8524958667b651f8ae09026a766c7348c16dd3eae8ea917dfd97feacd75f169e
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-16 01:27:37 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
Plugin Output
| Suspicious | The PE is possibly packed. | Unusual section name found: .buildid |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 93.0311% of the executable. |
| Safe | VirusTotal score: 0/71 (Scanned on 2026-09-27 21:49:13) | All the AVs think this file is safe. |
Hashes
| MD5 | c0db16dceaaad5763447d4d3466c6154 🔍 |
|---|---|
| SHA1 | 14c205595f257864045462cfe4e1d05536a01fb0 🔍 |
| SHA256 | 8524958667b651f8ae09026a766c7348c16dd3eae8ea917dfd97feacd75f169e 🔍 |
| SHA3 | 6a087cff9389af0eba26784900defdf7576aec439b6561b9351d0e24171f80b5 🔍 |
| SSDeep | 1536:2JQ4Cvri5zsBS/Z0Eos2+vVOFWFDYwKcbRZ5aGcNv1UzOnyUnnnM3a:MQ4wr2zuS/Z0Eop+vVOF3uboGjz6XnM 🔍 |
| Imports Hash | 8d88ee3d02e50123906bab082925025d 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-May-16 01:27:37 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1a00 |
| SizeOfInitializedData | 0x17a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001160 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x3c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x45417 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | e350e5d12b865f27b329760233d88fdc 🔍 |
|---|---|
| SHA1 | 0a5636c2cc88eff9cd8516bcf375a5823c8a5ec2 🔍 |
| SHA256 | c5bbb5f255c2e70e1e75e98e5f03f22cffe4db8f53be123cf345856fc17e7eb5 🔍 |
| SHA3 | 9b2d28a3e3a3cd27bfd31b324eff44ee6fd855feba5fe37c9d5837e76c5f7498 🔍 |
| VirtualSize | 0x1976 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1a00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.88586 |
.rdata
| MD5 | a2acda28d16f9ba7c49956324cbc9fb3 🔍 |
|---|---|
| SHA1 | 09e4d71d975500abb731a9f4f714065ab77508d3 🔍 |
| SHA256 | 6e15ad3714bbd7f821479206a0c92f7e35bb261f02965352411784636f85853f 🔍 |
| SHA3 | 0419ac4dc84d2c6e37b2235a53fd8eb620788d5212687716b4610b2a5f790264 🔍 |
| VirtualSize | 0x10e0 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x1200 |
| PointerToRawData | 0x1e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.15833 |
.buildid
| MD5 | 833096e875a78618682e0bef286e59e3 🔍 |
|---|---|
| SHA1 | fbf35c283fa8979b6f492bfaa08d57a6108f67ab 🔍 |
| SHA256 | 2d9c86077db63c0f9bf99b6705d3eeac8b8c6914ca75c0a70c6325ccd7260363 🔍 |
| SHA3 | f9676108ec992efdbc3efd971cbd8e796d213b2e0da6c0bd9b430e25bcb27945 🔍 |
| VirtualSize | 0x35 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.604661 |
.data
| MD5 | a55b2b5b5992ee63766a195ad0506662 🔍 |
|---|---|
| SHA1 | bd06875afb641b095f71d71abba1c1a729a897ed 🔍 |
| SHA256 | 8d92b355f9b7066015a80bb6ef849a380911026a1b98b8e070e3eaca0b049b1e 🔍 |
| SHA3 | 9c1e93f6640bc2d0c3a2963e73c66ade186fd29d4527a6d43d0198c7d87b4ea4 🔍 |
| VirtualSize | 0x120 |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.644065 |
.pdata
| MD5 | f6366b4e43edde63802c654974735b2a 🔍 |
|---|---|
| SHA1 | bc0e7f1b3ae59748ebf7cff39be19f426e08a9c0 🔍 |
| SHA256 | 5f891542771b1b0413f66178c558ab67c52f0a22ab54d5c8591e2e70f2b7cd63 🔍 |
| SHA3 | 83266372045ce97e826b31c98958926de0d42d571b0ae4cdfc972550336f3653 🔍 |
| VirtualSize | 0x138 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.52704 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 4271965637cccccf48991220155dfbdc 🔍 |
|---|---|
| SHA1 | 8a84912f617c3ce11dc97fca63b14dc47705bf0c 🔍 |
| SHA256 | 7b964b7cb7829d0aef44a247956dfefb181c2028b9e994eab8e9592236fbc8d5 🔍 |
| SHA3 | 8e3df88904c0381c1fb1c44a7bea8f79f32bd7648fa90da79f24908f652c6959 🔍 |
| VirtualSize | 0x3209e |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x32200 |
| PointerToRawData | 0x3800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.61084 |
Imports
| api-ms-win-crt-private-l1-1-0.dll |
__C_specific_handler
memcpy |
|---|---|
| api-ms-win-crt-stdio-l1-1-0.dll |
__acrt_iob_func
__p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vswprintf fwrite |
| api-ms-win-crt-runtime-l1-1-0.dll |
__p___argc
__p___wargv _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
calloc free malloc |
| api-ms-win-crt-string-l1-1-0.dll |
_wcsdup
memset strlen strncmp wcslen |
| USER32.dll |
MessageBoxW
|
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection GetLastError GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryW SetDllDirectoryW SetUnhandledExceptionFilter Sleep TlsGetValue VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-environment-l1-1-0.dll |
__p__wenviron
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.05704 |
| MD5 | 0d7c91196e8e51cf33752be331117bfd 🔍 |
| SHA1 | 4fbd48dddd9e3ecf72c0bd0b343dd03785657501 🔍 |
| SHA256 | 498995676e5dc88d83f7ad9e651e14d42ecc7b07dabb2193961c94de2cdf22dc 🔍 |
| SHA3 | 198a4b357df0c83dcbb72774035941b0d3783b22dd94beafed3e99d762d9a2ce 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.40078 |
| MD5 | 84e56f5e7e47531d7b7cc4478b4a9396 🔍 |
| SHA1 | d3b98884e07e4df0e2882918d16e150799564c24 🔍 |
| SHA256 | f64bf44d990e04947e12fbaaad61f9aeec5cde76febba8f56bc3317b9a868208 🔍 |
| SHA3 | 861353f2e38131cda2b93f8ef507bc2bc1b820d424979f438963ea5fdc34397d 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.11753 |
| MD5 | 40952c336a45ee57554bbdd42e5f6dfe 🔍 |
| SHA1 | cb669290eca6fa5aacde61708e8fc68514cfb8ac 🔍 |
| SHA256 | 2f046eec51eb59266a739c99108589a5522bf157197ea298953b5eaf6559a6c7 🔍 |
| SHA3 | aeed04a13727fb582409bd465c7ea8ac899de70879671ea5681a784fd31d6a39 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.64616 |
| MD5 | ef22c8e1cc02c674bb4b86398ae067a3 🔍 |
| SHA1 | a7445577b12ea567e0c3a3cfd0a9fb3970091e20 🔍 |
| SHA256 | b74243742e97d5009e859417c7a4b5a96670b454e69ae02c1f12dbb3fd2ed281 🔍 |
| SHA3 | 08604c43ac46b190d6f802323397e9c2a968b0f3736e29642c8de52101a36e55 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.43049 |
| MD5 | 966c3e865e8d08b79f14b80ccb937052 🔍 |
| SHA1 | f7f54c525f03ffc8e6694fbd5288dcc462897e0b 🔍 |
| SHA256 | 5b953d852e632a72222c5347a989d070c6cdd525e1fffa591edb87f91bc2c3d6 🔍 |
| SHA3 | b35336b8f4b99f68085718dd8002582d6d8114a08383e86c5166038a87c0828c 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5488 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.32281 |
| MD5 | 787e900ac0b024ef8e2ed462266b817e 🔍 |
| SHA1 | 2f48e7e68446a214b580c97157852409438e9456 🔍 |
| SHA256 | a8d6ef1d46b14dd90f73c52c12fd35777ddf3f2833d155854b9d4e4cede23818 🔍 |
| SHA3 | 72910ba867b2d6b1fe82fc1c8ac7c8171ea64e328d869ab476ccffa0b188b630 🔍 |
7
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x94a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.18424 |
| MD5 | ba2ab9289346b332293d3585e17b4964 🔍 |
| SHA1 | f02b975b8a6349361440b7e9e5af6221d72d1c87 🔍 |
| SHA256 | 7eebe05fdf8ca75f9c713db622c173e3e65c036bdab0793534499ae2d394dfd9 🔍 |
| SHA3 | f905f4ac9343240897c1581f386c275c8b133ce8d2ec30c83dd66c1e2dcb65e7 🔍 |
8
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.05848 |
| MD5 | 30d39ef1d30f2d460cb7d630e5d8628a 🔍 |
| SHA1 | 4de54f37abaeec1f33fe357e8f835d8ecafee2af 🔍 |
| SHA256 | 499f126deb27861f0b1fdcf8c1a101f65f444459dc5d567d469f7c1dd1d0d35e 🔍 |
| SHA3 | 268383ab6eb1c20ccbff1fe4fdf62b400774422d5ae5ed87b2e9d1d1167c96ca 🔍 |
9
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xa335 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.98177 |
| Detected Filetype | PNG graphic file |
| MD5 | 4f4e2ea900efc6e9ae77427fb055796f 🔍 |
| SHA1 | a58828e74d246340472f72e1d6cefdb40b23519e 🔍 |
| SHA256 | a845f8e0f0dd02befc2e6a06fb686abd95959ef55e9533bff7881b13e49f03ec 🔍 |
| SHA3 | 7c238b6206820c67ae208e0761d943748beecfe0a0b968039babf81df5f1350e 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x84 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.03466 |
| Detected Filetype | Icon file |
| MD5 | b4d0b6323ec8bd386608f36958bb4a1f 🔍 |
| SHA1 | d9ea602eae4cef3277186eac67f1c73ce43cf939 🔍 |
| SHA256 | 9ae888f20f144d7948fb146d87f66e10ce5a657b40aed95769523c131b9ba029 🔍 |
| SHA3 | 15e2fea371a7d913a3cd787652e78da5e97ce3a19efdaf8e252c42221022d51c 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2bc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.82693 |
| MD5 | 67d470b193d92eaedadc0bb58838f5f1 🔍 |
| SHA1 | f3d3d4f28c3635167a46e075d490c33bdbb01496 🔍 |
| SHA256 | 7a7ce637fc4e50b945d45254545c848c8350184f51ee13abca9188621c9bad25 🔍 |
| SHA3 | 87048578496162e372472f4afe5412b15ce526e1ab77d805f4e73f0a59a0c7f1 🔍 |
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-16 01:27:37 |
| Version | 0.0 |
| SizeofData | 25 |
| AddressOfRawData | 0x501c |
| PointerToRawData | 0x301c |
TLS Callbacks
| StartAddressOfRawData | 0x140008000 |
|---|---|
| EndAddressOfRawData | 0x140008008 |
| AddressOfIndex | 0x140006078 |
| AddressOfCallbacks | 0x1400036b8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x0000000140001580
0x0000000140001600 |
Load Configuration
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0 |
RICH Header
Errors
Leave a comment
No comments yet.