Manalyze report for 777d99fc789578236a55fe3247a6a9184b695f0b4e2cb86ab5de28a6669c5bd1

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	1970-Jan-01 00:00:00
Debug artifacts	Embedded COFF debugging symbols

Plugin Output

Suspicious	PEiD Signature:	`PeStubOEP v1.x` `HQR data file`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.Exe cmd.exe` Contains domain names: -github.com .eq.github.com .eq.golang.org .github.com .hash.net 0github.com 1github.com 3github.com 5github.com 6github.com 7github.com 9github.com api.themoviedb.org api4.thetvdb.com colorful.xyz eq.github.com eq.golang.org github.com go-colorful.xyz golang.org http://www.omdbapi.com http://www.omdbapi.com/ https://api.themoviedb.org https://api.themoviedb.org/3tls https://api4.thetvdb.com https://api4.thetvdb.com/v4boringcrypto https://github.com https://go.dev itab.github.com omdbapi.com textproto.nl themoviedb.org thetvdb.com www.omdbapi.com
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES`
Suspicious	The PE is possibly packed.	`Unusual section name found: /4` `Unusual section name found: /19` `Unusual section name found: /32` `Unusual section name found: /46` `Unusual section name found: /65` `Unusual section name found: /78` `Unusual section name found: /95` `Unusual section name found: /112` `Unusual section name found: .symtab`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: SwitchToThread`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`a3e46b8e9f6e9160487210c6f8dcba76` 🔍
SHA1	`d0f4361fa5241f5fc3ec82d5ba6e504251c35e47` 🔍
SHA256	`777d99fc789578236a55fe3247a6a9184b695f0b4e2cb86ab5de28a6669c5bd1` 🔍
SHA3	`f8412b83e3f6af379b2fd6ce4914a845d8dd320c98cb73e8ffb6541c3c1629a0` 🔍
SSDeep	`98304:bqQ+jFVRksdByzqo73wFn47y7kKpUR3pDBaEx+9PAhg68DCKuWh8Ci7a5nEe51h:bQjFHknqTnae6dHx+W18TusnRZL` 🔍
Imports Hash	`c6fb30ad4dce883317a7260ffcbc1a17` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0x8b`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`14`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0xd32a00`
NumberOfSymbols	`13383`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`3.0`
SizeOfCode	`0x472c00`
SizeOfInitializedData	`0x9a800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0008D110 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x90f000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.1`
ImageVersion	`1.0`
SubsystemVersion	`6.1`
Win32VersionValue	`0`
SizeOfImage	`0x2e34000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`820c76a98472a5d8b92ee3e2939972c7 🔍`
SHA1	`fa8f54c2dd3d6a44845afc513a636d479db66472 🔍`
SHA256	`1f5c02fd5461d0f785e3e648bd175b5714bcf79abdb126615f787a276688cdc7 🔍`
SHA3	`f95b70547ab667b1ba7f07d1cddca7d56f4a4c3b8dc1d11d11090cfd82a05745 🔍`
VirtualSize	`0x472a8e`
VirtualAddress	`0x1000`
SizeOfRawData	`0x472c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.01981`

.rdata

MD5	`ac2b1fee48a1f361a3f84875dc3f23a4 🔍`
SHA1	`f71aa9b9f70527f98c785d26d0d214bcd41ccb3b 🔍`
SHA256	`5898a743a2ca776f588c17529b67b77eca2118089282c1ec5f633f291d6b0391 🔍`
SHA3	`dbafdcb6463a404c903351bc907aff321b97b48d958758365211199dfc12e5a0 🔍`
VirtualSize	`0x49aec8`
VirtualAddress	`0x474000`
SizeOfRawData	`0x49b000`
PointerToRawData	`0x473000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.66989`

.data

MD5	`db57413dd2f558596db75ace0ac94001 🔍`
SHA1	`4f7657f71dc7ad48577bd118b2bcaa310e1ac352 🔍`
SHA256	`e879717aedf83cec2f44a1b5a522b5d1c20e9e774de616aa884d36e0df218441 🔍`
SHA3	`1833b0ad19a18ed4c7a79cce0eb0e6ca256ca28cb18f2059036d36c8e8658929 🔍`
VirtualSize	`0x20cc180`
VirtualAddress	`0x90f000`
SizeOfRawData	`0x9a800`
PointerToRawData	`0x90e000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.18012`

/4

MD5	`bcddef00414a946919302442928e542e 🔍`
SHA1	`b0fbeae40093e8241edcbdeae94ba06880dedf04 🔍`
SHA256	`fb7bf682d27ba8920146a9b134a183cd2109b202916488b9b3a4f7d623f0b484 🔍`
SHA3	`7d5b252590738bde977b6dfab9c3034c2ad82b952980a3585c1dc88e1f06f005 🔍`
VirtualSize	`0x154`
VirtualAddress	`0x29dc000`
SizeOfRawData	`0x200`
PointerToRawData	`0x9a8800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.67257`

/19

MD5	`b4e4a31f914c9a60c47c56ff50b131d7 🔍`
SHA1	`5e79abfad83472a83c415167fe8286d847869799 🔍`
SHA256	`f589543f1e73c4f9bcb3e24636ea92e1f98c95d9b36fa48babb6962a40ee1b61 🔍`
SHA3	`e8f2b0b323151adceb4bef9ae8a787a50dde2bd1c1dff46e84386460686633a6 🔍`
VirtualSize	`0xc2a2c`
VirtualAddress	`0x29dd000`
SizeOfRawData	`0xc2c00`
PointerToRawData	`0x9a8a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99713`

/32

MD5	`1888e35f576b4c7b7c852ec2aaedac09 🔍`
SHA1	`750c881dfc4a0310672dd3ca1fcb0956e638d90f 🔍`
SHA256	`3fa2c9a8de96073e23448cc0cea8e615651fadb767709fcae918a3ff0408d87c 🔍`
SHA3	`74699a0159016e65964d846221804c370532ee918a9a8ff38aa1460ccf8aead8 🔍`
VirtualSize	`0x224da`
VirtualAddress	`0x2aa0000`
SizeOfRawData	`0x22600`
PointerToRawData	`0xa6b600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.98075`

/46

MD5	`56d08c10aa9e5c0c3680f67f8992b3d4 🔍`
SHA1	`5c31bb8cb4724831186f4adf11b6a46cba1b7936 🔍`
SHA256	`3edf472b3815ca8cab6b3efd8773b22c8a567a0ec7f5ce7b1a9b30e2a22b0258 🔍`
SHA3	`0e65aaf1cebf5c5fcda0ebafc01834bf7378c916495ab10752a8a034209a6034 🔍`
VirtualSize	`0x2a`
VirtualAddress	`0x2ac3000`
SizeOfRawData	`0x200`
PointerToRawData	`0xa8dc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.73721`

/65

MD5	`57078dd8d9d2ee7367ae7062629ef333 🔍`
SHA1	`281bf499f90ce9ad2ecdfc45104f310243529aab 🔍`
SHA256	`18119765a1b98d7f99d43289745779379cb4bbfac697c3e933f5ffb71431d939 🔍`
SHA3	`bd7ed00c63a5c30c261c46e7ede93afeda61d8b99eec68d4534af2de95f5b19d 🔍`
VirtualSize	`0x15c251`
VirtualAddress	`0x2ac4000`
SizeOfRawData	`0x15c400`
PointerToRawData	`0xa8de00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99861`

/78

MD5	`f1c54e5db9ef9b4ed2fcc3699a528008 🔍`
SHA1	`df4e30d07dd4443474c5d15698ceef59d44f16d2 🔍`
SHA256	`a51c951c9f6811b3c9237738d69195bb0bfd027d920fb5d7cdb86471da94f517 🔍`
SHA3	`bddc2652bef3157a9c3de6c1a1340e2ae2a2d594eb86688c0cae4eed7b097bbe 🔍`
VirtualSize	`0xb8053`
VirtualAddress	`0x2c21000`
SizeOfRawData	`0xb8200`
PointerToRawData	`0xbea200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99834`

/95

MD5	`2830f64ace059d8b29d22ada93186a63 🔍`
SHA1	`cd6d03fd699d01570390ce12f7f059ba59cea16f 🔍`
SHA256	`e6b378c241f684750e552e9d2a2228943dc3ef5409fbfb9ba7a0aacb95f7584f 🔍`
SHA3	`59a66693de31e586fecbe54358ac2c07183a91e6664beedd08e4b4e7aee8f7ac 🔍`
VirtualSize	`0x4f55c`
VirtualAddress	`0x2cda000`
SizeOfRawData	`0x4f600`
PointerToRawData	`0xca2400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99541`

/112

MD5	`e1630d2d2ad0bfa74daa8916198d70d8 🔍`
SHA1	`b638df46a44a592e81618e47bd6efb2391c390ef 🔍`
SHA256	`a8df39fb6b530d9011d3b285d204f70a7b4061b1f8bbc215c3641a7f36383d99 🔍`
SHA3	`46547387d76e46e340a367e1d9d76c5827a94f1e88f19a0ca0a19e4c1e72e5fb 🔍`
VirtualSize	`0x744d`
VirtualAddress	`0x2d2a000`
SizeOfRawData	`0x7600`
PointerToRawData	`0xcf1a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.93839`

.idata

MD5	`5352acba68fa614d1b163fe3fc44c80e 🔍`
SHA1	`b9fae2229d4444bf91485ecdfd706a989355e644 🔍`
SHA256	`0fa16f562748c9f0d60e85c7d7536037008c2e4626fc8cb4637ff87ded6491a4 🔍`
SHA3	`fb2f3afee56e162c831af4f463eb20b0796f1cff7526c80f03b5bec48615d154 🔍`
VirtualSize	`0x482`
VirtualAddress	`0x2d32000`
SizeOfRawData	`0x600`
PointerToRawData	`0xcf9000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.17429`

.reloc

MD5	`1f70ce28e3d0114b817df0d4d997398e 🔍`
SHA1	`fed355c252cc62c451c4ed86a2a996cc8c2fcb7f 🔍`
SHA256	`683d4e887428b511ff839a798f811317c1be7642b095b9082d267199e18fbefa 🔍`
SHA3	`58a63562a0139b024cdf89e1e17b6777adefa52bd8c32d1ea311f1a2c6e6ec7c 🔍`
VirtualSize	`0x392a0`
VirtualAddress	`0x2d33000`
SizeOfRawData	`0x39400`
PointerToRawData	`0xcf9600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.62538`

.symtab

MD5	`2561a698ebc6892925448a8c3ccac180 🔍`
SHA1	`b26f6af1efe0ceea6d06b58c0218bc8119beb136 🔍`
SHA256	`47e4dca520beccfe9e052167c955c872bedad9856fe1d64b4004cf786043f674 🔍`
SHA3	`d229d30243f9a861b1a9731ac2364ca2c8a3764b43ebac6621df28fd3a50a7a0 🔍`
VirtualSize	`0xc651f`
VirtualAddress	`0x2d6d000`
SizeOfRawData	`0xc6600`
PointerToRawData	`0xd32a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.43841`

Imports

kernel32.dll	`GetProcAddress` `LoadLibraryExW` `WriteFile` `WriteConsoleW` `WerSetFlags` `WerGetFlags` `WaitForMultipleObjects` `WaitForSingleObject` `VirtualQuery` `VirtualFree` `VirtualAlloc` `TlsAlloc` `SwitchToThread` `SuspendThread` `SetWaitableTimer` `SetUnhandledExceptionFilter` `SetProcessPriorityBoost` `SetEvent` `SetErrorMode` `SetConsoleCtrlHandler` `ResumeThread` `RaiseFailFastException` `QueryPerformanceCounter` `PostQueuedCompletionStatus` `LoadLibraryExW` `SetThreadContext` `GetThreadContext` `GetSystemInfo` `GetSystemDirectoryA` `GetStdHandle` `GetQueuedCompletionStatusEx` `GetProcessAffinityMask` `GetProcAddress` `GetErrorMode` `GetEnvironmentStringsW` `GetCurrentThreadId` `GetConsoleMode` `FreeEnvironmentStringsW` `ExitProcess` `DuplicateHandle` `CreateWaitableTimerExW` `CreateThread` `CreateIoCompletionPort` `CreateEventA` `CloseHandle` `AddVectoredExceptionHandler`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Tried to read outside the COFF string table to get the name of section /19!
[*] Warning: Tried to read outside the COFF string table to get the name of section /32!
[*] Warning: Tried to read outside the COFF string table to get the name of section /46!
[*] Warning: Tried to read outside the COFF string table to get the name of section /65!
[*] Warning: Tried to read outside the COFF string table to get the name of section /78!
[*] Warning: Tried to read outside the COFF string table to get the name of section /95!
[*] Warning: Tried to read outside the COFF string table to get the name of section /112!

Leave a comment

No comments yet.