f2fb02cdfb23930b5010730a581ef20c3576186e37fb7f7528ee9447ceb0ec87

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Oct-29 00:22:55
Detected languages English - United States

Plugin Output

Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • CreateRemoteThread
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Memory manipulation functions often used by packers:
  • VirtualAllocEx
  • VirtualProtect
 Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • Process32FirstW
  • Process32NextW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 3af8028564c7da0373bff3d69adcc0dc 🔍
SHA1 d95e125eb9e6a61a8dde4d045e7417eeb6bb78ef 🔍
SHA256 f2fb02cdfb23930b5010730a581ef20c3576186e37fb7f7528ee9447ceb0ec87 🔍
SHA3 46cdf46da1b55cefefdd4d42c23e72e10b76f2ce6cd6a2d8cbca85da1000f1d9 🔍
SSDeep 3072:gD29LnOc5omJtxNbIviVpjNWEZTwZdA+7BVloIpPzsWkEQEDsNVf3rM:gD29LnO6NjE4pjzwZd/BJIWkJf 🔍
Imports Hash b0bfd0567fa6dec088ccfa65a7bb7294 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Oct-29 00:22:55
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x22c00
SizeOfInitializedData 0x13c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000059B0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f3dab73956d5aa95e8ec87b8c2fc206a 🔍
SHA1 881fe95cf15818bdb6d988df52aefa5ec32d4bf9 🔍
SHA256 63da03b2f09b1cfb46a14be8f80a6f093bc9808f97f51f3abc312a83abdc4185 🔍
SHA3 993ebdd2e0cce1ca8fd1033714ba9af4fa884189db6eaeae60e8c07d48fe5a59 🔍
VirtualSize 0x22b90
VirtualAddress 0x1000
SizeOfRawData 0x22c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51701

.rdata

MD5 0d26774f2a75abf45dd1da4771a8d3c7 🔍
SHA1 6fb141bc4fd39dcd6f8adbd58cbd3f86ba759fd8 🔍
SHA256 01b9c4addd31c35487e835a46fcf0467215a132d7379f1e02e3953085bd9b353 🔍
SHA3 c9388b0a574a1cccc29354295e565fb32d39002f7910e34a0dc388cba2d5d0c7 🔍
VirtualSize 0xf638
VirtualAddress 0x24000
SizeOfRawData 0xf800
PointerToRawData 0x23000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.28224

.data

MD5 d2522636ac824f6d3a129ecb771b8df1 🔍
SHA1 a11935cbcae20b9a369b9748588b623d48c610ad 🔍
SHA256 9b49d32716f67abdb10af77339901d05040ac656a942e8b962304de8fc78af91 🔍
SHA3 fd6021a891a402c34fe4971c31eacfaeb6ce926dce2c0f0c60cd48fc918478a8 🔍
VirtualSize 0x1968
VirtualAddress 0x34000
SizeOfRawData 0xc00
PointerToRawData 0x32800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.23501

.pdata

MD5 b2b7c4a6bda68a628fdb80700d8395b8 🔍
SHA1 3443f89ad68bb93b57fce7d56e4ff9cc8c6eb690 🔍
SHA256 c9078782043c9134984079bf943dc0b7c602cd263bff9481a5b78ff29a097c8d 🔍
SHA3 bd2ca65a6d303a14b10cf1cbab8bcda0c34c45f82766f0a3e5569926f4ba133e 🔍
VirtualSize 0x1ce0
VirtualAddress 0x36000
SizeOfRawData 0x1e00
PointerToRawData 0x33400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.24889

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x38000
SizeOfRawData 0x200
PointerToRawData 0x35200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 efb0230f3130363de39a3155de141819 🔍
SHA1 bc58b48dc9934d16942743ff0d0cc9e2f695773a 🔍
SHA256 efa68b68e8c771dcf53f271000ab69e9bcd08062b757f2fe270ab8d70640f8fb 🔍
SHA3 ce9181d9782869cffdfe5bab4954f24a3ea7b374b0643c14d8ca635f414d0050 🔍
VirtualSize 0x1e0
VirtualAddress 0x39000
SizeOfRawData 0x200
PointerToRawData 0x35400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71768

.reloc

MD5 d8ead2d1e745e6b96f91af6a1a7457ec 🔍
SHA1 735a54f3f1705deedae03dacb587ce089833fd19 🔍
SHA256 96fd4655db3181542bdfd5fa4ee938d11c04a2d3921494766bb8341f8dd8b9ae 🔍
SHA3 b7ff91d4d84e547df5abaf3d935543785203695d2f21be472c4b17f51036cfa0 🔍
VirtualSize 0x6d4
VirtualAddress 0x3a000
SizeOfRawData 0x800
PointerToRawData 0x35600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.07404

Imports

KERNEL32.dll Sleep
GetTickCount
WideCharToMultiByte
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileAttributesW
WriteFile
GetTempPathW
CloseHandle
GetLastError
WaitForSingleObject
GetCurrentProcessId
CreateRemoteThread
GetExitCodeThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
CopyFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetStdHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
LocalFree
FormatMessageW
GetConsoleMode
SetConsoleMode
SetConsoleTitleW
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
RtlUnwind
USER32.dll GetWindowTextLengthW
GetWindowTextW
IsWindowVisible
EnumWindows
GetWindowThreadProcessId

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-29 00:22:55
Version 0.0
SizeofData 840
AddressOfRawData 0x304e8
PointerToRawData 0x2f4e8

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140034040

RICH Header

XOR Key 0xa3464a18
Unmarked objects 0
C++ objects (33145) 151
C objects (33145) 13
ASM objects (33145) 8
ASM objects (35721) 10
C objects (35721) 18
C++ objects (35721) 44
Imports (33145) 5
Total imports 121
C++ objects (36260) 4
Resource objects (36260) 1
151 1
Linker (36260) 1

Errors

Leave a comment

No comments yet.