| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Mar-17 09:43:04 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
tg_unblock.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA1 Uses constants related to RC5 or RC6 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 1/71 (Scanned on 2026-03-26 14:45:44) | APEX: Malicious |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Mar-17 09:43:04 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2fd600 |
| SizeOfInitializedData | 0x36d600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000002E3D44 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x66e000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
LoadLibraryExA
FormatMessageW GetProcAddress LoadLibraryExW SetThreadErrorMode FreeLibrary HeapFree GetModuleFileNameW CreateFileW CloseHandle HeapAlloc GetProcessHeap GetCurrentThreadId LoadLibraryW GlobalLock GlobalAlloc SetLastError GetFinalPathNameByHandleW GlobalUnlock GlobalSize GlobalFree GetCurrentThread CreateEventW WaitForSingleObject CreateWaitableTimerExW SetWaitableTimer GetModuleHandleW GetCurrentProcess DuplicateHandle SetHandleInformation GetOverlappedResult PostQueuedCompletionStatus ReadFile GetLastError CreateIoCompletionPort GetQueuedCompletionStatusEx GetSystemTimeAsFileTime SetFileCompletionNotificationModes IsProcessorFeaturePresent Sleep GetModuleHandleA LoadLibraryA |
|---|---|
| advapi32.dll |
ImpersonateAnonymousToken
RevertToSelf SystemFunction036 |
| oleaut32.dll |
GetErrorInfo
SysFreeString SysStringLen SysAllocStringLen SafeArrayCreateVector SafeArrayPutElement VariantClear SetErrorInfo |
| ws2_32.dll |
accept
recv send WSACleanup ioctlsocket connect getsockopt WSAIoctl WSASocketW bind listen freeaddrinfo getaddrinfo WSAStartup WSAGetLastError socket setsockopt closesocket |
| secur32.dll |
InitializeSecurityContextW
AcceptSecurityContext EncryptMessage DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle AcquireCredentialsHandleA FreeContextBuffer DecryptMessage |
| crypt32.dll |
CertCloseStore
CertEnumCertificatesInStore CertOpenStore CertDuplicateStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext |
| api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
WakeByAddressSingle WakeByAddressAll |
| bcrypt.dll |
BCryptGenRandom
|
| ntdll.dll |
NtDeviceIoControlFile
NtOpenFile NtWriteFile NtCreateFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtCreateNamedPipeFile |
| bcryptprimitives.dll |
ProcessPrng
|
| OPENGL32.dll |
wglMakeCurrent
wglGetCurrentContext wglShareLists wglCreateContext wglGetProcAddress wglDeleteContext wglGetCurrentDC |
| SHLWAPI.dll |
AssocQueryStringW
|
| KERNEL32.dll |
IsDebuggerPresent
UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFileTime SetFileInformationByHandle ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx lstrlenW HeapReAlloc MultiByteToWideChar WideCharToMultiByte GetFileInformationByHandleEx SwitchToThread GetFileInformationByHandle FindFirstFileExW FindClose GetConsoleMode GetFullPathNameW ExitProcess QueryPerformanceFrequency CancelIo WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread WaitForMultipleObjects ReadFileEx SleepEx GetFileAttributesW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetSystemInfo GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind |
| USER32.dll |
GetWindowPlacement
GetDC GetClientRect GetWindowLongPtrW DispatchMessageW TranslateMessage PeekMessageW RedrawWindow ReleaseDC CreateIconFromResourceEx SendMessageW GetSystemMetrics GetActiveWindow DestroyWindow PostMessageW SetWindowPlacement EmptyClipboard IsClipboardFormatAvailable OpenClipboard SetClipboardData GetClipboardData RegisterClipboardFormatW CloseClipboard SetPropW SetWindowLongPtrW GetPropW CallWindowProcW RemovePropW RegisterWindowMessageA SetCapture GetClassNameW SystemParametersInfoA MonitorFromPoint EnumDisplayMonitors RegisterRawInputDevices MapVirtualKeyW MsgWaitForMultipleObjectsEx GetMonitorInfoW RegisterClassExW GetCursorPos DestroyCursor DestroyIcon GetClipCursor ClipCursor ShowCursor ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW GetMenu AdjustWindowRectEx SetWindowDisplayAffinity IsProcessDPIAware GetRawInputData CreateWindowExW ClientToScreen SetCursorPos GetForegroundWindow SetWindowPos InvalidateRgn LoadCursorW SetCursor ReleaseCapture GetClassInfoExW GetWindowRect IsIconic SendInput SetForegroundWindow GetWindowTextLengthW GetWindowTextW SetWindowTextW RegisterTouchWindow CreateIcon ScreenToClient MonitorFromRect TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle ValidateRect MapVirtualKeyExW GetKeyboardState GetAsyncKeyState GetKeyState GetKeyboardLayout ToUnicodeEx FlashWindowEx MonitorFromWindow ChangeDisplaySettingsExW DefWindowProcW |
| SHELL32.dll |
DragFinish
DragQueryFileW |
| GDI32.dll |
GetDeviceCaps
ChoosePixelFormat DescribePixelFormat SetPixelFormat DeleteObject CreateRectRgn SwapBuffers |
| uiautomationcore.dll |
UiaRaiseAutomationPropertyChangedEvent
UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaLookupId UiaGetReservedNotSupportedValue |
| ole32.dll |
RegisterDragDrop
OleInitialize CoCreateInstance CoUninitialize CoInitializeEx RevokeDragDrop |
| imm32.dll |
ImmGetContext
ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx |
| dwmapi.dll |
DwmEnableBlurBehindWindow
DwmSetWindowAttribute |
| uxtheme.dll |
SetWindowTheme
|
| VCRUNTIME140.dll |
__CxxFrameHandler3
memcpy memcmp _CxxThrowException __current_exception_context __C_specific_handler memset memmove __current_exception |
| api-ms-win-crt-math-l1-1-0.dll |
cos
floorf sin _hypotf floor truncf cbrtf trunc ceilf expf powf roundf acosf round sinf cosf __setusermatherr atan2f pow exp2f |
| api-ms-win-crt-string-l1-1-0.dll |
strlen
wcslen |
| api-ms-win-crt-runtime-l1-1-0.dll |
_configure_narrow_argv
_set_app_type terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit __p___argc __p___argv _seh_filter_exe _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table _register_onexit_function strerror exit |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
free |
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__p__commode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-17 09:43:04 |
| Version | 0.0 |
| SizeofData | 39 |
| AddressOfRawData | 0x5d1cf4 |
| PointerToRawData | 0x5d06f4 |
| Referenced File | tg_unblock.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-17 09:43:04 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x5d1d1c |
| PointerToRawData | 0x5d071c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-17 09:43:04 |
| Version | 0.0 |
| SizeofData | 836 |
| AddressOfRawData | 0x5d1d30 |
| PointerToRawData | 0x5d0730 |
| StartAddressOfRawData | 0x1405d2098 |
|---|---|
| EndAddressOfRawData | 0x1405d22c8 |
| AddressOfIndex | 0x140649640 |
| AddressOfCallbacks | 0x1402ffbe8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001402B2B40
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140649380 |
| XOR Key | 0xcabbfa92 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 12 |
| Imports (35207) | 2 |
| ASM objects (35207) | 3 |
| C objects (35207) | 9 |
| C++ objects (35207) | 23 |
| Imports (33145) | 13 |
| Total imports | 481 |
| Unmarked objects (#2) | 614 |
| Linker (35223) | 1 |
No comments yet.