| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Feb-28 02:56:33 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .xdata |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 11 |
| TimeDateStamp | 2026-Feb-28 02:56:33 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x1b200 |
| SizeOfInitializedData | 0x23600 |
| SizeOfUninitializedData | 0x110e00 |
| AddressOfEntryPoint | 0x00000000000014D0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x13b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.DLL |
AllocConsole
CheckRemoteDebuggerPresent CloseHandle CreateFileA CreateMutexA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindNextFileA FreeConsole FreeLibrary GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetFileAttributesA GetFileAttributesExA GetFileSize GetFileSizeEx GetFullPathNameA GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessId GetStartupInfoA GetTempPathA GetVersionExA GetVolumeInformationA InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryA LocalFree Module32FirstW Module32NextW MoveFileA MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW ReadFile ReleaseMutex SetConsoleCtrlHandler SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery VirtualQueryEx WaitForSingleObject WideCharToMultiByte __C_specific_handler |
|---|---|
| ADVAPI32.dll |
AdjustTokenPrivileges
AllocateAndInitializeSid FreeSid GetSecurityInfo LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA SetEntriesInAclA SetSecurityInfo |
| bcrypt.dll |
BCryptCloseAlgorithmProvider
BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider |
| CRYPT32.dll |
CertGetNameStringA
|
| GDI32.dll |
BitBlt
CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject |
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| msvcrt.dll |
___lc_codepage_func
___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _localtime64 _lock _onexit _stricmp _strnicmp _time64 _unlock abort atoi calloc exit fclose fflush fopen fprintf fputc free freopen fwrite getc islower isspace isupper isxdigit localeconv malloc memcpy memset realloc signal strchr strcmp strerror strftime strlen strncmp strncpy strrchr strstr strtol strtoul tolower ungetc vfprintf wcslen wcsrchr |
| ole32.dll |
CoCreateInstance
CoInitializeEx CoUninitialize CreateStreamOnHGlobal |
| SHELL32.dll |
ShellExecuteA
|
| USER32.dll |
EnumWindows
GetClassNameW GetDC GetSystemMetrics GetWindowTextW GetWindowThreadProcessId IsWindowVisible ReleaseDC wsprintfW |
| WINHTTP.dll |
WinHttpCloseHandle
WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend |
| WINTRUST.dll |
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATCatalogInfoFromContext WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust |
| StartAddressOfRawData | 0x140138000 |
|---|---|
| EndAddressOfRawData | 0x140138008 |
| AddressOfIndex | 0x14013402c |
| AddressOfCallbacks | 0x140137038 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x000000014000D5F0
0x000000014000D5C0 |
No comments yet.