| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-May-27 19:54:23 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\000\source\repos\fffffff\x64\Debug\fffffff.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Tries to detect virtualized environments:
|
| Info | Cryptographic algorithms detected in the binary: | Uses known Mersenne Twister constants |
| Suspicious | The PE is possibly packed. |
Section .textbss is both writable and executable.
Unusual section name found: .msvcjmc |
| Malicious | The PE contains functions mostly used by malware. |
Can access the registry:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 2026-May-27 19:54:23 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x13800 |
| SizeOfInitializedData | 0xf000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000114E7 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x39000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
SetConsoleTitleA
SetConsoleOutputCP SetComputerNameExA GetCurrentProcess CloseHandle DeleteFileA GetEnvironmentVariableA FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId GetProcAddress |
|---|---|
| ADVAPI32.dll |
RegDeleteTreeA
RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegDeleteValueA RegCloseKey GetTokenInformation OpenProcessToken |
| MSVCP140D.dll |
?_Xout_of_range@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ |
| VCRUNTIME140D.dll |
memmove
__std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __current_exception __current_exception_context __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy |
| VCRUNTIME140_1D.dll |
__CxxFrameHandler4
|
| ucrtbased.dll |
_c_exit
_register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode _free_dbg strcpy_s _seh_filter_dll _CrtDbgReport __p___argv _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s __stdio_common_vsprintf_s _invoke_watson _cexit _set_fmode _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment strcat_s __setusermatherr __p___argc _set_app_type _seh_filter_exe _CrtDbgReportW malloc _register_onexit_function _callnewh __stdio_common_vfprintf __acrt_iob_func system _initialize_onexit_table strlen _configure_narrow_argv |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-27 19:45:50 |
| Version | 0.0 |
| SizeofData | 80 |
| AddressOfRawData | 0x29b68 |
| PointerToRawData | 0x18768 |
| Referenced File | C:\Users\000\source\repos\fffffff\x64\Debug\fffffff.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-27 19:45:50 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x29bb8 |
| PointerToRawData | 0x187b8 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14002d040 |
| XOR Key | 0x3c4b72a4 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (35207) | 3 |
| C objects (35207) | 11 |
| C++ objects (35207) | 30 |
| Imports (35207) | 6 |
| Imports (33145) | 7 |
| Total imports | 101 |
| C++ objects (35227) | 1 |
| Resource objects (35227) | 1 |
| Linker (35227) | 1 |
No comments yet.