9351428aeba50702668c4c8c6f8eb7dae61d0f94915c0c869ad452c7c7476ead

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jun-11 20:42:34
Detected languages English - United States
TLS Callbacks 1 callback(s) detected.

Plugin Output

Suspicious PEiD Signature: UPX -> www.upx.sourceforge.net
UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: PFT0
Section PFT0 is both writable and executable.
Unusual section name found: PFT1
Section PFT1 is both writable and executable.
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • ShellExecuteA
 Uses Microsoft's cryptographic API:
  • CryptGenRandom
 Has Internet access capabilities:
  • WinHttpOpen
Info The PE's resources present abnormal characteristics. Resource 201 is possibly compressed or encrypted.
Resource 301 is possibly compressed or encrypted.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 319ba16e955df71af62850a3c5fe2805 🔍
SHA1 99805f127d17b6ab7c22a10b64d3f2f3ad135b4c 🔍
SHA256 9351428aeba50702668c4c8c6f8eb7dae61d0f94915c0c869ad452c7c7476ead 🔍
SHA3 28e291201e93d38436bccb28943e42706630d6cd9e46567acc1c4066fc1b6c22 🔍
SSDeep 6144:Xdlii0jppUB2sWYEHLYcbFK5a0VA7rw4qgk25RouL5dY7U1FN8:X+jnUByHLNFK00QTtbRXGU1FN 🔍
Imports Hash 21056df81354eb26f32931db974e04e1 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-Jun-11 20:42:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x46000
SizeOfInitializedData 0x9000
SizeOfUninitializedData 0x1c2000
AddressOfEntryPoint 0x00208300 (Section: PFT1)
BaseOfCode 0x1c3000
BaseOfData 0x209000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x212000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

PFT0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1c2000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PFT1

MD5 ffac9c29a8d45adac7bfa1cd08569124 🔍
SHA1 626413dd653c64b3a9f3920078ec8c8353226f9d 🔍
SHA256 b173f502071032ebf206294b3ebe95fe90058a34a6ee065855392f7c8964a808 🔍
SHA3 cdb9a7851ca2e1973bc1ec412ade1a63c0fa7ea2fe5404ae28762b461ced421f 🔍
VirtualSize 0x46000
VirtualAddress 0x1c3000
SizeOfRawData 0x46000
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99854

.rsrc

MD5 793413ae54b91e5d4663f89890c2f316 🔍
SHA1 62d8dd0c2da275e46b5321aa16c0d65a7e7b3b28 🔍
SHA256 d7df816d4eb18b42b5bd413228006dbf2f70b079d5eb97a81ba13b5350c2ba08 🔍
SHA3 a9f395b7854834ce308e988db646a33dff3f3fdaefadd0509cc987358bffd8e2 🔍
VirtualSize 0x9000
VirtualAddress 0x209000
SizeOfRawData 0x8e00
PointerToRawData 0x46200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.90252

Imports

ADVAPI32.dll CryptGenRandom
COMCTL32.DLL InitCommonControlsEx
dwmapi.dll DwmSetWindowAttribute
GDI32.dll BitBlt
KERNEL32.DLL LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
msvcrt.dll _iob
SHELL32.dll ShellExecuteA
USER32.dll EndPaint
WINHTTP.dll WinHttpOpen

Delayed Imports

102

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x4b28
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x270
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.55966
Detected Filetype PNG graphic file
MD5 9e3935353aee78dfecf1bdd889f38299 🔍
SHA1 b65b18a42f1a599ec4bcaa6aa42f2497483245a7 🔍
SHA256 c1734fb097d25f400f5903f1624e257fdad683b03a97ed48d2d54979395f6d34 🔍
SHA3 7ba4881f36c6af4e4b7a4fcfd3420026cbd3a6e89127ed8c353e6c3575f97296 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x474
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.79002
Detected Filetype PNG graphic file
MD5 8642953a89652a2a0509bfc1b7442f8d 🔍
SHA1 47eedaf908d1fdda196633513fdd6df465f8d8f7 🔍
SHA256 e3b933fcfef02b44f4522bbf805b284e1263d3a42c717baccf592f7c4155e26d 🔍
SHA3 720bbf9929501662e4bfae04ec47a5594c1d0db6f3612fc0c445e7bc5693670c 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x743
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85444
Detected Filetype PNG graphic file
MD5 415f5a3bcf97b48878739aee442955f0 🔍
SHA1 9b974f03e406cee46c5edcba9045dadbee70fa8d 🔍
SHA256 d993d01cace5ec957b97dd188d1db594972e8ff70fedb5954207bafdabef131f 🔍
SHA3 c750fc4f531b64c0b6fb6872f7bbb185fcb4320047683e551195b2b01baf33a0 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xab3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91556
Detected Filetype PNG graphic file
MD5 88a85ae8af0eebc2d25e4f23b394479b 🔍
SHA1 620b7c98500c8253f11831fb70fa22141394a910 🔍
SHA256 da24288aca7df7ca35e588e683832164ac3f4b95e8cd63f5afaa66a6def1c21d 🔍
SHA3 126941270dc457cfa9925d23c762a574b7b18de18d4c299b1f610f7dc6f92aa2 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1b68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93736
Detected Filetype PNG graphic file
MD5 5c92a88a30c1496dbc08a6d24e0aee3f 🔍
SHA1 4bb3a80a2fd7aa1d1261f94be25e9262a6055bd2 🔍
SHA256 f1131a62b18e39441c745703d1de9f6cd547a3c65d777b95f9e93a4024272bcd 🔍
SHA3 8a2268c1bfd4d1c4ce32ec7f9b079e490426cf678c99b3d134968a76d33adfbc 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x518b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96354
Detected Filetype PNG graphic file
MD5 832aa7747d225430c2bf2372c4d30a14 🔍
SHA1 ec4e4fabded53800d63c8639dcbf7ece69e19a47 🔍
SHA256 fbb317162ee21b9b1e6a36b2870e4631584d680561bfce7a37af670dc529fbf6 🔍
SHA3 ce6d6fd94f4a1d90ff7b0958ab5daffc6230f2c0cd08424cd5e5105eadd70f98 🔍

201

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x16c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.46186
MD5 f83c0ed81941da5413ec93d75c7bc3ab 🔍
SHA1 9e81ba2d97f7d7ccf09e21359c196719b1078ce9 🔍
SHA256 62367c867b06998f86ff6d80182b33d9440eaefe7122e6738a7d37c9a8bece8f 🔍
SHA3 83c98ffa8d23757bef9818679bafdaf32714234cadbf4243b86a47070ca0ebfe 🔍

301

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1a0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.48666
MD5 5097097a5f4bc59481d53cdaa1827cf2 🔍
SHA1 c1b36c5a9ee0fa50c46f8be72f6a638f6c14c2b8 🔍
SHA256 147a77fe7ae09ed55498e33897a20130505df9db829d47ea916eadbc40774ad7 🔍
SHA3 c153be2e4d004da63b445bf61dc501e1aed828cd39ac65d83a7790688bd4c53a 🔍

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.82432
Detected Filetype Icon file
MD5 af7330efdb3c3a904f3a7d9094e067d9 🔍
SHA1 f8b125479f4fe6f6d0ce1e72f719956adb6d496c 🔍
SHA256 650b520f9758cb66f4b3903526f3e63687652ff618e2f420a1331ecea69e0b3e 🔍
SHA3 20044cdc74ce0720400ef004faeda4668a5d882707b901943e83925f18d08439 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x229
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.12163
MD5 63e669e7f0ac59337383fbd7662fc42f 🔍
SHA1 fa371cf8bf2766f8e02a432dc96ade7fc170f590 🔍
SHA256 701266df373bf3cd6222c533245dbc8ca53d34557aaf97c587750470d0958492 🔍
SHA3 45b4d69486b98187668d4b74ef1c2f796ef97594174f9260803e5288de2be205 🔍

Version Info

TLS Callbacks

StartAddressOfRawData 0x608fa0
EndAddressOfRawData 0x608fa4
AddressOfIndex 0x4ec3f0
AddressOfCallbacks 0x608fa4
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x00608F69

Load Configuration

RICH Header

Errors

[*] Warning: Ignored an invalid IMAGE_RESOURCE_DATA_ENTRY [*] Warning: Section PFT0 has a size of 0! [!] Error: Resource 102 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 102 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 102 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 102 is bigger than the PE. Not trying to load it in memory. [!] Error: Bitmap is malformed! [!] Error: Resource 102 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 102 is bigger than the PE. Not trying to load it in memory.
Leave a comment

No comments yet.