Manalyze report for 7e07e8de041d2e5308cba61a3e495239c0a008306ffd2dabba12bb5632a9f4f3

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2025-Mar-27 21:11:39
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: /4`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Possibly launches other programs: system` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect VirtualProtectEx` `Manipulates other processes: OpenProcess ReadProcessMemory`
Suspicious	The file contains overlay data.	`14 bytes of data starting at offset 0xde00.`
Malicious	VirusTotal score: 3/66 (Scanned on 2026-08-09 04:56:22)	`Bkav: W32.Malware.29CD68BE` `CrowdStrike: win/malicious_confidence_60% (W)` `Cynet: Malicious (score: 100)`

Hashes

MD5	`9d2edb7eb497b155526a103bacc603e5` 🔍
SHA1	`220e322a6c01918dbcf63c24ec0e87620794851b` 🔍
SHA256	`7e07e8de041d2e5308cba61a3e495239c0a008306ffd2dabba12bb5632a9f4f3` 🔍
SHA3	`2f5c1f9583cd55bda9ea6b77093feda8253c4d10d1aedf7607dccfb62adb36bb` 🔍
SSDeep	`768:iAmitpvrQFwVOCkY6o4dNmThGIvjoI5wWrzyg1mw+VfDB4e9bLYlxR:rXrQFwVOCkZo4CVGI7oI6Wrzyg6fj/MP` 🔍
Imports Hash	`51418eea4cfa78b24118156790394f52` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`12`
TimeDateStamp	2025-Mar-27 21:11:39
PointerToSymbolTable	`0xde00`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x9600`
SizeOfInitializedData	`0xda00`
SizeOfUninitializedData	`0xe00`
AddressOfEntryPoint	`0x0000000000001320 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x36bb60000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x17000`
SizeOfHeaders	`0x400`
Checksum	`0x170b8`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`17e5df90d548219819265373a4502d59 🔍`
SHA1	`258d76e02c6f7b33e083fc6cc806ab14645cda73 🔍`
SHA256	`68ba97546828dd9e12fbd5087d6bb115a041ac45559d0ae0b5ed05c78a74e0b3 🔍`
SHA3	`d26340e4f62c54143618e366829724396cf84ef9f15f7097f7ea50ebfa187c01 🔍`
VirtualSize	`0x94f8`
VirtualAddress	`0x1000`
SizeOfRawData	`0x9600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.34007`

.data

MD5	`42a195827ede2ce366a12863dc300708 🔍`
SHA1	`b05eba38964b0561582b266fd54c068106cf63f4 🔍`
SHA256	`bdc20dd18f89819079a0c485658981ee7e30d1d4cb824e0c08784b66badb619d 🔍`
SHA3	`f9db21e49946bcc05b296d0214431b4ba1140b49c8ca964aafe2557159af6fa6 🔍`
VirtualSize	`0x3e0`
VirtualAddress	`0xb000`
SizeOfRawData	`0x400`
PointerToRawData	`0x9a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.74957`

.rdata

MD5	`a42f77cae4e885773d3231546762656f 🔍`
SHA1	`1914c7d59051f95e7432fc24378b5625dffada2a 🔍`
SHA256	`ba07d48cce1d09eed885617ffeb99eff9eaf7faa1b294977907dedd440c69e45 🔍`
SHA3	`b146734b921826c905fce91b72d73b4d12e34f3d0dbca4693ae31d09bfde975e 🔍`
VirtualSize	`0x1870`
VirtualAddress	`0xc000`
SizeOfRawData	`0x1a00`
PointerToRawData	`0x9e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.30432`

/4

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0xe000`
SizeOfRawData	`0x200`
PointerToRawData	`0xb800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`2b1599bb2c6e1390325337f5d18ad312 🔍`
SHA1	`6b34adbabebade7d9e068c7bbf8711bd5ab62adc 🔍`
SHA256	`44ace9b4f7e2468eacb3cad91400eb6347875f4cd62a61492fb59f8f1b350df9 🔍`
SHA3	`8a200f3defc34787d00e118a307f4e17ed754fde3c223e838d3f4d6ce2fc7825 🔍`
VirtualSize	`0x63c`
VirtualAddress	`0xf000`
SizeOfRawData	`0x800`
PointerToRawData	`0xba00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.7872`

.xdata

MD5	`b3b6d7dbbecba819f6cc6923af48e89d 🔍`
SHA1	`f9aaf1d9e0cc8de54fa93fd13ce89fd22300e52c 🔍`
SHA256	`a3145b4275c478379985c25da09d8c2b93c80f44b6133dfcc62184609ea8d212 🔍`
SHA3	`a4e598699b0eef2be16e710c37219d69e01ded6d5850a311b0d91ba78a77460a 🔍`
VirtualSize	`0x5e0`
VirtualAddress	`0x10000`
SizeOfRawData	`0x600`
PointerToRawData	`0xc200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.30439`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0xc10`
VirtualAddress	`0x11000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`189a1d42417e5d71b814d80094e4620a 🔍`
SHA1	`11ee37f55a68f16e5d9487be5c4d67fbf7082f31 🔍`
SHA256	`651b74fb6fb86c9cc78d2b70eb5c4366a39ae1948e23968a4ba323112872a76c 🔍`
SHA3	`6947b14dc41a65993cf6a86f2439c93be3fe6b450d20dd283bce35a3e26d4ec8 🔍`
VirtualSize	`0x47`
VirtualAddress	`0x12000`
SizeOfRawData	`0x200`
PointerToRawData	`0xc800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.765606`

.idata

MD5	`3a667690b0a30831a7fed2760f27f3fb 🔍`
SHA1	`f23875881655b826fcab90de5140ca5d58df4c77 🔍`
SHA256	`3580cfd4c8b38c98cd4e7bd4d1fe5b25e0e8834834ecdacc587d6519e92b830b 🔍`
SHA3	`91d0385b2693afb50576c14d6735571f2caf4b2cabbec9831fd3b155a95a2927 🔍`
VirtualSize	`0xcd0`
VirtualAddress	`0x13000`
SizeOfRawData	`0xe00`
PointerToRawData	`0xca00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.17019`

.CRT

MD5	`fb2f08029b34a1bccfe6210705ccc0ec 🔍`
SHA1	`71e6c0114a935039e455075cfb42837012d3d012 🔍`
SHA256	`26ce628e47439080783428b002b3198e491038c85f14d6cb394655e0944b2230 🔍`
SHA3	`119af93b7e25e9edc5625207181d2067b5c5e862d127352514175dfd8ad9b908 🔍`
VirtualSize	`0x58`
VirtualAddress	`0x14000`
SizeOfRawData	`0x200`
PointerToRawData	`0xd800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.253231`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x15000`
SizeOfRawData	`0x200`
PointerToRawData	`0xda00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`9f7d6d3219a210d540299f976780cff4 🔍`
SHA1	`b700d6ab0388652ae4c1ec281592b4fc2ab0c665 🔍`
SHA256	`f79a1b4b9410cd7423662fec64de0ea40527c5705c1f644a11df6933f65847f6 🔍`
SHA3	`52448ff951c95a7377686df3adf885dc806078701b8dd5a9d3122a44048599bd 🔍`
VirtualSize	`0x74`
VirtualAddress	`0x16000`
SizeOfRawData	`0x200`
PointerToRawData	`0xdc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`1.21539`

Imports

KERNEL32.dll	`AddAtomA` `AllocConsole` `CloseHandle` `CreateToolhelp32Snapshot` `DeleteAtom` `DeleteCriticalSection` `EnterCriticalSection` `ExitProcess` `FindAtomA` `FlushInstructionCache` `FreeLibrary` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThreadId` `GetLastError` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleW` `GetProcAddress` `GetProcessHeap` `GetSystemInfo` `GetThreadContext` `GetTickCount` `HeapAlloc` `HeapCreate` `HeapDestroy` `HeapFree` `HeapReAlloc` `InitializeCriticalSection` `IsDBCSLeadByteEx` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `MultiByteToWideChar` `OpenProcess` `OpenThread` `ReadProcessMemory` `ResumeThread` `RtlCaptureStackBackTrace` `SetThreadContext` `Sleep` `SuspendThread` `Thread32First` `Thread32Next` `TlsGetValue` `VirtualAlloc` `VirtualFree` `VirtualProtect` `VirtualProtectEx` `VirtualQuery` `WideCharToMultiByte`
msvcrt.dll	`___lc_codepage_func` `___mb_cur_max_func` `__iob_func` `_amsg_exit` `_errno` `_getch` `_initterm` `_lock` `_putws` `_unlock` `_wfopen` `abort` `atoi` `calloc` `fgets` `fputc` `free` `freopen` `fwrite` `getenv` `localeconv` `malloc` `memchr` `memcpy` `memset` `puts` `realloc` `strchr` `strcpy` `strerror` `strlen` `strncmp` `strstr` `system` `vfprintf` `wcscpy` `wcslen` `wcsrchr` `_strtoui64` `_putenv`

Delayed Imports

DllMain

Ordinal	`1`
Address	`0x1eee`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x36bb75000`
EndAddressOfRawData	`0x36bb75008`
AddressOfIndex	`0x36bb7115c`
AddressOfCallbacks	`0x36bb74030`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x000000036BB63F50` `0x000000036BB63F20`

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.