8e4ad211bf429b7a89c4084010e0b807ecb3d945c8a3e979c2dfb84f5d56eca8
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Jul-24 05:53:48 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
Plugin Output
| Suspicious | The PE is possibly packed. | Unusual section name found: .buildid |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 94.2702% of the executable. |
| Safe | VirusTotal score: 0/70 (Scanned on 2026-09-20 07:30:28) | All the AVs think this file is safe. |
Hashes
| MD5 | 71a239fbaa76da5b40b01d9e829ba0ea 🔍 |
|---|---|
| SHA1 | 21338dd558e226103d5bd1413da4e7075b82f8d6 🔍 |
| SHA256 | 8e4ad211bf429b7a89c4084010e0b807ecb3d945c8a3e979c2dfb84f5d56eca8 🔍 |
| SHA3 | e04d2264038904f3c1a7de9cfbceb3c39ea798d8a063d1c95208284d30b473b7 🔍 |
| SSDeep | 6144:q0n3WM5x87QUrv7fo8qHZa6DQ9BkOn38a:9nGM/8kUQtQ9Hn3d 🔍 |
| Imports Hash | 8d88ee3d02e50123906bab082925025d 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2025-Jul-24 05:53:48 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1a00 |
| SizeOfInitializedData | 0x17a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001160 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x47000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x48139 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | e350e5d12b865f27b329760233d88fdc 🔍 |
|---|---|
| SHA1 | 0a5636c2cc88eff9cd8516bcf375a5823c8a5ec2 🔍 |
| SHA256 | c5bbb5f255c2e70e1e75e98e5f03f22cffe4db8f53be123cf345856fc17e7eb5 🔍 |
| SHA3 | 9b2d28a3e3a3cd27bfd31b324eff44ee6fd855feba5fe37c9d5837e76c5f7498 🔍 |
| VirtualSize | 0x1976 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1a00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.88586 |
.rdata
| MD5 | a2acda28d16f9ba7c49956324cbc9fb3 🔍 |
|---|---|
| SHA1 | 09e4d71d975500abb731a9f4f714065ab77508d3 🔍 |
| SHA256 | 6e15ad3714bbd7f821479206a0c92f7e35bb261f02965352411784636f85853f 🔍 |
| SHA3 | 0419ac4dc84d2c6e37b2235a53fd8eb620788d5212687716b4610b2a5f790264 🔍 |
| VirtualSize | 0x10e0 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x1200 |
| PointerToRawData | 0x1e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.15833 |
.buildid
| MD5 | 32aefb8f040a0ae78246d367c89d0382 🔍 |
|---|---|
| SHA1 | a745ddf3f40673f028af4b5150b1e2527873ac18 🔍 |
| SHA256 | 49e6203311673834a1d45efdbbc7c1fa28471763d6d8b2d9c1f4008d1f3eb5e2 🔍 |
| SHA3 | a0bef64536db5abc2b7c6a42957a7f82457f46b0bde2b6dd53cf021bf29ad9ad 🔍 |
| VirtualSize | 0x35 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.600755 |
.data
| MD5 | a55b2b5b5992ee63766a195ad0506662 🔍 |
|---|---|
| SHA1 | bd06875afb641b095f71d71abba1c1a729a897ed 🔍 |
| SHA256 | 8d92b355f9b7066015a80bb6ef849a380911026a1b98b8e070e3eaca0b049b1e 🔍 |
| SHA3 | 9c1e93f6640bc2d0c3a2963e73c66ade186fd29d4527a6d43d0198c7d87b4ea4 🔍 |
| VirtualSize | 0x120 |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.644065 |
.pdata
| MD5 | f6366b4e43edde63802c654974735b2a 🔍 |
|---|---|
| SHA1 | bc0e7f1b3ae59748ebf7cff39be19f426e08a9c0 🔍 |
| SHA256 | 5f891542771b1b0413f66178c558ab67c52f0a22ab54d5c8591e2e70f2b7cd63 🔍 |
| SHA3 | 83266372045ce97e826b31c98958926de0d42d571b0ae4cdfc972550336f3653 🔍 |
| VirtualSize | 0x138 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.52704 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | feefaba6e5dfc2507225883366960338 🔍 |
|---|---|
| SHA1 | 38dfec0060d68551af85b5946eb3dae0c2405b94 🔍 |
| SHA256 | 779b05f120e3d100af9c8374f7127ebf99789118d3b89e9893ddcce590b59990 🔍 |
| SHA3 | cf04a8926dfbec3e18877ae63ad38c0a876b9d09f2886d82b1fca020636c9e21 🔍 |
| VirtualSize | 0x3d12a |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x3d200 |
| PointerToRawData | 0x3800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.78737 |
Imports
| api-ms-win-crt-private-l1-1-0.dll |
__C_specific_handler
memcpy |
|---|---|
| api-ms-win-crt-stdio-l1-1-0.dll |
__acrt_iob_func
__p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vswprintf fwrite |
| api-ms-win-crt-runtime-l1-1-0.dll |
__p___argc
__p___wargv _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
calloc free malloc |
| api-ms-win-crt-string-l1-1-0.dll |
_wcsdup
memset strlen strncmp wcslen |
| USER32.dll |
MessageBoxW
|
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection GetLastError GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryW SetDllDirectoryW SetUnhandledExceptionFilter Sleep TlsGetValue VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-environment-l1-1-0.dll |
__p__wenviron
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.64231 |
| MD5 | e5364a45740f02d1c1d8dfc2b0859edf 🔍 |
| SHA1 | 13c3139efc02ec75f5c6dc4b67c351b223227f55 🔍 |
| SHA256 | 63f555685da71828b1dab87844e7eadd55409d2ab874458c2a009be65963240e 🔍 |
| SHA3 | cfd32408615aa1abd7e71403bdb8265cfa434ce0d3820d3c129e466a76d3c2ca 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.45699 |
| MD5 | b37e95d220b7f8551963d929174a9a02 🔍 |
| SHA1 | 2c055015b90b8b5a10de807093bbebb624de1c39 🔍 |
| SHA256 | 6bbb08a4bfd46aeda1a04aee0c2308fc424237f818bf49e4ae38f61bdb10341b 🔍 |
| SHA3 | 57ba44a69d0c224a5cd0ce62a97b163e11294c878440377d189e4d9301479dbf 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.22841 |
| MD5 | 46773c887b69fe5ea79a3acae0487b7d 🔍 |
| SHA1 | 9082a6cc913de5b8de89ed14c0172d9f186ea1fb 🔍 |
| SHA256 | 4e5bf24acaa2b855fdc7a2360a3653975818620ebe70ce844f3f288d93fb21cb 🔍 |
| SHA3 | cfff1959c80826647ba9006399182dd405b3a6fcc80519775e8472c913ebdfec 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.98562 |
| MD5 | 3dda8e059d5998d3631461d1d5b07bf3 🔍 |
| SHA1 | 8491e3de03ae3e646c5e0a589515ea92308dfe2c 🔍 |
| SHA256 | dbb6e866921165c24b1483144ea4f960bcef44b7175cbfec508291663707ab1d 🔍 |
| SHA3 | 2f486f6b57a2989f62992e0e438ef07b5ea753a28a98b4815fa702235b1e9aa9 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.90788 |
| MD5 | baaf90e16de13a91046a861fe3c260c2 🔍 |
| SHA1 | f100b3d13331cf78f376a5a328286294f9346b37 🔍 |
| SHA256 | 0213282853cdbb8b2b608db8278a234b6cb9240efcd38a970e98ae5c5c253998 🔍 |
| SHA3 | 38d01bc7e0cec89812a282735fa6f45b3ba6d6070a290cf293c2ef02c54f7877 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5488 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.82226 |
| MD5 | 84c4c99859d6c9d708576b4f4cbd2472 🔍 |
| SHA1 | f3e86e76f9c39aee04790b0948087c8df1e54945 🔍 |
| SHA256 | 6737e207f81c3e0a9ae338391ed461b1d5ae3115b7dcf13de84b051324d668f1 🔍 |
| SHA3 | 39de89ae8c84838a049a640dcb3da21d4c543346b752de4a2cc62c781e3353ae 🔍 |
7
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x94a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.74967 |
| MD5 | 9bb0f9e92530bc428e0457a6ef196678 🔍 |
| SHA1 | 7b1bb87f6a4f726376870b3199043f46c857cefd 🔍 |
| SHA256 | e15e4c439841907ba9d78c1a93b7543731dbce30dd9c72627c31c856f9cb83c4 🔍 |
| SHA3 | 7e6907fcebd029c219083c88b9b15739d4cfc3cee6d5216747324476296c5ff0 🔍 |
8
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.67383 |
| MD5 | fad855e0751f70128922a3841dd60549 🔍 |
| SHA1 | b865bc3820c8551de21facce6c8ec6165a6c30c4 🔍 |
| SHA256 | e56e299a0b87a23ed834efd4e90b77b037ce26cfd7260309c033cab645554553 🔍 |
| SHA3 | e4629818d9b58e4b2568430a10990bfbd83a24b04bff8125a1592c4e5cd120b4 🔍 |
9
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x153c1 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.9799 |
| Detected Filetype | PNG graphic file |
| MD5 | cdd46a21c576803f6c8b3798b281e14f 🔍 |
| SHA1 | dd3ff175ee1353c9d7bd770eae55c84ad3526c82 🔍 |
| SHA256 | 7db22e31e2e5ba9c1fa2f1af6a756a116e111aa88c1e918821dbc52005a7f14a 🔍 |
| SHA3 | 275d419d29a9e6ac00f9c64dfef5c4a365d6f133b955ffe8fb79d2131f19f011 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x84 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.05309 |
| Detected Filetype | Icon file |
| MD5 | cad345c3cae0b5a11631e6de888d5edb 🔍 |
| SHA1 | 50d32e5fd24e9d9f8fdd7d9eac8aa17b0cc011ba 🔍 |
| SHA256 | f962e5155f1710abd8f27ca9f6acae04c6aa1b680357ef306e2cc49c8f0be359 🔍 |
| SHA3 | 2a7f400f95ebc290bcf7db3d56df11597732269be44db7b7a42c4b737cd11252 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2bc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.82693 |
| MD5 | 67d470b193d92eaedadc0bb58838f5f1 🔍 |
| SHA1 | f3d3d4f28c3635167a46e075d490c33bdbb01496 🔍 |
| SHA256 | 7a7ce637fc4e50b945d45254545c848c8350184f51ee13abca9188621c9bad25 🔍 |
| SHA3 | 87048578496162e372472f4afe5412b15ce526e1ab77d805f4e73f0a59a0c7f1 🔍 |
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Jul-24 05:53:48 |
| Version | 0.0 |
| SizeofData | 25 |
| AddressOfRawData | 0x501c |
| PointerToRawData | 0x301c |
TLS Callbacks
| StartAddressOfRawData | 0x140008000 |
|---|---|
| EndAddressOfRawData | 0x140008008 |
| AddressOfIndex | 0x140006078 |
| AddressOfCallbacks | 0x1400036b8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x0000000140001580
0x0000000140001600 |
Load Configuration
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0 |
RICH Header
Errors
Leave a comment
No comments yet.