| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
2026-Apr-16 06:11:14
|
| Detected languages |
English - United States
|
| Suspicious |
The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
|
| Info |
The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
- LoadLibraryA
- GetProcAddress
|
| Suspicious |
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
| MD5 |
b57c71564e305909aeb330bbe2d02f35
|
| SHA1 |
98d743519f0b18571bfb1eabcc95db173535c549
|
| SHA256 |
c50756201833dec432bc06343b1a85e4f90f61949d3d9aba996975fd3d2fca64
|
| SHA3 |
25ee990f48433bb81f581fbd2c3b709b5a317a3bb7270b3ae81274ffb84ac6df
|
| SSDeep |
192:kerdeBdKOpHjnC8AaIpIUjpDloQJvtL/ovR:ZdeBdKOJnCpIUtRJl/ovR
|
| Imports Hash |
5882c1880ef93ab33708805ee335a702
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x100
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections |
3
|
| TimeDateStamp |
2026-Apr-16 06:11:14
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xf0
|
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic |
PE32+
|
| LinkerVersion |
14.0
|
| SizeOfCode |
0x2000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0x8000
|
| AddressOfEntryPoint |
0x000000000000A470 (Section: UPX1)
|
| BaseOfCode |
0x9000
|
| ImageBase |
0x140000000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
6.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
6.0
|
| Win32VersionValue |
0
|
| SizeOfImage |
0xc000
|
| SizeOfHeaders |
0x400
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve |
0x100000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
| VirtualSize |
0x8000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0x400
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
31ffa9620976dbe17dd1277d0eb97316
|
| SHA1 |
6375efb1d3346d84320a57035a7d3fc8eb8e2611
|
| SHA256 |
3d7b6a6e636ee5ff03bc018a7f2d1d8194d1a348735fb3f778114703c3da5455
|
| SHA3 |
d41968f105448f10b045a5fcb8d5a1422c914d57bf6753845c18ee4db7b577b1
|
| VirtualSize |
0x2000
|
| VirtualAddress |
0x9000
|
| SizeOfRawData |
0x1800
|
| PointerToRawData |
0x400
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
7.60247
|
| MD5 |
6c0c0d47b36dd9653323016136ed3815
|
| SHA1 |
ab231be6b1e6c6b72167b02e0086514256ef9fbd
|
| SHA256 |
096df4d3228a1ba9784cc321d807d38f107916d08feb6cbe07fbc31fbb8907af
|
| SHA3 |
d30e118827e754dff0e49a384cb573e7bec9d4e4ac7ff08831e91d4c6d4d3efe
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0xb000
|
| SizeOfRawData |
0x600
|
| PointerToRawData |
0x1c00
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
4.31479
|
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-runtime-l1-1-0.dll |
exit
|
| api-ms-win-crt-stdio-l1-1-0.dll |
getchar
|
| api-ms-win-crt-string-l1-1-0.dll |
strlen
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
|
| MSVCP140.dll |
?good@ios_base@std@@QEBA_NXZ
|
| VCRUNTIME140.dll |
memset
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| Type |
RT_MANIFEST
|
| Language |
English - United States
|
| Codepage |
UNKNOWN
|
| Size |
0x17d
|
| TimeDateStamp |
1980-Jan-01 00:00:00
|
| Entropy |
4.91161
|
| MD5 |
1e4a89b11eae0fcf8bb5fdd5ec3b6f61
|
| SHA1 |
4260284ce14278c397aaf6f389c1609b0ab0ce51
|
| SHA256 |
4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
|
| SHA3 |
4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353
|
| Size |
0x140
|
| TimeDateStamp |
1970-Jan-01 00:00:00
|
| Version |
0.0
|
| GlobalFlagsClear |
(EMPTY)
|
| GlobalFlagsSet |
(EMPTY)
|
| CriticalSectionDefaultTimeout |
0
|
| DeCommitFreeBlockThreshold |
0
|
| DeCommitTotalFreeThreshold |
0
|
| LockPrefixTable |
0
|
| MaximumAllocationSize |
0
|
| VirtualMemoryThreshold |
0
|
| ProcessAffinityMask |
0
|
| ProcessHeapFlags |
(EMPTY)
|
| CSDVersion |
0
|
| Reserved1 |
0
|
| EditList |
0
|
| SecurityCookie |
0x140005000
|
| XOR Key |
0x831f80e0
|
| Unmarked objects |
0
|
| Imports (VS2008 SP1 build 30729) |
12
|
| ASM objects (35403) |
4
|
| C objects (35403) |
10
|
| C++ objects (35403) |
19
|
| Imports (35403) |
6
|
| Imports (33145) |
3
|
| Total imports |
68
|
| C++ objects (LTCG) (35725) |
1
|
| Resource objects (35725) |
1
|
| Linker (35725) |
1
|
[*] Warning: Section UPX0 has a size of 0!