| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-May-28 17:25:05 |
| Info | Cryptographic algorithms detected in the binary: | Uses known Mersenne Twister constants |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 4/65 (Scanned on 2026-06-12 02:09:20) |
APEX:
Malicious
CrowdStrike: win/malicious_confidence_90% (D) Cynet: Malicious (score: 100) TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101ET26YF |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-May-28 17:25:05 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x46800 |
| SizeOfInitializedData | 0x1f000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000002D370 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x6a000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetModuleHandleW
ReleaseSRWLockExclusive AcquireSRWLockExclusive GetModuleHandleExA DisableThreadLibraryCalls GetProcAddress SetLastError GetPrivateProfileIntW GetFileAttributesW GetPrivateProfileStringW WriteConsoleW CreateFileW FlushInstructionCache SetThreadPriority RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitOnceComplete InitOnceBeginInitialize RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList GetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetFilePointerEx GetStringTypeW SetStdHandle HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode CloseHandle |
|---|---|
| XINPUT9_1_0.dll |
XInputGetState
|
| DINPUT8.dll |
DirectInput8Create
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-May-28 17:25:05 |
| Version | 0.0 |
| SizeofData | 912 |
| AddressOfRawData | 0x55b20 |
| PointerToRawData | 0x54720 |
| StartAddressOfRawData | 0x180055ef8 |
|---|---|
| EndAddressOfRawData | 0x180055f00 |
| AddressOfIndex | 0x18005e36c |
| AddressOfCallbacks | 0x180048360 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x18005d200 |
| XOR Key | 0x6b8317c7 |
|---|---|
| Unmarked objects | 0 |
| C objects (33145) | 12 |
| ASM objects (33145) | 8 |
| ASM objects (35207) | 12 |
| C objects (35207) | 15 |
| C++ objects (35207) | 42 |
| C++ objects (33145) | 139 |
| C objects (CVTCIL) (33145) | 1 |
| Imports (33145) | 7 |
| Total imports | 109 |
| C++ objects (LTCG) (35225) | 13 |
| ASM objects (35225) | 1 |
| Linker (35225) | 1 |
No comments yet.