| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-May-31 18:28:59 |
| Detected languages |
English - United States
|
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: TECHNOLOGIAE MILL
Issuer: GlobalSign GCC R45 CodeSigning CA 2020 |
| Safe | VirusTotal score: 0/72 (Scanned on 2024-11-20 14:15:18) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2024-May-31 18:28:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x64a00 |
| SizeOfInitializedData | 0x86000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000050F5C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xee000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xf2add |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| libcrypto-3-x64.dll |
HMAC_Init_ex
HMAC_Update HMAC_Final OBJ_NAME_add OBJ_NAME_remove EVP_MD_meth_new EVP_MD_meth_free EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size EVP_MD_meth_set_app_datasize EVP_MD_meth_set_flags EVP_MD_meth_set_init EVP_MD_meth_set_update EVP_MD_meth_set_final EVP_MD_meth_set_copy EVP_MD_meth_set_cleanup EVP_MD_meth_set_ctrl EVP_MD_get0_name EVP_MD_is_a EVP_CIPHER_fetch EVP_CIPHER_free CMAC_CTX_new CMAC_CTX_free CMAC_CTX_copy CMAC_Init CMAC_Update CMAC_Final CRYPTO_zalloc OSSL_PARAM_construct_size_t EVP_MD_get_block_size EVP_CIPHER_is_a EVP_CIPHER_get0_provider EVP_CIPHER_get_key_length EVP_CIPHER_CTX_get_block_size EVP_CIPHER_CTX_copy EVP_Cipher EVP_EncryptInit_ex EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_key_length EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_params BN_is_zero BN_CTX_new BN_CTX_secure_new BN_CTX_free BN_CTX_start BN_CTX_get BN_CTX_end BN_rand_range BN_new BN_secure_new BN_lebin2bn BN_sub BN_is_negative BN_div BN_nnmod BN_mod_add BN_mod_mul BN_set_word BN_cmp BN_free BN_dup BN_ucmp BN_hex2bn BN_mod_inverse EC_GROUP_free EC_GROUP_set_generator EC_GROUP_get_order EC_GROUP_set_curve_name EC_GROUP_get_curve_name EC_GROUP_new_curve_GFp EC_POINT_new EC_POINT_free EC_POINT_set_affine_coordinates EC_POINT_get_affine_coordinates EC_POINT_mul EC_KEY_get0_group EC_KEY_set_group EC_KEY_get0_private_key EC_KEY_set_private_key EC_KEY_get0_public_key EC_KEY_set_public_key ECDSA_SIG_new ECDSA_SIG_free ECDSA_SIG_get0 ECDSA_SIG_set0 CRYPTO_strdup CRYPTO_secure_malloc CRYPTO_secure_free BIO_indent BIO_printf BN_num_bits BN_bin2bn BN_bn2bin BN_print d2i_ASN1_OBJECT i2d_ASN1_OBJECT ASN1_STRING_new ASN1_STRING_free ASN1_STRING_set ASN1_STRING_length HMAC_CTX_reset ASN1_BIT_STRING_free ASN1_INTEGER_free d2i_ASN1_INTEGER ASN1_OCTET_STRING_free d2i_ASN1_OCTET_STRING i2d_ASN1_OCTET_STRING ASN1_INTEGER_to_BN EC_POINT_cmp EC_KEY_new EC_KEY_free OBJ_nid2ln EVP_DecryptInit_ex EVP_PKEY_get_id EVP_PKEY_get_base_id EVP_PKEY_set_type EVP_PKEY_assign EVP_PKEY_get0 EVP_PKEY_new EVP_PKEY_free EVP_PKEY_missing_parameters EVP_PKEY_asn1_new EVP_PKEY_asn1_set_public EVP_PKEY_asn1_set_private EVP_PKEY_asn1_set_param EVP_PKEY_asn1_set_free EVP_PKEY_asn1_set_ctrl EVP_PKEY_asn1_set_security_bits EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_get_data EVP_PKEY_derive_set_peer EVP_PKEY_derive BUF_reverse PKCS7_SIGNER_INFO_get0_algs PKCS7_RECIP_INFO_get0_alg X509_ALGOR_set0 X509_ALGOR_get0 X509_PUBKEY_new X509_PUBKEY_free PKCS8_pkey_set0 PKCS8_pkey_get0 X509_PUBKEY_set0_param X509_PUBKEY_get0_param CMS_RecipientInfo_type CMS_RecipientInfo_get0_pkey_ctx CMS_RecipientInfo_ktri_get0_algs CMS_SignerInfo_get0_algs CMS_RecipientInfo_kari_get0_alg CMS_RecipientInfo_kari_get0_orig_id CMS_RecipientInfo_kari_get0_ctx OPENSSL_hexstr2buf OBJ_txt2obj EVP_MD_meth_get_ctrl EVP_MD_get_type EVP_DigestFinal_ex EVP_PKEY_meth_new EVP_PKEY_CTX_set_data EVP_PKEY_CTX_get0_pkey EVP_PKEY_meth_set_init EVP_PKEY_meth_set_copy EVP_PKEY_meth_set_cleanup EVP_PKEY_meth_set_paramgen EVP_PKEY_meth_set_keygen EVP_PKEY_meth_set_sign EVP_PKEY_meth_set_verify EVP_PKEY_meth_set_signctx EVP_PKEY_meth_set_encrypt EVP_PKEY_meth_set_decrypt EVP_PKEY_meth_set_derive EVP_PKEY_meth_set_ctrl EVP_PKEY_meth_set_check EVP_PKEY_meth_set_public_check EC_KEY_check_key X509_PUBKEY_it ASN1_OBJECT_it ASN1_OCTET_STRING_it ASN1_item_new ASN1_item_free ASN1_item_d2i ASN1_item_i2d EVP_DigestSignInit EVP_DigestSignFinal EVP_PKEY_new_mac_key X509at_add1_attr_by_OBJ X509at_get0_data_by_OBJ RAND_bytes BN_bn2lebinpad EC_POINT_set_to_infinity EVP_MD_get_size EVP_MD_CTX_reset EVP_PKEY_copy_parameters EVP_PKEY_get_default_digest_nid EVP_PKEY_CTX_get0_peerkey EC_GROUP_get0_order EC_GROUP_get0_field X509_PUBKEY_set X509_PUBKEY_get ERR_new ERR_set_debug ERR_set_error ERR_load_strings ERR_unload_strings ERR_get_next_error_library HMAC_CTX_free HMAC_CTX_new EVP_get_digestbyname EVP_get_cipherbyname EVP_CIPHER_CTX_free EVP_CIPHER_CTX_new EVP_CipherFinal_ex EVP_CipherUpdate EVP_CipherInit_ex EVP_CIPHER_CTX_set_flags EVP_DigestFinalXOF EVP_DigestUpdate EVP_DigestInit_ex OBJ_nid2sn CRYPTO_memcmp RAND_priv_bytes EVP_DigestSignUpdate EVP_MD_CTX_copy EVP_MD_CTX_set_flags EVP_MD_CTX_free EVP_MD_CTX_new EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_set_num EVP_CIPHER_CTX_get_num EVP_CIPHER_CTX_buf_noconst EVP_CIPHER_CTX_iv_noconst EVP_CIPHER_CTX_original_iv EVP_CIPHER_CTX_iv EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_get_iv_length EVP_CIPHER_CTX_get_key_length EVP_CIPHER_CTX_get_nid EVP_CIPHER_CTX_is_encrypting EVP_CIPHER_CTX_get0_cipher EVP_CIPHER_get_mode EVP_CIPHER_get_iv_length EVP_MD_CTX_get0_md_data EVP_MD_CTX_md EVP_CIPHER_meth_set_ctrl EVP_CIPHER_meth_set_get_asn1_params EVP_CIPHER_meth_set_set_asn1_params EVP_CIPHER_meth_set_cleanup EVP_CIPHER_meth_set_do_cipher EVP_CIPHER_meth_set_init EVP_CIPHER_meth_set_impl_ctx_size EVP_CIPHER_meth_set_flags EVP_CIPHER_meth_set_iv_length EVP_CIPHER_meth_free EVP_CIPHER_meth_new EVP_MD_meth_get_init OBJ_txt2nid OBJ_obj2nid OBJ_nid2obj ASN1_OCTET_STRING_set ASN1_OCTET_STRING_new ASN1_TYPE_set ASN1_TYPE_get ERR_add_error_data OPENSSL_die OPENSSL_cleanse CRYPTO_malloc ENGINE_get_static_state ENGINE_set_cmd_defns ENGINE_set_pkey_asn1_meths ENGINE_set_pkey_meths ENGINE_set_digests ENGINE_set_ciphers ENGINE_set_ctrl_function ENGINE_set_finish_function ENGINE_set_init_function ENGINE_set_destroy_function ENGINE_set_name ENGINE_set_id ENGINE_register_all_complete ENGINE_register_pkey_meths ENGINE_register_digests ENGINE_register_ciphers EVP_add_digest EVP_add_cipher OBJ_add_object OBJ_new_nid ASN1_OBJECT_create ASN1_OBJECT_free OPENSSL_init_crypto CRYPTO_free ASN1_STRING_get0_data CRYPTO_set_mem_functions |
|---|---|
| KERNEL32.dll |
WriteConsoleW
CreateFileW CloseHandle HeapReAlloc HeapSize GetStringTypeW SetFilePointerEx GetFileSizeEx SetStdHandle GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetStdHandle LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError InterlockedFlushSList RtlUnwindEx TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter |
| Ordinal | 1 |
|---|---|
| Address | 0x1010 |
| Ordinal | 2 |
|---|---|
| Address | 0x1960 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-May-31 18:28:59 |
| Version | 0.0 |
| SizeofData | 776 |
| AddressOfRawData | 0xdedec |
| PointerToRawData | 0xddbec |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1800e6d40 |
| XOR Key | 0x1e8353af |
|---|---|
| Unmarked objects | 0 |
| ASM objects (28900) | 6 |
| C++ objects (28900) | 136 |
| C objects (28900) | 10 |
| ASM objects (33731) | 9 |
| C objects (33731) | 14 |
| C++ objects (33731) | 33 |
| Imports (28900) | 2 |
| Imports (33811) | 3 |
| Total imports | 381 |
| C objects (33811) | 33 |
| Exports (33811) | 1 |
| Resource objects (33811) | 1 |
| Linker (33811) | 1 |
No comments yet.