Manalyze report for ed8559e5b77401831fd91517ac3939adbb6465baca2881c89d788f02128f8387

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-26 08:01:51
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	PEiD Signature:	`HQR data file`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` `Contains domain names: dearimgui.org discord.com http://scripts.sil.org http://scripts.sil.org/OFLInterSemiBoldInterSemiBoldOpen http://scripts.sil.org/OFLOpen http://scripts.sil.org/OFLhttp http://www.dearimgui.org http://www.dearimgui.org/faq/ https://discord.com https://rsms.me scripts.sil.org www.dearimgui.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to RC5 or RC6`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Code injection capabilities: CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory` `Possibly launches other programs: CreateProcessW` `Uses Windows's Native API: NtOpenFile NtReadFile NtWriteFile NtCreateNamedPipeFile` `Memory manipulation functions often used by packers: VirtualAllocEx VirtualProtect` `Manipulates other processes: OpenProcess Process32FirstW Process32NextW WriteProcessMemory`
Malicious	VirusTotal score: 8/62 (Scanned on 2026-10-29 15:17:29)	`APEX: Malicious` `Bkav: W32.Malware.C2E36616` `CrowdStrike: win/malicious_confidence_60% (D)` `Elastic: malicious (high confidence)` `Malwarebytes: Malware.Heuristic.2518` `McAfeeD: ti!ED8559E5B774` `SentinelOne: Static AI - Suspicious PE` `Symantec: ML.Attribute.HighConfidence`

Hashes

MD5	`2336c4ae04cbe0d8bf9869e26db94777` 🔍
SHA1	`439e03d6bff1ddf811986ab8136e7d0a77effa1a` 🔍
SHA256	`ed8559e5b77401831fd91517ac3939adbb6465baca2881c89d788f02128f8387` 🔍
SHA3	`a3327cb70f86b4112361e05f74d1bb610d99e8a322518097217c6c81c34dc317` 🔍
SSDeep	`196608:3ZVRe67hWqEepet/h8cb5HC9hSClEtPIP/cY:pu6WxeEt/h49hrym` 🔍
Imports Hash	`00e6f403020e9edc8ab1696990eaeec6` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	2026-Oct-26 08:01:51
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x34000`
SizeOfInitializedData	`0xbb7200`
SizeOfUninitializedData	`0x200`
AddressOfEntryPoint	`0x0000000000001440 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xbf3000`
SizeOfHeaders	`0x400`
Checksum	`0xbf1e7d`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`45341faee6bbcd474d175f5d4735991f 🔍`
SHA1	`2ae4f9924954b5477514f43b0c096fda0855c3b4 🔍`
SHA256	`66c9803356d6e55b46fef6fae8a6fafb0a4d18c338aa072c1ed1c5331b650406 🔍`
SHA3	`c6b79be9d1bc0382700fbcf12652312887d749fd1358e31501ff4c3f4a8b053b 🔍`
VirtualSize	`0x33fb0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x34000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.37977`

.data

MD5	`18abda05eb2e243d2ccbc7bec2d71725 🔍`
SHA1	`36451bd48e6fb6ca4abb464ed8b7858a5747e730 🔍`
SHA256	`c0807eb228a1aba2541c0e97e14679c87b5dfb858ec29e8726b3647d1498fc19 🔍`
SHA3	`c2532e0bae67023ac718ac71aed335d31be5305471cf26c189beb4fc34aa8679 🔍`
VirtualSize	`0x140`
VirtualAddress	`0x35000`
SizeOfRawData	`0x200`
PointerToRawData	`0x34400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.656237`

.rdata

MD5	`0b71b5ae357e5a6e87f9d61ad600ef00 🔍`
SHA1	`f4716177f8b268faf53694911f4c39de9cd10950 🔍`
SHA256	`485a5da3501a28cc5af39d0b85cfb7f95f2711da7741755609a34b69698f46ce 🔍`
SHA3	`e262d044adcde019ba68338ab36f6fc512b447fd99856684d3408e285d29ae91 🔍`
VirtualSize	`0xbb2ba8`
VirtualAddress	`0x36000`
SizeOfRawData	`0xbb2c00`
PointerToRawData	`0x34600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.97832`

.eh_fram

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0xbe9000`
SizeOfRawData	`0x200`
PointerToRawData	`0xbe7200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`e0a0c41e7dbcccdad165a9b6cc0a2539 🔍`
SHA1	`4c727389e47fb5fa92343faeeb8041a173b7ec9d 🔍`
SHA256	`52c6ba44adf91395ffce0a7f3c806bd8a678f35805029a16d0e4da8c236c93e0 🔍`
SHA3	`d7ea10803a2988db7d96c35e2de11fc5dce2caa1b314a6c53a4b77f437300085 🔍`
VirtualSize	`0x1080`
VirtualAddress	`0xbea000`
SizeOfRawData	`0x1200`
PointerToRawData	`0xbe7400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.18513`

.xdata

MD5	`39e5a69231c4663221b03b0a7694f074 🔍`
SHA1	`39dbac75c5f80d57162521b80d4af545712f8ad3 🔍`
SHA256	`0c63449bebe55e2da5073e41022e64959856adbee2baaa340a719c83e677369a 🔍`
SHA3	`81665a24a0d5efb9db228710d7b84f94c120d026b2f43a78fd4449d085c29ccb 🔍`
VirtualSize	`0x131c`
VirtualAddress	`0xbec000`
SizeOfRawData	`0x1400`
PointerToRawData	`0xbe8600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.55207`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x200`
VirtualAddress	`0xbee000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`33fe105cfae68c7fb011f5ec7ee7e69b 🔍`
SHA1	`aecbfda35fe5203e109784ccb538b725b533c95d 🔍`
SHA256	`79cb852d392268b149a3634ad8aba4913096e4e0fb4966129094f1eab390ed3a 🔍`
SHA3	`35972f7da33b47384abcffbcce2e9d33797342b798057573a6f3464e2ec102c4 🔍`
VirtualSize	`0x16fc`
VirtualAddress	`0xbef000`
SizeOfRawData	`0x1800`
PointerToRawData	`0xbe9a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.34799`

.tls

MD5	`747c714797088e60103392e24735de13 🔍`
SHA1	`00acd5e8767a1a52b498c4be047963bec3a9da6a 🔍`
SHA256	`23a9f7ce466cac10e118dad8e706d13357eea25f9c719e90e7de04ac960698ea 🔍`
SHA3	`0bc8d02c91cba2f38fd3969fbbc168a2f663248eafbcf544316a59d89fe3e70f 🔍`
VirtualSize	`0x58`
VirtualAddress	`0xbf1000`
SizeOfRawData	`0x200`
PointerToRawData	`0xbeb200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0407808`

.reloc

MD5	`b871af3852decac8a27a7cd2bec2819d 🔍`
SHA1	`8a7434bd55e0b56e0761526eba6b11d837a0b2a6 🔍`
SHA256	`b3fd491603f89daa700aede97e5085c8bcc739dfd2f875e6d879fa75e0aec2a9 🔍`
SHA3	`2d901f35edbdaf8539fe9198e8539d9a65de62a8a24c0ca81caa7f5d3445da22 🔍`
VirtualSize	`0xf4`
VirtualAddress	`0xbf2000`
SizeOfRawData	`0x200`
PointerToRawData	`0xbeb400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.06229`

Imports

api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressAll` `WakeByAddressSingle`
kernel32.dll	`CloseHandle` `CompareStringOrdinal` `CreateDirectoryW` `CreateFileW` `CreateProcessW` `CreateRemoteThread` `CreateThread` `CreateToolhelp32Snapshot` `CreateWaitableTimerExW` `DuplicateHandle` `ExitProcess` `FindClose` `FindFirstFileExW` `FlsAlloc` `FlsFree` `FlsSetValue` `FlushFileBuffers` `FormatMessageW` `FreeEnvironmentStringsW` `FreeLibrary` `GetCommandLineW` `GetConsoleMode` `GetConsoleOutputCP` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetEnvironmentStringsW` `GetEnvironmentVariableW` `GetExitCodeThread` `GetFileAttributesW` `GetFileInformationByHandle` `GetFileInformationByHandleEx` `GetFullPathNameW` `GetLastError` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleExW` `GetModuleHandleW` `GetProcAddress` `GetProcessHeap` `GetProcessId` `GetStdHandle` `GetSystemDirectoryW` `GetSystemTimePreciseAsFileTime` `GetWindowsDirectoryW` `HeapAlloc` `HeapFree` `HeapReAlloc` `IsThreadAFiber` `LoadLibraryA` `Module32FirstW` `Module32NextW` `MultiByteToWideChar` `OpenProcess` `Process32FirstW` `Process32NextW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `ReadConsoleW` `ReadFileEx` `SetFileInformationByHandle` `SetFilePointerEx` `SetFileTime` `SetLastError` `SetUnhandledExceptionFilter` `SetWaitableTimer` `Sleep` `SleepEx` `VirtualAllocEx` `VirtualFreeEx` `WaitForSingleObject` `WideCharToMultiByte` `WriteConsoleW` `WriteFileEx` `WriteProcessMemory`
ntdll.dll	`NtOpenFile` `NtReadFile` `NtWriteFile` `RtlNtStatusToDosError`
KERNEL32.dll	`DeleteCriticalSection` `EnterCriticalSection` `InitializeCriticalSection` `LeaveCriticalSection` `RaiseException` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `TlsGetValue` `VirtualProtect` `VirtualQuery` `__C_specific_handler`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-private-l1-1-0.dll	`memcmp` `memcpy` `memmove`
api-ms-win-crt-runtime-l1-1-0.dll	`_set_app_type` `__p___argc` `__p___argv` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_fpreset` `_initialize_narrow_environment` `_initterm` `_initterm_e` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `fflush` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`memset` `strlen` `strncmp` `wcslen`
ntdll.dll (#2)	`NtOpenFile` `NtReadFile` `NtWriteFile` `RtlNtStatusToDosError`

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData	`0x140bf1000`
EndAddressOfRawData	`0x140bf1050`
AddressOfIndex	`0x140bee12c`
AddressOfCallbacks	`0x140be8b80`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000140033DE0` `0x0000000140033DC0`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.