94da6a4b943ddfd8b26485ec1d19cd5b6683cbbc954609ee59e300d4f7f4ccb7

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Jun-09 18:51:29
Detected languages English - United States
Debug artifacts F:\Projects\HyperVDebug_public\x64\Release\hvlib.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • rshell.exe
 Accesses the WMI:
  • root\virtualization
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Can access the registry:
  • RegCloseKey
  • RegQueryValueExW
  • RegOpenKeyExW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Interacts with services:
  • ControlService
  • DeleteService
  • OpenServiceA
  • OpenSCManagerW
  • CreateServiceA
 Manipulates other processes:
  • Process32FirstW
  • Process32NextW
  • OpenProcess
Suspicious VirusTotal score: 2/72 (Scanned on 2025-10-21 10:36:26) Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS

Hashes

MD5 9d2e2d86eab5ffbe817873ba25c6b8b8 🔍
SHA1 b9794b4e96cf76fc3a9403e760e78bbd5bfa0502 🔍
SHA256 94da6a4b943ddfd8b26485ec1d19cd5b6683cbbc954609ee59e300d4f7f4ccb7 🔍
SHA3 66b7ece31e9492e86f9c2ba03e23aa1080f1f914430fbe288ecffd6d23947094 🔍
SSDeep 1536:yV3TfMbjIc7uHY0vLAada39inq3gtP7Jtuzr5Y3grDTy1fH9E0pr+:uz+jXuHYSAaQti5ruz/Ty1lE0s 🔍
Imports Hash c393e9e2147b6a4e1c0720dcc004e9c6 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2024-Jun-09 18:51:29
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xe600
SizeOfInitializedData 0xee00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000E90C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x21000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c16df5ef1edb8c9b691b707136a58aec 🔍
SHA1 10d284246de000e846e24693d3f11731f652ad38 🔍
SHA256 e856b2231623cf9a0f170949c924c65422e41ed0d00346481749b4151fc1f7e9 🔍
SHA3 1457e85dc0447d059a699bc755c8f2b9560e0981be884e3a6d66f088cf37f155 🔍
VirtualSize 0xe4cd
VirtualAddress 0x1000
SizeOfRawData 0xe600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.31674

.rdata

MD5 68a900fa9e48fcbd07ee6ff871b2afce 🔍
SHA1 df750ab1758595ce36729b7d477b688996d29f3e 🔍
SHA256 05dcb9d96172308de087a7b6d7e7d16901722e60386c1f099c76ae0b3cd77f18 🔍
SHA3 c59e14b0ee74ab66b2cd6f398602d8b11448d76da15bb1f359ac68504738124e 🔍
VirtualSize 0x8f54
VirtualAddress 0x10000
SizeOfRawData 0x9000
PointerToRawData 0xea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.82886

.data

MD5 0db1a89abd6747cb0fdbad363861e355 🔍
SHA1 c010a5361f09db55cd66cba8c73e1a33d0e84886 🔍
SHA256 3f3ad1713ad1293ecbbf9af57a8611e00a5e1476dc68cf16bfffb90e8af89f77 🔍
SHA3 5a47502705129b05c05770c30f530d2c49066c47750afd4cd01164bb5e52a0e8 🔍
VirtualSize 0x4f68
VirtualAddress 0x19000
SizeOfRawData 0x4200
PointerToRawData 0x17a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.83198

.pdata

MD5 bd949a9de7f9b28fc5827dc169722c8a 🔍
SHA1 4fefb24dd88c95884bc0910f9c772dd25174f818 🔍
SHA256 8af3e62bf68d0ba9a6a1bbe0d7e45939cace9abe22d93bf56526806209d5b6fd 🔍
SHA3 5445486e38c106d54699d2ca538cb48067be880410340335933dc625fde0c890 🔍
VirtualSize 0x9d8
VirtualAddress 0x1e000
SizeOfRawData 0xa00
PointerToRawData 0x1bc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.84774

.rsrc

MD5 50c26f8b7696190a236f2e12c71402ce 🔍
SHA1 fa79d20c7dc487c649abf9eee618a851f2001f2f 🔍
SHA256 1d70940be978fc2c32544ce47b02857699a378a03e6aec0c50e613880907172c 🔍
SHA3 c554c3740a75ec9fc13b33eeda7b3f9be90769377aa08226b960a7fb4833be68 🔍
VirtualSize 0x1e0
VirtualAddress 0x1f000
SizeOfRawData 0x200
PointerToRawData 0x1c600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71768

.reloc

MD5 b875b2ec29e37af5c8663a8716db2e4a 🔍
SHA1 d404aa5310f62b482f54f7eb043602b3cca79dc0 🔍
SHA256 7d6f9f1df8dd6274c3070bfe8b64a70f6b6c04a808300a46d309c6d0f0d97eed 🔍
SHA3 b0e91d603b642cfde0fe083cafd291fdf8f3a5afe18dd9304430e819dd45fd43 🔍
VirtualSize 0x34
VirtualAddress 0x20000
SizeOfRawData 0x200
PointerToRawData 0x1c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.700783

Imports

SHLWAPI.dll PathRemoveFileSpecA
KERNEL32.dll WaitForSingleObject
ExitThread
ResetEvent
SetEvent
CreateEventW
CreateThread
lstrcatW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
DebugSetProcessKillOnExit
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemTime
SystemTimeToFileTime
GlobalMemoryStatusEx
RtlCaptureContext
RtlVirtualUnwind
DebugActiveProcessStop
DebugActiveProcess
OpenProcess
DeviceIoControl
CreateFileW
CloseHandle
CreateFileA
GetModuleFileNameA
GetLastError
Sleep
RtlLookupFunctionEntry
lstrcmpW
LoadLibraryW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ADVAPI32.dll AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ControlService
StartServiceA
DeleteService
OpenServiceA
OpenSCManagerW
CloseServiceHandle
CreateServiceA
ole32.dll CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
OLEAUT32.dll VariantClear
VCRUNTIME140.dll memset
strstr
__C_specific_handler
wcsstr
__std_type_info_destroy_list
memcpy
api-ms-win-crt-string-l1-1-0.dll strcpy_s
_wcsnicmp
_stricmp
_wcsicmp
wcscpy_s
api-ms-win-crt-heap-l1-1-0.dll free
malloc
realloc
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0.dll _invalid_parameter_noinfo
_wsystem
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_errno
_execute_onexit_table
_cexit
api-ms-win-crt-convert-l1-1-0.dll _wtoi

Delayed Imports

SdkCloseAllPartitions

Ordinal 1
Address 0x7c80

SdkClosePartition

Ordinal 2
Address 0x7c90

SdkControlVmState

Ordinal 3
Address 0x7c40

SdkEnumPartitions

Ordinal 4
Address 0x84e0

SdkGetData

Ordinal 5
Address 0x81e0

SdkGetData2

Ordinal 6
Address 0x81b0

SdkGetDefaultConfig

Ordinal 7
Address 0x7cc0

SdkGetMachineType

Ordinal 8
Address 0x7ca0

SdkGetPhysicalAddress

Ordinal 9
Address 0x7da0

SdkInvokeHypercall

Ordinal 10
Address 0x7b00

SdkNumberToString

Ordinal 11
Address 0x7e40

SdkReadPhysicalMemory

Ordinal 12
Address 0x80f0

SdkReadVirtualMemory

Ordinal 13
Address 0x7fd0

SdkReadVpRegister

Ordinal 14
Address 0x8130

SdkSelectPartition

Ordinal 15
Address 0x7d80

SdkSetData

Ordinal 16
Address 0x83a0

SdkWritePhysicalMemory

Ordinal 17
Address 0x80b0

SdkWriteVirtualMemory

Ordinal 18
Address 0x8010

SdkWriteVpRegister

Ordinal 19
Address 0x8170

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2024-Jun-09 18:51:29
Version 0.0
SizeofData 77
AddressOfRawData 0x16fe4
PointerToRawData 0x159e4
Referenced File F:\Projects\HyperVDebug_public\x64\Release\hvlib.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2024-Jun-09 18:51:29
Version 0.0
SizeofData 20
AddressOfRawData 0x17034
PointerToRawData 0x15a34

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Jun-09 18:51:29
Version 0.0
SizeofData 600
AddressOfRawData 0x17048
PointerToRawData 0x15a48

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2024-Jun-09 18:51:29
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180019000

RICH Header

XOR Key 0x64be7bc2
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 10
Imports (33731) 2
C objects (30795) 1
ASM objects (33731) 4
C objects (33731) 8
C++ objects (33731) 12
Imports (30795) 11
Total imports 102
C objects (LTCG) (33811) 23
Exports (33811) 1
Resource objects (33811) 1
Linker (33811) 1

Errors

Leave a comment

No comments yet.