| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jul-11 14:58:05 |
| Detected languages |
English - United States
|
| TLS Callbacks | 3 callback(s) detected. |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .xdata |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0 |
| e_cp | 0 |
| e_crlc | 0 |
| e_cparhdr | 0 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0x4550 |
| e_csum | 0 |
| e_ip | 0x8664 |
| e_cs | 0xa |
| e_ovno | 0x6a52 |
| e_oemid | 0xf0 |
| e_oeminfo | 0x22f |
| e_lfanew | 0x10 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 2026-Jul-11 14:58:05 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x21dc00 |
| SizeOfInitializedData | 0x2c7c00 |
| SizeOfUninitializedData | 0x6c00 |
| AddressOfEntryPoint | 0x00000000000014D0 (Section: .text) |
| BaseOfCode | 0x10 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2d3000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2d740d |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
AddVectoredExceptionHandler
AreFileApisANSI CloseHandle CopyFileExW CreateDirectoryExW CreateDirectoryW CreateEventA CreateFileW CreateSemaphoreA DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FormatMessageA FormatMessageW GetComputerNameA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileTime GetFullPathNameW GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount64 GetWindowsDirectoryW InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA RaiseException ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleTitleA SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFilePointerEx SetFileTime SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeConditionVariable WideCharToMultiByte |
|---|---|
| msvcrt.dll |
__C_specific_handler
___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _access _acmdln _aligned_free _aligned_malloc _amsg_exit _assert _beginthreadex _cexit _close _commode _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _getpid _gmtime64 _initterm _lock _lseeki64 _onexit _read _setjmp _stat64 _stricmp _strdup _strnicmp _swab _time64 _ultoa _unlink _unlock _utime64 _vsnprintf _wfopen abort atoi bsearch calloc clock exit fclose feof ferror fflush fgetpos fopen fprintf fputc fputs fread free fseek fsetpos ftell fwrite getc getenv getwc islower isspace isupper iswctype isxdigit _write localeconv log10 longjmp malloc memchr memcmp memcpy memmove memset printf putc putwc qsort realloc rand setlocale setvbuf signal strcat strchr strcmp strcoll strcpy strerror strftime strlen strncmp strncpy strtol strtoul strxfrm system tmpnam tolower towlower towupper ungetc vfprintf ungetwc wcscoll wcsftime wcslen wcstombs wcsxfrm |
| StartAddressOfRawData | 0x1402d1000 |
|---|---|
| EndAddressOfRawData | 0x1402d1008 |
| AddressOfIndex | 0x1402ccefc |
| AddressOfCallbacks | 0x1402d0038 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x000000014015B350
0x000000014015B320 0x000000014016E420 |
No comments yet.