de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2025-Mar-22 06:40:57
Detected languages English - United States
Debug artifacts D:\a\_work\1\b\amd64\tls12-download.pdb

Plugin Output

Info The PE contains common functions which appear in legitimate applications. Has Internet access capabilities:
  • WinHttpReadData
  • WinHttpConnect
  • WinHttpCloseHandle
  • WinHttpGetIEProxyConfigForCurrentUser
  • WinHttpQueryHeaders
  • WinHttpReceiveResponse
  • WinHttpSendRequest
  • WinHttpOpenRequest
  • WinHttpSetOption
  • WinHttpOpen
Info The PE is digitally signed. Signer: Microsoft Corporation
Issuer: Microsoft Code Signing PCA 2011
Safe VirusTotal score: 0/71 (Scanned on 2026-10-15 08:30:12) All the AVs think this file is safe.

Hashes

MD5 e6363b8ec386338ce08f159a739f0e97 🔍
SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed 🔍
SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4 🔍
SHA3 c3a581d54912c6b4b92e33e51ef516c4c6619f54004545b2351eab7704acdf9e 🔍
SSDeep 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c 🔍
Imports Hash efbc5d32d2077e678dc0b30693365b4b 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Mar-22 06:40:57
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1600
SizeOfInitializedData 0x2a600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000010F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x31000
SizeOfHeaders 0x400
Checksum 0x104ad
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5b7c6d8dbcbeb6448a121ce5d18ca513 🔍
SHA1 1aa53d5cf99318275c294709f1b424d0fbc604e3 🔍
SHA256 8fd8841ae535b45f93ed1bbf67cd5efccc01a101f5de242d7b62777065c1ffb7 🔍
SHA3 ac94010179fddadf9467d2e8a86b7b4bc07905296b2edb726b4a54fd5e0cd84b 🔍
VirtualSize 0x14f6
VirtualAddress 0x1000
SizeOfRawData 0x1600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.75207

.rdata

MD5 6b2e513534798f856a7e871ae5646197 🔍
SHA1 8eb3efb53e89683cbb5fed8347b3f98110ee4f58 🔍
SHA256 ad15d4fa4ad397779b3dd503c4c7ed7dda509674091ce0f32a1f1f6ddd2c0249 🔍
SHA3 476e839790a76b41fd8f6465857aea8138e339f6174eb897f2951110dceb3539 🔍
VirtualSize 0x1418
VirtualAddress 0x3000
SizeOfRawData 0x1600
PointerToRawData 0x1a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.68844

.data

MD5 ecc70401998327e185b9fe7c56f6acc3 🔍
SHA1 e5cc81c2327bd86606b5865ebba09b36a12d52f1 🔍
SHA256 3189a6cdae34e147303d9523c2fcaf36e1aedff1aa546a473fcc3f306cb5392c 🔍
SHA3 882d4c24e3a46c0947b76ecbd3f07170089a400f91cc3a1622a99d4c558ad1d4 🔍
VirtualSize 0x285c8
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.281092

.pdata

MD5 37d76257c2c0683e45d1c0c574e6f6e4 🔍
SHA1 4c3a7160f38ff17d6341056bf48d8a06ff4f201f 🔍
SHA256 9e784d7e3a07170d47cf4374a7778d3243096a07276a48b83a25568c9e72cbde 🔍
SHA3 1aa8b0845faee0c0b3e66cc3e0d58e5842ac1fa009f7afe08737360598d81956 🔍
VirtualSize 0x18c
VirtualAddress 0x2e000
SizeOfRawData 0x200
PointerToRawData 0x3200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.12178

.rsrc

MD5 2efead311d347fc2db36e1355d1738fc 🔍
SHA1 edddc146935a7f46b548e233ff8b353ec8f74603 🔍
SHA256 f9452914a7140cf71d81c4d985ba86d76515dbba8d0ff8746ea997a042dcbeb2 🔍
SHA3 139751426b0913a1f480ba3a7c1ee707e0717896bfa46ab7ce273fca7c6d82ae 🔍
VirtualSize 0x520
VirtualAddress 0x2f000
SizeOfRawData 0x600
PointerToRawData 0x3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.05845

.reloc

MD5 2c2166043e231bbb459cb741beff9517 🔍
SHA1 2833f1500992dd87b32a8b3858d80efc57c0305c 🔍
SHA256 9122d2d64503c11066db894ae823467788b527832d15948c81a137c82a834efd 🔍
SHA3 e6e69809044793706f7a4f31f157b546fb643b7c8dd3e44781ff662b3368001d 🔍
VirtualSize 0x28
VirtualAddress 0x30000
SizeOfRawData 0x200
PointerToRawData 0x3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.602845

Imports

WINHTTP.dll WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpOpen
WINTRUST.dll WinVerifyTrust
SHELL32.dll CommandLineToArgvW
KERNEL32.dll CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
WriteConsoleW
WideCharToMultiByte
FormatMessageW
GlobalFree
GetModuleHandleW
GetStdHandle
GetCommandLineW
GetEnvironmentVariableW
CreateFileW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointer
WriteFile
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
TerminateProcess

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x4bb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.35391
MD5 87f476ef2f5356dd597398775caa1a00 🔍
SHA1 e621cb636985e2200f1f044bc69acedb1890d6b4 🔍
SHA256 aeed0684378192358c63e5f26bb9ceb0f81522d0769a91faa7fc5ccd4aa23ff6 🔍
SHA3 3cace8de13c3066d40d6b85918c232a04bf51d74a4c94237e29c56f2b5494399 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Mar-22 06:40:57
Version 0.0
SizeofData 64
AddressOfRawData 0x3af4
PointerToRawData 0x24f4
Referenced File D:\a\_work\1\b\amd64\tls12-download.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2025-Mar-22 06:40:57
Version 0.0
SizeofData 20
AddressOfRawData 0x3b34
PointerToRawData 0x2534

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Mar-22 06:40:57
Version 0.0
SizeofData 416
AddressOfRawData 0x3b48
PointerToRawData 0x2548

UNKNOWN

Characteristics 0
TimeDateStamp 2025-Mar-22 06:40:57
Version 0.0
SizeofData 4
AddressOfRawData 0x3ce8
PointerToRawData 0x26e8

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140005000
GuardCFCheckFunctionPointer 5368721776
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xc0174211
Unmarked objects 0
ASM objects (34321) 3
C++ objects (34321) 1
C objects (34321) 5
Imports (33140) 9
Total imports 42
C objects (34438) 1
Resource objects (34438) 1
Linker (34438) 1

Errors

Leave a comment

No comments yet.