7a21ba4e58fc1d20c457810571758041eee89bf85dbd93d146c5194c546e8d58

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-15 15:02:16

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
 Manipulates other processes:
  • OpenProcess
  • Process32FirstW
  • Process32NextW
Suspicious The file contains overlay data. 12355545 bytes of data starting at offset 0x5a400.
The overlay data has an entropy of 7.9982 and is possibly compressed or encrypted.
Overlay data amounts for 97.095% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 b78b6c54f85e20b5acc26c524a1dd99f 🔍
SHA1 310be7cb606781e8c2988ab093a0fb215c7d079b 🔍
SHA256 7a21ba4e58fc1d20c457810571758041eee89bf85dbd93d146c5194c546e8d58 🔍
SHA3 7e622aa0af106add8f5e10f613b9f62efb93711e06a6b467a0d620e059254f6c 🔍
SSDeep 393216:w1A8gHyjPZE34J0GgKibuf7EECSoiHVBSC71M9PK:wCG+OEKoECziHVB/W 🔍
Imports Hash e3e80a143805ea18936c8f612e25d363 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Oct-15 15:02:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x32000
SizeOfInitializedData 0x28000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000E770 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x62000
SizeOfHeaders 0x400
Checksum 0xc2d7ea
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5c1d0671232b92bd70fcd311921f85d8 🔍
SHA1 50b27ae7bf9de958e48a011a91a93e6d92e52bbd 🔍
SHA256 67bdc7f5eeccf01180cd5b3621be7d0265efa6a44742496a7a6c6f9076ef4b1f 🔍
SHA3 44213c985ebb26cbdb3a14609c9c9640e67eaee33108c6535e25ae07005bd14a 🔍
VirtualSize 0x32000
VirtualAddress 0x1000
SizeOfRawData 0x32000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48583

.rdata

MD5 c68281418d14cf0388071ab1c560e2d3 🔍
SHA1 d30fc862ba8ae3bb97c1c807f95141cb88726577 🔍
SHA256 d7fb460b57b1962ab3d8a072d35a647ae7c5d6c1b4931ae3768bfd925ae7c426 🔍
SHA3 4c1c3a4614f52f8f1c306fafc0d81be8cbb7eaad3f190237923f7a82bc0eafb8 🔍
VirtualSize 0x14954
VirtualAddress 0x33000
SizeOfRawData 0x14a00
PointerToRawData 0x32400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.70312

.data

MD5 954eb046773252153f4899a4edd122ea 🔍
SHA1 3e95993a0d765a7b0568d7f91bf4985f5d957f18 🔍
SHA256 f999ee89612700ed57df416c1025d22e69bf061e54903f34ecf2398e8d8b0627 🔍
SHA3 e166d3147f10f8c7d9f18b48a68a9a957a7f019b4cf63a25ffaa2d66de6db7a1 🔍
VirtualSize 0x4af8
VirtualAddress 0x48000
SizeOfRawData 0xe00
PointerToRawData 0x46e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.81694

.pdata

MD5 5bcb3226ba293f62cbcb0c82dfa00c46 🔍
SHA1 ad8534e52285d5b852e8005f8715aa222df1e0c9 🔍
SHA256 f33be2799dafcdfb77a394fd72134a9a838822f9fa500e5381029f152423c278 🔍
SHA3 42854eefb3a580302a0a88825ef9bb225f073e893924d432ecef69af1f44fc9a 🔍
VirtualSize 0x276c
VirtualAddress 0x4d000
SizeOfRawData 0x2800
PointerToRawData 0x47c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.47028

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x50000
SizeOfRawData 0x200
PointerToRawData 0x4a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 7fcb315ccda51350462cd0f780748c50 🔍
SHA1 a2d3f4571e3e5d0e93fa46c6f479164cc410228f 🔍
SHA256 2d08ae80219b17a8b017b2c3896b25e1d25d8dc53618e4168832e3e10b64bfe9 🔍
SHA3 9e07df7287c752f89323171be52398e86e69c8220e5a8737bc92520bdef0b01f 🔍
VirtualSize 0xf41c
VirtualAddress 0x51000
SizeOfRawData 0xf600
PointerToRawData 0x4a600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.55488

.reloc

MD5 b09b4e3bc6927c160ce8504826e824e7 🔍
SHA1 8cd13d56118b51568ceae228b22bac9713b80594 🔍
SHA256 f10e5c9b3cca6292a947f527a24f91802bd207c348624b01187ef083a85a07ed 🔍
SHA3 795b22dbfcf37382cd85fe655d07e0be4fb573655a40c8329bf9bd5fef974819 🔍
VirtualSize 0x760
VirtualAddress 0x61000
SizeOfRawData 0x800
PointerToRawData 0x59c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.25159

Imports

USER32.dll CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
ADVAPI32.dll GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15653
MD5 15d6a8563184abef13a1ee75aea262ad 🔍
SHA1 d7d896432efd845f283f2b98a66486df05bf5e10 🔍
SHA256 7cccfafd00332ac9c9f6ac0112cc0653991eb169943919e55d05f3fa15929821 🔍
SHA3 93904dad7224f31021bf8d53753e553f8233c2f40f6dbe25e67b692c6ae378ab 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.44895
MD5 1c06420cfb94514d35c088699a04774d 🔍
SHA1 2c23d7df4bc8ce3fb15f33e78c042b12814aea3b 🔍
SHA256 d73c1848a067a0fd094423213dc1e855b5b29b0b441f0bcb315feb90d662972e 🔍
SHA3 a630c0bd054ccf853d3673897d2a553e10797d288b3f09898503304ecec7d7f3 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.77742
MD5 db1208cf5d76055be1c3a34567af9f5a 🔍
SHA1 c5adcd7407c8b18459e4b4ce96fb70ecf5701a97 🔍
SHA256 5a008270f7254f5ca861e9936f4b5b7a23c04d63165895234fd1782bc03ec0e5 🔍
SHA3 549076010917e74ff3fe656848779d90468b96740184b07016dbf2833e9abf99 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x952c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95095
Detected Filetype PNG graphic file
MD5 f6fbada22d6a6c07ef8fdaa504f117d5 🔍
SHA1 591a723501eff1a4920462f8efcaf3715e829450 🔍
SHA256 3919b11194f130d310dfe08bdce2891c5b64f2703107f53a5a1cbc016fdb609f 🔍
SHA3 ceca597fff3f436773eb9e48be245ce9d24439b9527a0d3aedaa1469e49d3f5c 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.0521
MD5 86ce219c337119fe35646823cb56d091 🔍
SHA1 74d3090f01f3128bda93a3a7525f139c495bffbd 🔍
SHA256 7ef5a24efde1748c0eb12c5817b14cfe1397ae968489a7824a269d02c8223cee 🔍
SHA3 8daaa7aab035df895cb478d3b92385d12aebd96c8bbde3a05a615ff56d41aebf 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.15081
MD5 58b7700e8f20d0a3c77021eb7e7019dc 🔍
SHA1 87f7668b96ab48bd6ba5c8b9968dbb024a028407 🔍
SHA256 c5536b396be6dcfc96f4e4f77cc7007b2a56730ee57598a6979cc1c1c71c920a 🔍
SHA3 13bb36cea0c569109ddca6560016003d3ce662f8e0bc189e9750019ccdc7bc72 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.39466
MD5 9de69c1c4b3a06597da9c275b38bffb6 🔍
SHA1 a4ed3bd1bb4edc0eaa187b68929f596906e9ee87 🔍
SHA256 ac2e25dc4a4f7bd96a0bcf3ea63cd1bcf26a6f6a05835e32f96ef99cb4323f30 🔍
SHA3 6ff197b54509b5c0fa643d6bdbc756cccec2b5bc8495c770883c021e833f7509 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 cd3a631eace19041876b4c4c6ec8461a 🔍
SHA1 d4b3f99c4d648e3446dc05e7fb6e444e42dfed01 🔍
SHA256 f5b94a42f1c77c9eef858a0dfd656419fea900b00318c2c0bf49c2fce345d838 🔍
SHA3 b6dcbb1b4c262eb5aee12773a52c29ff20fef809a4e61822700d005457944b9f 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae 🔍
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23 🔍
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11 🔍
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-15 15:02:16
Version 0.0
SizeofData 816
AddressOfRawData 0x43ab8
PointerToRawData 0x42eb8

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140048040
GuardCFCheckFunctionPointer 5368919256
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x43c877d4
Unmarked objects 0
C++ objects (33145) 189
C objects (33145) 12
ASM objects (33145) 11
253 (35721) 3
ASM objects (35721) 9
C objects (35721) 17
C++ objects (35721) 39
Imports (33145) 11
Total imports 163
C objects (36246) 30
Linker (36246) 1

Errors

Leave a comment

No comments yet.