHA1	`37d955db7f455d38179540d388118878b3ccbb9c 🔍`
SHA256	`78ce1a2b2234b6641b62156d953667ef3654654329cf8e3168fcd2943682f38b 🔍`
SHA3	`8059c3081a2db573fdabe18504522caeb838a9dab03bc2c59f07ee41fb8db3dc 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1cfb`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95798`
Detected Filetype	PNG graphic file
MD5	`126a8c0e960f7fd6f7e6c6041de10dd2 🔍`
SHA1	`b860af09eca6884a396dfe9fe4060ceb870e13cf 🔍`
SHA256	`ad59bcfc292bd4a498e414c75301fb3843a0e57e57094194d5ea703780942ff9 🔍`
SHA3	`274bb09012a530a03d68da8eef649a323b3059b1f42e3c738b2bfd3d1e4467a9 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xbac`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.68189`
Detected Filetype	PNG graphic file
MD5	`6cc71e1329adf4c906b07cfc3bbc57bf 🔍`
SHA1	`847304a9c37c59c49ded6777d6e27abcba36ce6a 🔍`
SHA256	`428e02999388f781b5c879fefb9b78625fc3609e5e22a79f49770498c4118bb7 🔍`
SHA3	`12c474caf94fe082a293359695ea5fe9c736c2a43d6aecb785f3e4a6d12a77b6 🔍`

101

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.79371`
Detected Filetype	Icon file
MD5	`a6a62a191402812c5fd8a057e5a93076 🔍`
SHA1	`379012673c63be94b366258e2ea26f5478362d78 🔍`
SHA256	`7ad69f41af77af74051c128ac05558d4de5d7b7bc0c8cbcc16f2d14d274f8cfe 🔍`
SHA3	`833617385e9e02651748f576ac376039dfeb4795bee1a0d6b01ffa7a9555ba54 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2c6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.31884`
MD5	`9ad96638d72bbbbc6440da9c856e4c39 🔍`
SHA1	`29afb0ef053afc70b447be919383f8c8fd562df9 🔍`
SHA256	`e989bc9ba32a3f5b1f5a565d5971e07462a2d6a504e7af682bd36cc8cc263f29 🔍`
SHA3	`bc609fa29e449d5658a65d53fff8f9bf73c07e46d140fc507870fc7b6a6f9857 🔍`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x140049000`
EndAddressOfRawData	`0x140049018`
AddressOfIndex	`0x140037010`
AddressOfCallbacks	`0x14003d4c8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000140019440`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.