bae4acac4a8a2b3b75234ec7dc8d582473e63ee0e9ddf09516e09235cccd214f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Oct-13 09:54:15

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • https://docs.rs
  • openssl.org
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to RC5 or RC6
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • CheckRemoteDebuggerPresent
  • CreateToolhelp32Snapshot
  • NtQueryInformationProcess
 Uses Windows's Native API:
  • NtCancelIoFileEx
  • NtCreateFile
  • NtDeviceIoControlFile
  • NtReadFile
  • NtWriteFile
  • NtQueryInformationProcess
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Leverages the raw socket API to access the Internet:
  • ws2_32.dll
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 e30c457440b8e3e705ea2c9b95745e27 🔍
SHA1 c38f02151aeb27c570e69dafcdb40196296a96de 🔍
SHA256 bae4acac4a8a2b3b75234ec7dc8d582473e63ee0e9ddf09516e09235cccd214f 🔍
SHA3 22a3527a5c82cc3ac00a90bca07bfff85eb29a040b18f5499586dddf78d093b5 🔍
SSDeep 49152:ZGLaAeuCDOmxOeYYs7+pTxZclv95b+fIU6is9:oaOmxOeHOlV55+s9 🔍
Imports Hash 72f9fa22aaba3c64939a9de78e82df22 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Oct-13 09:54:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x175400
SizeOfInitializedData 0x7e800
SizeOfUninitializedData 0x400
AddressOfEntryPoint 0x0000000000001440 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x1fb000
SizeOfHeaders 0x400
Checksum 0x201f45
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 2b29f3c49df9a1e779fe211ccfa5c519 🔍
SHA1 7080a0fed0e289e61d9487ae72300c6b207d80bb 🔍
SHA256 1b6415b09b9db16af3ab5f675f1b5e1321bd11040cfbce9347552bf98f6a879b 🔍
SHA3 ba02ca2eeae5d456893b3ef4656847f13395afce80fad5ff999c76670a39027b 🔍
VirtualSize 0x1752b0
VirtualAddress 0x1000
SizeOfRawData 0x175400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.34117

.data

MD5 db98bd58b2e211843e8f66d950f4af25 🔍
SHA1 02deca2fd27c249795c8001f90500f9a1ea94cf8 🔍
SHA256 0a38cab11b8915be54191e0c747259d2c048cd0d792baf98ea9228efda50ecec 🔍
SHA3 7cbe8d636cf797d713508a5bcd425e36317c1ac19bc5307d849f23205119b62c 🔍
VirtualSize 0xba0
VirtualAddress 0x177000
SizeOfRawData 0xc00
PointerToRawData 0x175800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.414011

.rdata

MD5 da182acade94401471d03a868a042bb2 🔍
SHA1 d9c8365014415b8ed8f0e230898240268c9eec6e 🔍
SHA256 2da10ff7217b2eff63f306573f826a817e2aae5df762f1471ffa1f2c21835595 🔍
SHA3 03fed61ade53bf722d138c0b89988bb2e875646888c0d2d1bb1cb9e79e13c9d1 🔍
VirtualSize 0x610e0
VirtualAddress 0x178000
SizeOfRawData 0x61200
PointerToRawData 0x176400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.02442

.eh_fram

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x4
VirtualAddress 0x1da000
SizeOfRawData 0x200
PointerToRawData 0x1d7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.pdata

MD5 82f4eb7aea24ab18e180c533379e8954 🔍
SHA1 0e671ff7f45cbbfd174b64d52a2af4b66f9fad1d 🔍
SHA256 1d3acae9a4db47e90da4f9a6e824dac356d37dfc8d5700ad67fc274700873188 🔍
SHA3 99a5a0b1f8a33464b4657cc7b74b50d8be1540dbd94687863a958fcc05beb6ce 🔍
VirtualSize 0xa908
VirtualAddress 0x1db000
SizeOfRawData 0xaa00
PointerToRawData 0x1d7800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.24187

.xdata

MD5 b7ba5a5c7b969491ba2585648d5e91cd 🔍
SHA1 4b41d9cc50db4686c807834adb780e62b0a0b8fc 🔍
SHA256 cba6afe58a62989c7e0d8d9a5af5824c662e6ebf7ca5d735cf25c84ea8bb16f3 🔍
SHA3 0d920404a6816bd650e2828e2aedd2ec4f033721982621f08a0e331be3be4d2a 🔍
VirtualSize 0xdb48
VirtualAddress 0x1e6000
SizeOfRawData 0xdc00
PointerToRawData 0x1e2200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.94218

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2c0
VirtualAddress 0x1f4000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 59adfaf2d1d547916751071f22ac3489 🔍
SHA1 eea5e62b54c3904e02b1315b1ad2637f0628f9af 🔍
SHA256 898fa4625542f0611eddd9d74cd06d07e1f73e24a96859eb7c478a47f892e467 🔍
SHA3 8a6b7b30532c0358dc0427a986361be03921499f2386e83cec7b88ce67b6ef99 🔍
VirtualSize 0x1a84
VirtualAddress 0x1f5000
SizeOfRawData 0x1c00
PointerToRawData 0x1efe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.40704

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x1f7000
SizeOfRawData 0x200
PointerToRawData 0x1f1a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 1c9e0b2037d76c267f9fa29bae42a86d 🔍
SHA1 520f5e185bf68875fffb4480a509144095a095fd 🔍
SHA256 d3bd2703274ee2ea461d0d4fc2ba6c32586f9019831fafd6151d1d946b8ca10b 🔍
SHA3 aac3d723d12bda4b4bcc53d7f600a1d83cc3c962aa264d927e8fb4bf1539d978 🔍
VirtualSize 0x22e4
VirtualAddress 0x1f8000
SizeOfRawData 0x2400
PointerToRawData 0x1f1c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.40581

Imports

kernel32.dll GetModuleHandleA
GetProcAddress
bcryptprimitives.dll ProcessPrng
api-ms-win-core-synch-l1-2-0.dll WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32.dll (#2) GetModuleHandleA
GetProcAddress
ntdll.dll NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
ws2_32.dll WSACleanup
WSAGetLastError
WSAIoctl
WSASend
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
ioctlsocket
recv
setsockopt
ADVAPI32.dll SystemFunction036
bcrypt.dll BCryptGenRandom
KERNEL32.dll AddVectoredExceptionHandler
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
GetCommandLineW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleW
GetSystemInfo
GetSystemTimePreciseAsFileTime
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Module32FirstW
Module32NextW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RtlUnwindEx
SetUnhandledExceptionFilter
VirtualQuery
__C_specific_handler
api-ms-win-crt-environment-l1-1-0.dll __p__environ
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
pow
api-ms-win-crt-private-l1-1-0.dll memcmp
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0.dll _set_app_type
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_fpreset
_initialize_narrow_environment
_initterm
_initterm_e
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-string-l1-1-0.dll memset
strlen
strncmp
ntdll.dll (#2) NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.