| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Dec-30 01:32:49 |
| TLS Callbacks | 3 callback(s) detected. |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Tries to detect virtualized environments:
|
| Suspicious | The PE is possibly packed. | Unusual section name found: .xdata |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
30616 bytes of data starting at offset 0x107200.
The overlay data has an entropy of 7.3328 and is possibly compressed or encrypted. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2017-Dec-30 01:32:49 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xcf800 |
| SizeOfInitializedData | 0x37600 |
| SizeOfUninitializedData | 0xe00 |
| AddressOfEntryPoint | 0x0000000000001420 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x10d000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
CloseEventLog
CloseServiceHandle EnumServicesStatusExA GetNumberOfEventLogRecords OpenEventLogA OpenSCManagerA RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA |
|---|---|
| GDI32.dll |
GetDeviceCaps
|
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| KERNEL32.dll |
BuildCommDCBAndTimeoutsA
CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateFileA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA GetCPInfo GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentVariableA GetFileAttributesA GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemDefaultLCID GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultUILanguage GetVolumeInformationA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent K32EnumDeviceDrivers K32GetDeviceDriverFileNameW LeaveCriticalSection LoadLibraryW LocalFree Module32FirstW Module32NextW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte |
| MFPlat.DLL |
MFShutdown
MFStartup MFTEnumEx |
| msvcrt.dll |
iswctype
_assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _setjmp _setmode _time64 _vscprintf _vsnprintf abort atexit calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _strdup _read _fileno |
| ole32.dll |
CoCreateInstance
CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize |
| OLEAUT32.dll |
SysAllocString
SysFreeString VariantClear VariantInit |
| SETUPAPI.dll |
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo SetupDiGetClassDevsA |
| USER32.dll |
EnumWindows
GetCursorPos GetDC GetLastInputInfo GetSystemMetrics GetWindowTextA IsClipboardFormatAvailable IsWindowVisible ReleaseDC |
| WININET.dll |
HttpOpenRequestA
HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile |
| StartAddressOfRawData | 0x14010a000 |
|---|---|
| EndAddressOfRawData | 0x14010a018 |
| AddressOfIndex | 0x14010707c |
| AddressOfCallbacks | 0x1400eb2b0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000140019BA0
0x0000000140019B80 0x0000000140028C60 |
No comments yet.