Manalyzer :: 9b721f1f9a2e5568fe7ecd845a744b35894bb76bddf5924a78f75286288066b9

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2024-May-24 02:48:32

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains references to system / monitoring tools: rundll32.exe` `Contains references to security software: rshell.exe` `May have dropper capabilities: CurrentVersion\Run` `Miscellaneous malware strings: cmd.exe`
Suspicious	The PE is possibly packed.	`Unusual section name found: .cfg` `Unusual section name found: .note` `The PE only has 8 import(s).`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`8b2998394e87836aa6d0009810d69b0e` 🔍
SHA1	`0adf067f5dd831e6c8901ceb65afb2776528ef66` 🔍
SHA256	`9b721f1f9a2e5568fe7ecd845a744b35894bb76bddf5924a78f75286288066b9` 🔍
SHA3	`4f5ac772937914734a96e38f2e278b739cb0c898f5b001d5677350fb67262f97` 🔍
SSDeep	`48:SiYTlgrAgEUbWjgE8GGN7i5//i5//i5/:5YTsAubCgwGN7WXWXW` 🔍
Imports Hash	`8d7fedd6ce99bfa4a3ea50f9df03b4b4` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0`
e_cp	`0`
e_crlc	`0`
e_cparhdr	`0`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`5`
TimeDateStamp	2024-May-24 02:48:32
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`0.0`
SizeOfCode	`0x200`
SizeOfInitializedData	`0x1000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000001000 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x6000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`1232c21f53f4580dc0bce6b00d7bdf4f 🔍`
SHA1	`52063e9b2dd70872eb1cf8e1268769efaf6a863d 🔍`
SHA256	`19625d7ff82bd542c3be44a8b8c63fa6efab37f52a1fa342c672fc8581d71dcb 🔍`
SHA3	`d524c392a39d262f4123b9da907f7acd1e914a7bd3fd3fb5c16e66414eeaddca 🔍`
VirtualSize	`0x60`
VirtualAddress	`0x1000`
SizeOfRawData	`0x200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`0.743116`

.rdata

MD5	`06427c8b5318bee7d0c689afb8b96ebd 🔍`
SHA1	`d86ec1b9e80591142786051a62d980cbdf3a9a8e 🔍`
SHA256	`ff3a9a82ba3153fc56c691062e01f45839c2f031fc08b0653b804a28b52162fd 🔍`
SHA3	`c1d5c7b893cc8c86194aa926bc87ae16482f622a13c7a05d38a7d08f4637ed0a 🔍`
VirtualSize	`0x800`
VirtualAddress	`0x2000`
SizeOfRawData	`0x800`
PointerToRawData	`0x600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.896744`

.data

MD5	`e94c52213b298148e806ab73552283a5 🔍`
SHA1	`a1e8c87f0661c6ba4f03648c772138c9e25051da 🔍`
SHA256	`7aba4e8d26fe18a089ae8decba60ffa0e3d7ed55707e7ac3c87b6be4c4a73327 🔍`
SHA3	`bca55bd2b3ce3d31faf668194990062ef363d08ce6b2a790860708c101d04dd1 🔍`
VirtualSize	`0x20c`
VirtualAddress	`0x3000`
SizeOfRawData	`0x400`
PointerToRawData	`0xe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.59774`

.cfg

MD5	`8f1cfb53afbe093ca7b2d11af3333366 🔍`
SHA1	`f5cd1e9f460ae51c3448224f64d2a7d2dd02ef96 🔍`
SHA256	`8deadb3d9a744549407b19d14a99916dc68eb4f936fa424a82db2052dc5c6b34 🔍`
SHA3	`f99d58528b311dc79fbddb1ce4b8d3e4257d4395339e7fe55e9883d941802752 🔍`
VirtualSize	`0x95`
VirtualAddress	`0x4000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.23285`

.note

MD5	`3b6b9374109e41b25f9bf606cf66570b 🔍`
SHA1	`3c594941bde1fdc5fd589f67ca18a3e0c24c7c10 🔍`
SHA256	`721b7b2d262ccecda0f0f5083bf2aa8ffa2e022e9276699598ec438085a544ad 🔍`
SHA3	`15517c8754d5888f2762d62d4f244ea384d835602270a7c2e7de6ba3770f57de 🔍`
VirtualSize	`0x1ef`
VirtualAddress	`0x5000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.37894`

Imports

KERNEL32.dll	`GetCurrentProcessId` `GetTickCount` `GetSystemDirectoryA` `GetModuleFileNameA` `GetLastError`
USER32.dll	`MessageBoxA` `LoadStringA` `GetWindowTextA`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.