| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Oct-31 09:15:24 |
| Detected languages |
Chinese - PRC
English - United States |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 1/69 (Scanned on 2026-10-03 07:38:15) | APEX: Malicious |
| MD5 | 2a11a99e9722eecfbed888e31d73d707 🔍 |
|---|---|
| SHA1 | 4e191d5a3ad73929c5f523c4f9a6ac347a0fd25d 🔍 |
| SHA256 | 7657e4c00de35f5272eec5b8d513b36b4e0767bb941668aa37677f3f9a3d4162 🔍 |
| SHA3 | 9d872c900cf59ac835f7114a240557e539ae15517d72aa5eb09f1df7aae5cd84 🔍 |
| SSDeep | 49152:aDhllnXDwz1ZHJoEn3CmcKmcoq/0qAOkFqKTtdqw:y/gjmKQq/WpR 🔍 |
| Imports Hash | 37521311375be933263c5295120fe8b7 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2025-Oct-31 09:15:24 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x26f800 |
| SizeOfInitializedData | 0x180a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000022C674 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3f5000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | fe364f42137247af481a0a9b374ccd71 🔍 |
|---|---|
| SHA1 | 32940c690ea6437ba7f227c28eec0ab678641ce8 🔍 |
| SHA256 | 6e01e2fdee500cd8af3b8f3e77ee54946d66c8935b8852f96af67db36573a4a6 🔍 |
| SHA3 | 097824393966c8bf1207cda2c588289073c0ad57d976e83febeccf1156a87eb8 🔍 |
| VirtualSize | 0x26f610 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x26f800 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.50441 |
| MD5 | 1f52ad56d6cfef287efa4ef12d43c327 🔍 |
|---|---|
| SHA1 | d456dfe445f69e69eeb00c8f2adb391b2952e9c5 🔍 |
| SHA256 | bbcc24f54cc925d4b321cb86d688b4e48e995135ac0380a74716ff30ac87eee3 🔍 |
| SHA3 | 89ba4f98a3ab794941fd4e6b961135fece05d571141f0c72e37cbfb142dfba04 🔍 |
| VirtualSize | 0xf3d14 |
| VirtualAddress | 0x271000 |
| SizeOfRawData | 0xf3e00 |
| PointerToRawData | 0x26fc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.15789 |
| MD5 | 9819927bf8464f2f7692c0748f05ebe0 🔍 |
|---|---|
| SHA1 | 1e9fb8dc4625eb70148040a00f815501c20708f5 🔍 |
| SHA256 | db9078a780e595c4d6b0b4bbee15015a5b091b0a10533994e395f00672bfee3f 🔍 |
| SHA3 | ca99e0979088040e9bb00e94678e1b4f9246934f7691bfc0dc90a5d1ea144f87 🔍 |
| VirtualSize | 0x12d60 |
| VirtualAddress | 0x365000 |
| SizeOfRawData | 0xf000 |
| PointerToRawData | 0x363a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 5.03217 |
| MD5 | f9d7e79bd84492f8b7a9f3954fcb532b 🔍 |
|---|---|
| SHA1 | e6208005d5b88377318fbc1eb353ef965fd4687a 🔍 |
| SHA256 | 17485e00ce4e0f1aefd3314edec0144d3e57850f18a8cfd5a8a355b7ec76001f 🔍 |
| SHA3 | 7630d581301a1d8ed30b81d79fc20f27f7896bfb2269cadf0d8cd8b42d1ea6f3 🔍 |
| VirtualSize | 0x19b78 |
| VirtualAddress | 0x378000 |
| SizeOfRawData | 0x19c00 |
| PointerToRawData | 0x372a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.31005 |
| MD5 | 4dc6d5af19dfd5423ae10eef2964aa75 🔍 |
|---|---|
| SHA1 | 2b9b65237bbd8e43f909888a4e4710e84127ea71 🔍 |
| SHA256 | 3dd22c381f96c43467b586a67435b0434fae067d85116ec66c3186f34ec1c465 🔍 |
| SHA3 | 017ca14bbb05a8cd6deac7aba1b3ee6a1c28939297b3f492ee5e7d96e446614a 🔍 |
| VirtualSize | 0xf4 |
| VirtualAddress | 0x392000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x38c600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.42558 |
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x100 |
| VirtualAddress | 0x393000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x38c800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
| MD5 | 1d321313e419231b205bdb05b4388dbf 🔍 |
|---|---|
| SHA1 | 9b17daf9247a79234809c1d0c45cbf7c4f1cffcf 🔍 |
| SHA256 | 83430f52f828fd3c7927036557c84579490a67338de96ef8b0b0ef34efb676aa 🔍 |
| SHA3 | 0582e857ef55fd6dc38c239806c0d3d3d69a238f549260605b778757d243a9e6 🔍 |
| VirtualSize | 0x5a8f0 |
| VirtualAddress | 0x394000 |
| SizeOfRawData | 0x5aa00 |
| PointerToRawData | 0x38ca00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.17061 |
| MD5 | 328b053a05e696730ad0e19d1caf0746 🔍 |
|---|---|
| SHA1 | bc5d82251dd9aac96902c301028f6e8516a1d2bc 🔍 |
| SHA256 | b740ef0240e2f3888013fc19bef64ce33ee112f41405ec5fc122cd224ea32447 🔍 |
| SHA3 | c237dc2f5d864088de66e8312e4a1b0456862821f8873eb4d536ecca18e44075 🔍 |
| VirtualSize | 0x533c |
| VirtualAddress | 0x3ef000 |
| SizeOfRawData | 0x5400 |
| PointerToRawData | 0x3e7400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.44748 |
| WINMM.dll |
timeBeginPeriod
timeEndPeriod |
|---|---|
| KERNEL32.dll |
GetLastError
QueryPerformanceFrequency GlobalAlloc LoadLibraryW GetProcAddress GlobalLock GetModuleHandleW FreeLibrary WideCharToMultiByte QueryPerformanceCounter GlobalUnlock MoveFileW ExitProcess CreateFileW ReadFile WriteFile CloseHandle TlsAlloc HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetACP IsValidCodePage FindFirstFileExW FlushFileBuffers HeapReAlloc GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA GetStdHandle GetFileAttributesW FindClose GetModuleFileNameW FindNextFileW SetEndOfFile FindFirstFileW WriteConsoleW GetOEMCP TlsSetValue GetModuleHandleExW RtlUnwind SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW TlsGetValue LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime LoadLibraryExW TlsFree WaitForSingleObjectEx Sleep GetCurrentThreadId FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx |
| USER32.dll |
GetCursorPos
ReleaseDC DefWindowProcW AdjustWindowRectEx GetKeyState GetWindowRect DestroyWindow GetDC MessageBoxW SetWindowLongPtrW CreateWindowExW ScreenToClient UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow OpenClipboard GetCapture DispatchMessageW ClientToScreen CloseClipboard EmptyClipboard PeekMessageW TrackMouseEvent MoveWindow TranslateMessage GetClipboardData LoadIconW LoadCursorW SetCapture SetClipboardData SetCursor GetClientRect IsClipboardFormatAvailable PostQuitMessage SetProcessDPIAware ReleaseCapture SetForegroundWindow |
| GDI32.dll |
ChoosePixelFormat
CreateSolidBrush SwapBuffers SetPixelFormat GetPixel |
| COMDLG32.dll |
GetSaveFileNameW
GetOpenFileNameW |
| SHELL32.dll |
DragAcceptFiles
SHFileOperationW DragFinish DragQueryFileW |
| OPENGL32.dll |
glGetError
glGetString glTexSubImage2D glDepthFunc glPixelStorei wglMakeCurrent glPushMatrix glDisable glMultMatrixf glClearDepth glScalef glGetTexImage glColor3ubv glColorPointer glColor4ub glFlush glRasterPos2i glTexImage2D glTranslatef wglDeleteContext glDrawArrays glClearColor glTexCoordPointer glBegin glReadBuffer glDeleteTextures glColor4ubv glFinish glTexParameteri glVertex3fv wglGetProcAddress glColorMask wglCreateContext glReadPixels glBlendFunc glLineWidth glFrontFace glMatrixMode glDisableClientState glEnd glLoadMatrixf glDepthMask glVertex3f glEnable glVertexPointer glGenTextures glBindTexture glTexSubImage1D wglShareLists glPolygonOffset glClear glEnableClientState glTexImage1D glViewport glPopMatrix glNormal3fv glColor3fv glPointSize glGetIntegerv glLoadIdentity glNormalPointer |
| VCOMP140.DLL |
_vcomp_fork
_vcomp_reduction_i4 _vcomp_for_static_end _vcomp_for_static_simple_init |
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.32941 |
| MD5 | ca0274e7af5a9a741e745adc6e1a50e6 🔍 |
| SHA1 | df0ac56958f3c087a0df3652bc5cc51c21f93425 🔍 |
| SHA256 | 25773844cf7d6ee83660bad673221ace0569f8347d835e412558c2496eb5cbb7 🔍 |
| SHA3 | 9d19556d9a8048da9a372e3087b9da7710e30ffeb4829c8417877584896c1c76 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.79388 |
| MD5 | 82deb475ee3df81bf4214781857bcb81 🔍 |
| SHA1 | 6004be511799c0b7cf9e58b38a410b8d6cb8ad20 🔍 |
| SHA256 | ba367220032432613205936a45b1fe612806dd4b039d32d4f6fc62f0aece9c9f 🔍 |
| SHA3 | 0b827ababf6180d52910395252bc15ebc505ecb2cc369ed94ba283507844baff 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.45152 |
| MD5 | 9cf51cfcb0262eba54719c3be92d0372 🔍 |
| SHA1 | 9834a0f8e2394865f339424a9dae2871c048fc48 🔍 |
| SHA256 | 44fc956137ee068efdfba6bc6ba4eb1d319deea6f89cd56bc8a066cff13f8a56 🔍 |
| SHA3 | aa48f60c854f056850dbb92f0b18a31a962e34dd27d1edec4a70c9cbe3776777 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.44338 |
| MD5 | f6c9cd2b7614a90748a6b455683f0825 🔍 |
| SHA1 | f5bc96b60c87d02a8e16d2b79341e6e4ef23c1c5 🔍 |
| SHA256 | 43cd6d773cb23f32c19488ff464af9d172e7d198a45e421af22fbdfa77739843 🔍 |
| SHA3 | 818535661cb7c80f19d811b68570cc7ca84f4f15b2df04febb0326490ee0aee1 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.20841 |
| MD5 | 8a61b288b084e096d19c11d93f0ff409 🔍 |
| SHA1 | ea4927fd22a3443d071fe1229a7cfbe61877645b 🔍 |
| SHA256 | c7db7c59ea3cd0d710659be23ebb6373fbb491e14dfdbf3950c5abb56caa1edb 🔍 |
| SHA3 | fb1601653252799327475f4264292c6557f76f297fe873101f354188b0ae5b8f 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x42028 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.07927 |
| MD5 | c26f1532e7b06e8cc5aeed5643e9d1a8 🔍 |
| SHA1 | 13261463a8e7fced45f560db8b7ac0195668c7b6 🔍 |
| SHA256 | a0711d96e31213877e29e093ed4224c072fee6ad17ae7ec59150b04275c68b5e 🔍 |
| SHA3 | 885764620e6995802a0edbd3658ab3ef0dd53bdc7b2ed1e4140cd22e65bcd744 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Chinese - PRC |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.76511 |
| Detected Filetype | Icon file |
| MD5 | 61e58469fe660c213ebc6e2cc66cbafc 🔍 |
| SHA1 | c47479da87d8390f935b337e91bdbedcc739b3eb 🔍 |
| SHA256 | c369bebe3271775e43301281caa7efcd03938e3bc1f620212d6c5617edaad403 🔍 |
| SHA3 | 7c04647ad931cbf1b5c005cebc686d11b461a50e14ba9aa560e6cc1749adcb2f 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Oct-31 09:15:24 |
| Version | 0.0 |
| SizeofData | 1048 |
| AddressOfRawData | 0x3373d8 |
| PointerToRawData | 0x335fd8 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Oct-31 09:15:24 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x140337838 |
|---|---|
| EndAddressOfRawData | 0x140337840 |
| AddressOfIndex | 0x14037506c |
| AddressOfCallbacks | 0x140271928 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140365240 |
| XOR Key | 0x30b475c9 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33140) | 188 |
| C objects (33140) | 39 |
| ASM objects (33140) | 29 |
| Unmarked objects (#2) | 1 |
| Imports (30034) | 2 |
| 253 (28518) | 1 |
| C objects (30034) | 18 |
| ASM objects (30034) | 13 |
| C++ objects (30034) | 91 |
| Imports (33140) | 15 |
| Total imports | 272 |
| C objects (VS2019 Update 11 (16.11.14-15) compiler 30145) | 27 |
| C objects (VS2022 Update 2 (17.2.5-6) compiler 31332) | 45 |
| C++ objects (LTCG) (VS2019 Update 11 (16.11.14-15) compiler 30145) | 45 |
| Resource objects (VS2019 Update 11 (16.11.14-15) compiler 30145) | 1 |
| 151 | 1 |
| Linker (VS2019 Update 11 (16.11.14-15) compiler 30145) | 1 |
No comments yet.