Manalyze report for f757ada777f1ae8bc99df9a188b20784749a3d94b0f0b03d1024f19be32dfed3

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-15 19:45:25
Detected languages	English - United States
Debug artifacts	C:\Users\Jeremy\projects\vdma work\zephyr-glide\bin\zephyr-glide.pdb

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: example.com https://curl.se https://paradiseauth.com paradiseauth.com`
Info	Libraries used to perform cryptographic operations:	`Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExW GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot CheckRemoteDebuggerPresent` `Can access the registry: RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW RegGetValueA` `Uses Microsoft's cryptographic API: CryptDestroyKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptEncrypt CryptImportKey CryptStringToBinaryA CryptDecodeObjectEx CryptQueryObject` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Functions related to the privilege level: CheckTokenMembership` `Interacts with services: OpenServiceW QueryServiceStatusEx ControlService OpenSCManagerW` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: Process32NextW Process32FirstW` `Interacts with the certificate store: CertOpenStore CertAddCertificateContextToStore`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`d5b37edbf2f4b523689e94eaf78e1aa2` 🔍
SHA1	`59743f96de7a64f2d9d2da9edcf179b7fb302cca` 🔍
SHA256	`f757ada777f1ae8bc99df9a188b20784749a3d94b0f0b03d1024f19be32dfed3` 🔍
SHA3	`2943c724f03695c7b9ce71abf5d2ae494d004629248670c929c900a60949780c` 🔍
SSDeep	`24576:UwhaFHabGojYJFoSHO4pWmyl+hlFd/AZKh3qLYB9pItQImDyneBND:UMaF6bfjY4VEW9l+hlFd/AZKh3Hsbo` 🔍
Imports Hash	`c109693a26b39b922bd840e90f5f1df5` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x118`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Oct-15 19:45:25
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0xc2a00`
SizeOfInitializedData	`0x42e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000000000008FB04 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x10a000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`565829260d95f428ed97699f51c5380a 🔍`
SHA1	`4c8e82a985f3561423febb14893c72cff6f61af9 🔍`
SHA256	`f39f20620b8ed42752b67cbcc9a3a7a2be4d1b61308609320af5ec77e7aa111e 🔍`
SHA3	`bd8406374c0da1b808958ad6051e168c730d9df11cc7948c562a9aea7424adc9 🔍`
VirtualSize	`0xc2964`
VirtualAddress	`0x1000`
SizeOfRawData	`0xc2a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.42544`

.rdata

MD5	`eeaf7c7880364b9b4bbb982ec921f17e 🔍`
SHA1	`4d59d1dd75ee90e9ed59fa9bd65a41f6ecfece10 🔍`
SHA256	`cb5478a80c050924c12794536d552dc925de8bee0edffe9b0bee9b53a3e8ea44 🔍`
SHA3	`d8e180dca1a727dc4159f1fccfd7043152c840e15b0645e508c0b946248d2d16 🔍`
VirtualSize	`0x33904`
VirtualAddress	`0xc4000`
SizeOfRawData	`0x33a00`
PointerToRawData	`0xc2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.57766`

.data

MD5	`eabdc51df36c960283b1119b45b4ea38 🔍`
SHA1	`0a3f90122aa97bef0dd5697e5f8eecfc794fabcc 🔍`
SHA256	`9bd944c283f9b3f64b632144643b640e80ea420c82f6e986cb5402e9e761c523 🔍`
SHA3	`7586fdba676243a517ec270258d19fa86ba89a8f00d73316eda694aa6b8b9476 🔍`
VirtualSize	`0x3e34`
VirtualAddress	`0xf8000`
SizeOfRawData	`0x2200`
PointerToRawData	`0xf6800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.18158`

.pdata

MD5	`bd16fd01392c3412b239d3531ecc8b52 🔍`
SHA1	`12798f71e27fb2a16ca93cf21dea55295f416490 🔍`
SHA256	`e7d2ada6e9165102e755f6751e997279e7e55f4d0b89c83ce77c857a92da2ec8 🔍`
SHA3	`8745f7ce5ee78ef5f19684eea4d90638b9b510ccba181b1232f8849e0cf630fd 🔍`
VirtualSize	`0x9abc`
VirtualAddress	`0xfc000`
SizeOfRawData	`0x9c00`
PointerToRawData	`0xf8a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.01062`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x106000`
SizeOfRawData	`0x200`
PointerToRawData	`0x102600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`636b0bb0ee4488001c8668aede8484ae 🔍`
SHA1	`aa6717ff4aa3db0f9c0ac8b9c95ac929611550f4 🔍`
SHA256	`77553d5ab87c539b3646b0cd05f3f53ada942827004fe8edb5b6924f4a79e369 🔍`
SHA3	`79156da26c67ca4c80323fec3a45fd66ec6626d5390e0158e20e7c2e4e150df2 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0x107000`
SizeOfRawData	`0x200`
PointerToRawData	`0x102800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.71768`

.reloc

MD5	`df7b6feeee7f60c73ffba37846918f8f 🔍`
SHA1	`92e8763afdc28fa0aa4543ca7a7dd425227042d3 🔍`
SHA256	`b3052180a3ef1ff23b6330fa433fa36877362f80fbdb16688f395c032dca7e9f 🔍`
SHA3	`ae049274f947203c1ef986c9ead551b0522cc908e8d5998fcbbee4dc71bbd79f 🔍`
VirtualSize	`0x12e0`
VirtualAddress	`0x108000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x102a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.27879`

Imports

WS2_32.dll	`htons` `htonl` `connect` `socket` `WSAStartup` `select` `closesocket` `setsockopt` `ioctlsocket` `sendto` `recv` `recvfrom` `gethostname` `freeaddrinfo` `getaddrinfo` `__WSAFDIsSet` `WSAIoctl` `getpeername` `WSASetLastError` `WSAGetLastError` `WSAWaitForMultipleEvents` `WSAResetEvent` `WSAEventSelect` `WSAEnumNetworkEvents` `WSACreateEvent` `WSACloseEvent` `getsockopt` `WSACleanup` `accept` `bind` `listen` `getsockname` `send` `ntohs`
ADVAPI32.dll	`CryptDestroyKey` `CheckTokenMembership` `OpenServiceW` `QueryServiceStatusEx` `RegCloseKey` `RegOpenKeyExW` `RegQueryValueExW` `FreeSid` `RegSetValueExW` `ControlService` `AllocateAndInitializeSid` `OpenSCManagerW` `CloseServiceHandle` `RegGetValueA` `CryptAcquireContextA` `CryptReleaseContext` `CryptGetHashParam` `CryptCreateHash` `CryptHashData` `CryptDestroyHash` `CryptEncrypt` `CryptImportKey` `StartServiceW`
bcrypt.dll	`BCryptGetProperty` `BCryptOpenAlgorithmProvider` `BCryptCloseAlgorithmProvider` `BCryptDestroyHash` `BCryptHashData` `BCryptCreateHash` `BCryptGenRandom` `BCryptFinishHash`
WLDAP32.dll	`#217` `#46` `#211` `#301` `#200` `#30` `#79` `#35` `#33` `#32` `#27` `#26` `#22` `#41` `#50` `#45` `#60` `#143`
CRYPT32.dll	`CertOpenStore` `CertCloseStore` `CertEnumCertificatesInStore` `CertFindCertificateInStore` `CertFreeCertificateContext` `CryptStringToBinaryA` `PFXImportCertStore` `CryptDecodeObjectEx` `CertAddCertificateContextToStore` `CertFindExtension` `CertGetNameStringA` `CryptQueryObject` `CertCreateCertificateChainEngine` `CertFreeCertificateChainEngine` `CertGetCertificateChain` `CertFreeCertificateChain`
Normaliz.dll	`IdnToUnicode` `IdnToAscii`
wer.dll	`WerAddExcludedApplication`
IPHLPAPI.DLL	`GetAdaptersAddresses`
KERNEL32.dll	`FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `VirtualProtect` `GetDateFormatW` `GetTimeFormatW` `CompareStringW` `LCMapStringW` `GetLocaleInfoW` `IsValidLocale` `GetUserDefaultLCID` `EnumSystemLocalesW` `GetTimeZoneInformation` `HeapReAlloc` `SetStdHandle` `HeapAlloc` `HeapFree` `FlushFileBuffers` `GetConsoleOutputCP` `ReadConsoleW` `GetConsoleMode` `GetCommandLineW` `GetCommandLineA` `WriteFile` `SetFilePointerEx` `FileTimeToSystemTime` `SystemTimeToTzSpecificLocalTime` `GetFileInformationByHandle` `GetDriveTypeW` `GetModuleHandleExW` `FreeLibraryAndExitThread` `ExitThread` `LoadLibraryExW` `TlsFree` `TlsSetValue` `TlsGetValue` `TlsAlloc` `InitializeCriticalSectionAndSpinCount` `RaiseException` `RtlPcToFileHeader` `SetEndOfFile` `GetCurrentDirectoryW` `GetFullPathNameW` `FindClose` `FindFirstFileExW` `FindNextFileW` `IsValidCodePage` `GetACP` `GetOEMCP` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `GetProcessHeap` `DeleteFileW` `HeapSize` `RtlUnwindEx` `InitializeSListHead` `GetStartupInfoW` `IsProcessorFeaturePresent` `TerminateProcess` `WriteConsoleW` `IsDebuggerPresent` `SetConsoleCtrlHandler` `SetConsoleTitleA` `GetModuleFileNameW` `WaitForSingleObject` `CreateEventW` `Sleep` `SetEvent` `CloseHandle` `FreeConsole` `ExitProcess` `GetConsoleWindow` `SetDefaultDllDirectories` `GetCurrentProcess` `K32GetModuleFileNameExW` `Thread32Next` `Thread32First` `GetEnvironmentVariableA` `LocalAlloc` `GetFileAttributesW` `GetCurrentThreadId` `DebugActiveProcessStop` `SuspendThread` `ResumeThread` `SetProcessMitigationPolicy` `CreateToolhelp32Snapshot` `Process32NextW` `QueryPerformanceFrequency` `Process32FirstW` `CreateThread` `GetThreadContext` `GetProcAddress` `LocalFree` `GetCurrentProcessId` `GetModuleHandleW` `SleepEx` `K32EnumProcessModules` `QueryPerformanceCounter` `SetDllDirectoryW` `OpenThread` `RtlUnwind` `CheckRemoteDebuggerPresent` `QueryDosDeviceW` `DeviceIoControl` `CreateFileW` `GetLastError` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `SetLastError` `FormatMessageW` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `GetSystemDirectoryA` `FreeLibrary` `GetModuleHandleA` `LoadLibraryA` `GetTickCount` `MultiByteToWideChar` `WideCharToMultiByte` `MoveFileExA` `WaitForSingleObjectEx` `GetStdHandle` `GetFileType` `ReadFile` `PeekNamedPipe` `WaitForMultipleObjects` `VerSetConditionMask` `VerifyVersionInfoW` `CreateFileA` `GetFileSizeEx` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `RtlCaptureContext` `GetCPInfo` `GetStringTypeW` `WakeAllConditionVariable` `TryAcquireSRWLockExclusive` `SleepConditionVariableSRW` `EncodePointer` `DecodePointer` `LCMapStringEx` `GetSystemTimeAsFileTime`
USER32.dll	`EnumWindows` `ShowWindow` `MessageBoxA` `EnumChildWindows` `IsWindowVisible` `GetWindowTextW` `GetClassNameW`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Oct-15 19:45:25
Version	`0.0`
SizeofData	`93`
AddressOfRawData	`0xe9a78`
PointerToRawData	`0xe8878`
Referenced File	C:\Users\Jeremy\projects\vdma work\zephyr-glide\bin\zephyr-glide.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Oct-15 19:45:25
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0xe9ad8`
PointerToRawData	`0xe88d8`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Oct-15 19:45:25
Version	`0.0`
SizeofData	`1052`
AddressOfRawData	`0xe9aec`
PointerToRawData	`0xe88ec`

TLS Callbacks

StartAddressOfRawData	`0x1400e9f50`
EndAddressOfRawData	`0x1400e9f58`
AddressOfIndex	`0x1400faf5c`
AddressOfCallbacks	`0x1400c49b8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1400f8a40`

RICH Header

XOR Key	`0x2002b95a`
Unmarked objects	`0`
C++ objects (33145)	`193`
C objects (33145)	`18`
ASM objects (33145)	`10`
253 (35207)	`7`
ASM objects (35207)	`10`
C objects (35207)	`19`
C++ objects (35207)	`92`
Total imports	`293`
Imports (33145)	`21`
C objects (35227)	`127`
C++ objects (LTCG) (35229)	`7`
Resource objects (35229)	`1`
Linker (35229)	`1`

Errors

Leave a comment

No comments yet.