eccc994dcea470fe4a4b606f93cba2a4467240d377e07748218a1abb7085909e
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Jun-18 01:57:37 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
Plugin Output
| Suspicious | The PE is possibly packed. | Unusual section name found: .buildid |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 84.8058% of the executable. |
| Safe | VirusTotal score: 0/71 (Scanned on 2026-08-28 02:49:44) | All the AVs think this file is safe. |
Hashes
| MD5 | 84a05797b7a7f1070b33467df0fc8cc7 🔍 |
|---|---|
| SHA1 | a55bc78a702168e220264c0e07474ad97ff980c0 🔍 |
| SHA256 | eccc994dcea470fe4a4b606f93cba2a4467240d377e07748218a1abb7085909e 🔍 |
| SHA3 | b46bec9eaca6346f659bffb659e0952e058c9bd2e325812fbdcb9eb8bb96dfc0 🔍 |
| SSDeep | 3072:U3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:CQ+IFCumUGekHRvEuO3go9kfnQ 🔍 |
| Imports Hash | a9563ca2ee659a9314820bead4ec962b 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2024-Jun-18 01:57:37 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1e00 |
| SizeOfInitializedData | 0x17600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001140 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2885d |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 612f13b1a20949bba1c805c638495c00 🔍 |
|---|---|
| SHA1 | 8e74a79958acf6488fe615dee4173a4b96e39fae 🔍 |
| SHA256 | 4ab9a6254f73f4956601a46361357f0ad92d238a43ae6f8eab200fa5047c1415 🔍 |
| SHA3 | 1e7a84cf73f8503dee0f05389252d65ec5d8e1cb349fe970a29a24a6db3def5a 🔍 |
| VirtualSize | 0x1c86 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1e00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.77527 |
.rdata
| MD5 | dcb7faae7abc7c1dfadac4c2855067fa 🔍 |
|---|---|
| SHA1 | cae7ca686a9024d78f8289ce8674185151ec9550 🔍 |
| SHA256 | 38d9791ed6ef45149712782f4a0ccfb42f23c02b3a4492ca7f03e53b9cbdecdc 🔍 |
| SHA3 | 7f6f0f51025e8dd9feeb07420ea2050bd7396785845219b11465ff5de10d62bc 🔍 |
| VirtualSize | 0x114c |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x1200 |
| PointerToRawData | 0x2200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.35065 |
.buildid
| MD5 | e1cf6c2ead62fb15cda57a9af9f35ff3 🔍 |
|---|---|
| SHA1 | 006f1295230ce278ecf693f1245472edc3ea1f98 🔍 |
| SHA256 | babbaa2b5d8dd783b2562829cc202d9c8d95f311a971f12c76b450c984fbf25e 🔍 |
| SHA3 | 1b048063c24fd0fe13419b6906352ab8dc69b414e9ca83988bfc41a47ae0e65e 🔍 |
| VirtualSize | 0x35 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.600755 |
.data
| MD5 | d36e8e0be902e9d81289ba090cc311e5 🔍 |
|---|---|
| SHA1 | 6d2c8cf042080bc1196e5565f5b2aa7854c74458 🔍 |
| SHA256 | a028f657d3a4672e79bfecb170e886116cbd0b06e428d842c91c20f05784ec66 🔍 |
| SHA3 | eb6eebff34b04427a10388b0c0285cbd5904f812b78d60a49dbd74bd6afa4325 🔍 |
| VirtualSize | 0x1bc |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.42505 |
.pdata
| MD5 | 96b91119ce3f4f34345e33b607b00a4d 🔍 |
|---|---|
| SHA1 | 47f375ecbcc5dee11fcadc69f4f66feaa2812e65 🔍 |
| SHA256 | 6b6d61042d983cc28576e611fed69c351522e7188a7fe4ad6b870276bff8351d 🔍 |
| SHA3 | f839da7b9cf99a56b06fe69b6fc83d09a617654109243f8a352898a60c299d0c 🔍 |
| VirtualSize | 0x18c |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 3.12203 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | a5988c2b738114e49123bc8be4105e1a 🔍 |
|---|---|
| SHA1 | b9261d08d1d802247646dda59de3f5669dfa81e3 🔍 |
| SHA256 | 5980b26d5b916e89fdb4b706e7a45cfcdeba9e5aac839af102304dd9ed583780 🔍 |
| SHA3 | 24ae65a3e695d3c5a2935a63f19d1458725aaf10019f07b6597317cf3a3d5fa8 🔍 |
| VirtualSize | 0x15b38 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x15c00 |
| PointerToRawData | 0x3c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.72197 |
Imports
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
calloc free malloc |
|---|---|
| api-ms-win-crt-private-l1-1-0.dll |
__C_specific_handler
memcpy |
| api-ms-win-crt-runtime-l1-1-0.dll |
__p___argc
__p___argv __p___wargv __p__wcmdln _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal |
| api-ms-win-crt-stdio-l1-1-0.dll |
__acrt_iob_func
__p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vswprintf fwrite |
| api-ms-win-crt-string-l1-1-0.dll |
_wcsdup
memset strlen strncmp wcslen |
| USER32.dll |
MessageBoxW
|
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection GetLastError GetProcAddress GetStartupInfoW InitializeCriticalSection LeaveCriticalSection LoadLibraryW SetDllDirectoryW SetUnhandledExceptionFilter Sleep TlsGetValue VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-environment-l1-1-0.dll |
__p__environ
__p__wenviron |
| api-ms-win-crt-time-l1-1-0.dll |
__daylight
__timezone __tzname _tzset |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x11f0c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.98525 |
| Detected Filetype | PNG graphic file |
| MD5 | c9f2e144c594f125c93d67c8589f94cb 🔍 |
| SHA1 | 3c83859ad32e00831d73c3e7e0ecf016ed70a8a2 🔍 |
| SHA256 | bb0f432405dd0146e10cad611fc2eacda864a4705a7cf27b7957c432ad437b7e 🔍 |
| SHA3 | 0d561b06ed1cb8e63659c0d580b100365c851645a357d7701ff7d6a5eccb9895 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.11793 |
| MD5 | 458152437bed22f7bd89dc69aaf15bd7 🔍 |
| SHA1 | e29320ba2f2fddd739a8d2237c3117450ac2011c 🔍 |
| SHA256 | b3192a18fb10675280f881680135b4f37d7fdc5af7d201069c1b3f47aa54d7e3 🔍 |
| SHA3 | 39e2df21afb4ff57d701847ce8a9eca894ba53a5a29a7416cfe02e8b33cb142c 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.27096 |
| MD5 | 534215cef211a152679a4cc7bd91b7e1 🔍 |
| SHA1 | 62ba9c1c73df21644c609d3b5fd2edc946eafadb 🔍 |
| SHA256 | 8ac5e2c08e72998d06b9e79cc3522364730330763554bbebdfabc9a7bf0d1b46 🔍 |
| SHA3 | 6f560168e19f37e1a6310914163bc1e23f5da7da7910ed604eb5cd4ed3bdc84f 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.62596 |
| MD5 | bd322d31714690439d11eb16737f4821 🔍 |
| SHA1 | 344bbc216eeb6eba8e5fc6ce9f6bf3ded62fa918 🔍 |
| SHA256 | 3801536907d2cffe216dda35c7fab46e36f0802c9738d1d52f79a9d19ba9fc4a 🔍 |
| SHA3 | f99cbc3cc5967660460bcbeeda1c04d2155acb2e8e28b4148172cec5840beab1 🔍 |
0
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x3e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.48426 |
| Detected Filetype | Icon file |
| MD5 | 84f9c249f731e2e8756bc805e0eb83f0 🔍 |
| SHA1 | 66821612a3fff9cd372d29d23f1a1132a759895e 🔍 |
| SHA256 | e5fadec1ca3f88b262845c6e300b837214a554eae5084921f3c5178b74c1796d 🔍 |
| SHA3 | 51da84cac26f96fa9fab3f458ffedf84ba493a6be14cfd91df5dc3e6225aac8c 🔍 |
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Jun-18 01:57:37 |
| Version | 0.0 |
| SizeofData | 25 |
| AddressOfRawData | 0x501c |
| PointerToRawData | 0x341c |
TLS Callbacks
| StartAddressOfRawData | 0x140008000 |
|---|---|
| EndAddressOfRawData | 0x140008008 |
| AddressOfIndex | 0x140006128 |
| AddressOfCallbacks | 0x140003530 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x0000000140001780
0x0000000140001800 |
Load Configuration
RICH Header
Errors
[!] Error: Could not reach the requested directory (offset=0x0).
Leave a comment
No comments yet.