| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date |
1970-Jan-01 00:00:00
|
|
Suspicious
|
The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Unusual section name found: UPX2
The PE only has 4 import(s).
|
|
Info
|
The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
- LoadLibraryA
- GetProcAddress
|
|
Suspicious
|
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
| MD5 |
6b0e700aecd577f3a1895ba9eda21a0e
🔍
|
| SHA1 |
95904a8748b570045f5fe933f4d1fcd9eea3e39e
🔍
|
| SHA256 |
8980dc83faeacfdda47ef786e6972234af14caeb115786be60187478860052a9
🔍
|
| SHA3 |
c837f2802bc46602bdbdd78bc441ca9955b25134662e28aa3735a264d98f6750
🔍
|
| SSDeep |
49152:BLZQE6gEYCt0s3fAVZouWyA+cJStxwF91FrgrBnA39XGFp9TPpQmudDlDLcLlhN:sgEn3fKouBPc8t6lEE92Fp9ThuvE5
🔍
|
| Imports Hash |
6ed4f5f04d62b18d96b26d6db7c18840
🔍
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0x8b
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections |
3
|
| TimeDateStamp |
1970-Jan-01 00:00:00
|
| PointerToSymbolTable |
0xb54e00
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xf0
|
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic |
PE32+
|
| LinkerVersion |
3.0
|
| SizeOfCode |
0x3b0000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0x84b000
|
| AddressOfEntryPoint |
0x0000000000BFA870 (Section: UPX1)
|
| BaseOfCode |
0x84c000
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
6.1
|
| ImageVersion |
1.0
|
| SubsystemVersion |
6.1
|
| Win32VersionValue |
0
|
| SizeOfImage |
0xbfd000
|
| SizeOfHeaders |
0x200
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve |
0x200000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
🔍
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
🔍
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
🔍
|
| VirtualSize |
0x84b000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
cf61c25fd5b797da0b8ef2c0bf755919
🔍
|
| SHA1 |
a941f443bf8c38506736295325ba72b77c19ae93
🔍
|
| SHA256 |
295481e879e940df9d3411cab949982bdbf19801a00544e04ca5f033712f8489
🔍
|
| SHA3 |
02bc0ac17782ef485e2d2eb996bb75db71ec354d3be2c5ae670756f707627adc
🔍
|
| VirtualSize |
0x3b0000
|
| VirtualAddress |
0x84c000
|
| SizeOfRawData |
0x3af400
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
7.99996
|
| MD5 |
e464051ad3610034d01c9c5c6f6b81a7
🔍
|
| SHA1 |
22dd8cddaa773e1fafa4b3ffbaefb91ff8cac47a
🔍
|
| SHA256 |
b1150057d6b1fdc0617af00eeecb398844ae3290411cf04e53eb9341e0af8ce5
🔍
|
| SHA3 |
6c3a6d36ca91f0232e98460c976cf10801901a4461c5cb4fa000441c248345df
🔍
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0xbfc000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x3af600
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
1.37191
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
|
[*] Warning: Section UPX0 has a size of 0!