00eea85752664955047caad7d6280bc7bf1ab91c61eb9a2542c26b747a12e963

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2055-Feb-23 17:36:32
TLS Callbacks 2 callback(s) detected.

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • octave.info
Suspicious The PE is possibly packed. Unusual section name found: .xdata
Safe VirusTotal score: 0/70 (Scanned on 2026-03-07 05:50:47) All the AVs think this file is safe.

Hashes

MD5 79cd4997890e99e4c6bb9d5c2d29dac6
SHA1 6296fd1b6176d1a3b90a3879ceeba6dc67e240ac
SHA256 00eea85752664955047caad7d6280bc7bf1ab91c61eb9a2542c26b747a12e963
SHA3 6ce53f08f735807e757897ac2d11decf06a6df6221cbb60304db37ad005af859
SSDeep 384:Bl15TmaJvY3Ov+bdU5LO5Kavdqr9r0TI1rw3IpFB6DIuV31oHYbLqhqy5/weuPJ:T15m2Y3o+b65lV0EqU6suuoewsFuP
Imports Hash 2bba399021aee0fd9ecdc6662094e4f7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 11
TimeDateStamp 2055-Feb-23 17:36:32
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x4c00
SizeOfInitializedData 0x9200
SizeOfUninitializedData 0xc00
AddressOfEntryPoint 0x0000000000001500 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x11000
SizeOfHeaders 0x400
Checksum 0x1347a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d4f279e84cf5f078efb0e75de87bc432
SHA1 489287e5d1f3b90a4068df4863a4d08fafc86632
SHA256 aa7f07d60c67f265f1e0e537626d704de34e4b07d9707c53fb4709c38eaaf1f7
SHA3 9b8174935563dd57fa3f0f64701ec98cf529cb693b7d4e296813abbf9ca60f95
VirtualSize 0x4ab8
VirtualAddress 0x1000
SizeOfRawData 0x4c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.95961

.data

MD5 188d36306d699d3a0d46b449e471bdd0
SHA1 1338a6bce3167a7b842c178f17e0534e00a68d91
SHA256 23ee7348db358582689b8824b08595d984f7b4154b8c2664895d0dc64bf8f816
SHA3 77f7be09dd2c3a7b6d9e7835081014e7ccaf68a1d01b56a4463424ff10d1a41f
VirtualSize 0xa0
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.69358

.rdata

MD5 f429c0769ea2a1072e6ebb2ed503a2c6
SHA1 921e9f1839a7e3322dd4dc17241c96b30ab4a0ae
SHA256 20479b621822a224d2186635f74abda0915f9db3c609fa1f1bd7cbd1bdf9792d
SHA3 68a6ed7c11140f64d31e3afd63bf1a94238e845674a63fc6af10a16d261784a3
VirtualSize 0x1b04
VirtualAddress 0x7000
SizeOfRawData 0x1c00
PointerToRawData 0x5200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.99632

.pdata

MD5 ead440692af4fac2e2b0b2873f799ab6
SHA1 076934e738ec2544c6be967b046a72bfbaa72468
SHA256 27f3ea7bdf472f6741df815f3074d62578755cfe7f0dc599d30f2047d286bf9e
SHA3 d681623ab279d3002d5edb049e53ff6e66d3a31f0bd21ae3fdd1a1c29395bbb9
VirtualSize 0x300
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.23952

.xdata

MD5 d9d7daafea835a77fe3672cfeccc0bdd
SHA1 87a0e513a3c17ed0e813f8c59bd7b9af16bf0f83
SHA256 158d50faf8eb3de530e9c2c87fd9fcb9839a88ecac41935692c3dfc17d446810
SHA3 1394bde2167f2a3b0e34842213e96c3d8af42429f89a7d8f4967adbf60d586e5
VirtualSize 0x758
VirtualAddress 0xa000
SizeOfRawData 0x800
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.19819

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xad0
VirtualAddress 0xb000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata

MD5 d74bba207273a42a59d5d4a2e581dd16
SHA1 7fab37b377cb6057d051ca73bbf449aa474f2ec1
SHA256 fe39b2856e14c971da51350485c0dcba576ae9bcc5243ed1b8b09c6ff14eec5c
SHA3 695abff6b31a1bf4fa19bc199b8e6336ab39439b9607e979830e1e9617bc29f1
VirtualSize 0x4e6
VirtualAddress 0xc000
SizeOfRawData 0x600
PointerToRawData 0x7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.50572

.idata

MD5 8c3ea704e1603841211ef64ed0a5f9d7
SHA1 a63f1f08a64f536af3cd9228c7c71c7f5a23c9d1
SHA256 95e5d49c98592ac7f271c9177c21e517097d13bacc6045df209f383320a33b2a
SHA3 ea05e0ee5017ab008a6db1211028a9afe3b01e1315c9aab56ea19a2a711f4167
VirtualSize 0xf78
VirtualAddress 0xd000
SizeOfRawData 0x1000
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.44724

.CRT

MD5 82eca58cc92e2bc1ea32b1f4b1325d4c
SHA1 2deb60186226b7a4f5123bcbeef73d45e6750b26
SHA256 f8f22675f9a7481b33b98efab7882b94bac401991582a656be3a09ff108ac53d
SHA3 d0832f763f7f0e98d778f3c0928807bdcf51bc9be793e8b34b71a23a036d4ac8
VirtualSize 0x68
VirtualAddress 0xe000
SizeOfRawData 0x200
PointerToRawData 0x9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.270919

.tls

MD5 a9b84d46b6cf139ef26f775a78b475ad
SHA1 5932b39728d9cf87ea6463c28b1ec8076529ca69
SHA256 bb804ea5e9504558193621ad2bfab7b01bc6840556c9f62b52342e74329e4025
SHA3 5a078a3b0a6d4f8e9374a59490c7a8c728ed7aa1b1654de16443d261696ab6c6
VirtualSize 0x68
VirtualAddress 0xf000
SizeOfRawData 0x200
PointerToRawData 0x9200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.197438

.reloc

MD5 26eb1111a21ce3ea36cb24142951b0d4
SHA1 34ac5825b2b186714b91bb4dc698da6587304ad3
SHA256 02d121881abb034c3ad46cadc310795a7fe4ebf39a1b303b5f1455401352274d
SHA3 de1a8566d05a7f7b9988c34f7a8a374830040d6d5f6b4b4b9fc04309df65965d
VirtualSize 0x90
VirtualAddress 0x10000
SizeOfRawData 0x200
PointerToRawData 0x9400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.61995

Imports

libgcc_s_seh-1.dll _Unwind_Resume
libstdc++-6.dll _ZNKSs5rfindEPKcy
_ZNKSs6substrEyy
_ZNKSs7compareEPKc
_ZNKSt5ctypeIcE13_M_widen_initEv
_ZNSo3putEc
_ZNSo5flushEv
_ZNSs12_M_leak_hardEv
_ZNSs12_S_constructEycRKSaIcE
_ZNSs3endEv
_ZNSs4_Rep10_M_destroyERKSaIcE
_ZNSs4_Rep10_M_disposeERKSaIcE
_ZNSs4swapERSs
_ZNSs6assignEPKc
_ZNSs6assignEPKcy
_ZNSs6assignERKSs
_ZNSs7replaceEyyPKcy
_ZNSsC1EPKcRKSaIcE
_ZNSsC1ERKSs
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_x
_ZSt16__throw_bad_castv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt4cerr
_ZSt4cout
_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZdlPv
_Znwy
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_seh0
KERNEL32.dll DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
__C_specific_handler
msvcrt.dll __dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
free
fwrite
getenv
malloc
memcmp
memcpy
signal
strlen
strncmp
vfprintf

Delayed Imports

_ZNKSt5ctypeIcE8do_widenEc

Ordinal 1
Address 0x4590

_ZNSt3mapISsSsSt4lessISsESaISt4pairIKSsSsEEEixEOSs

Ordinal 2
Address 0x45a0

_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE14_M_insert_nodeEPSt18_Rb_tree_node_baseSA_PSt13_Rb_tree_nodeIS2_E

Ordinal 3
Address 0x46b0

_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE22_M_emplace_hint_uniqueIIRKSt21piecewise_construct_tSt5tupleIIOSsEESD_IIEEEEESt17_Rb_tree_iteratorIS2_ESt23_Rb_tree_const_iteratorIS2_EDpOT_

Ordinal 4
Address 0x4750

_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE22_M_emplace_hint_uniqueIIRKSt21piecewise_construct_tSt5tupleIIRS1_EESD_IIEEEEESt17_Rb_tree_iteratorIS2_ESt23_Rb_tree_const_iteratorIS2_EDpOT_

Ordinal 5
Address 0x48c0

_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE24_M_get_insert_unique_posERS1_

Ordinal 6
Address 0x4a20

_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE29_M_get_insert_hint_unique_posESt23_Rb_tree_const_iteratorIS2_ERS1_

Ordinal 7
Address 0x4b80

_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE8_M_eraseEPSt13_Rb_tree_nodeIS2_E

Ordinal 8
Address 0x4db0

_ZSteqIcEN9__gnu_cxx11__enable_ifIXsrSt9__is_charIT_E7__valueEbE6__typeERKSbIS3_St11char_traitsIS3_ESaIS3_EESC_

Ordinal 9
Address 0x4e90

main

Ordinal 10
Address 0x4ec0

Version Info

TLS Callbacks

StartAddressOfRawData 0x40f000
EndAddressOfRawData 0x40f060
AddressOfIndex 0x40b6dc
AddressOfCallbacks 0x40e040
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x0000000000403250
0x0000000000403220

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.