| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
2055-Feb-23 17:36:32
|
| TLS Callbacks |
2 callback(s) detected.
|
| Info |
Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious |
The PE is possibly packed. |
Unusual section name found: .xdata
|
| Safe |
VirusTotal score: 0/70 (Scanned on 2026-03-07 05:50:47) |
All the AVs think this file is safe.
|
| MD5 |
79cd4997890e99e4c6bb9d5c2d29dac6
|
| SHA1 |
6296fd1b6176d1a3b90a3879ceeba6dc67e240ac
|
| SHA256 |
00eea85752664955047caad7d6280bc7bf1ab91c61eb9a2542c26b747a12e963
|
| SHA3 |
6ce53f08f735807e757897ac2d11decf06a6df6221cbb60304db37ad005af859
|
| SSDeep |
384:Bl15TmaJvY3Ov+bdU5LO5Kavdqr9r0TI1rw3IpFB6DIuV31oHYbLqhqy5/weuPJ:T15m2Y3o+b65lV0EqU6suuoewsFuP
|
| Imports Hash |
2bba399021aee0fd9ecdc6662094e4f7
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections |
11
|
| TimeDateStamp |
2055-Feb-23 17:36:32
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xf0
|
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic |
PE32+
|
| LinkerVersion |
2.0
|
| SizeOfCode |
0x4c00
|
| SizeOfInitializedData |
0x9200
|
| SizeOfUninitializedData |
0xc00
|
| AddressOfEntryPoint |
0x0000000000001500 (Section: .text)
|
| BaseOfCode |
0x1000
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
5.2
|
| Win32VersionValue |
0
|
| SizeOfImage |
0x11000
|
| SizeOfHeaders |
0x400
|
| Checksum |
0x1347a
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve |
0x200000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d4f279e84cf5f078efb0e75de87bc432
|
| SHA1 |
489287e5d1f3b90a4068df4863a4d08fafc86632
|
| SHA256 |
aa7f07d60c67f265f1e0e537626d704de34e4b07d9707c53fb4709c38eaaf1f7
|
| SHA3 |
9b8174935563dd57fa3f0f64701ec98cf529cb693b7d4e296813abbf9ca60f95
|
| VirtualSize |
0x4ab8
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0x4c00
|
| PointerToRawData |
0x400
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy |
5.95961
|
| MD5 |
188d36306d699d3a0d46b449e471bdd0
|
| SHA1 |
1338a6bce3167a7b842c178f17e0534e00a68d91
|
| SHA256 |
23ee7348db358582689b8824b08595d984f7b4154b8c2664895d0dc64bf8f816
|
| SHA3 |
77f7be09dd2c3a7b6d9e7835081014e7ccaf68a1d01b56a4463424ff10d1a41f
|
| VirtualSize |
0xa0
|
| VirtualAddress |
0x6000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x5000
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
0.69358
|
| MD5 |
f429c0769ea2a1072e6ebb2ed503a2c6
|
| SHA1 |
921e9f1839a7e3322dd4dc17241c96b30ab4a0ae
|
| SHA256 |
20479b621822a224d2186635f74abda0915f9db3c609fa1f1bd7cbd1bdf9792d
|
| SHA3 |
68a6ed7c11140f64d31e3afd63bf1a94238e845674a63fc6af10a16d261784a3
|
| VirtualSize |
0x1b04
|
| VirtualAddress |
0x7000
|
| SizeOfRawData |
0x1c00
|
| PointerToRawData |
0x5200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy |
4.99632
|
| MD5 |
ead440692af4fac2e2b0b2873f799ab6
|
| SHA1 |
076934e738ec2544c6be967b046a72bfbaa72468
|
| SHA256 |
27f3ea7bdf472f6741df815f3074d62578755cfe7f0dc599d30f2047d286bf9e
|
| SHA3 |
d681623ab279d3002d5edb049e53ff6e66d3a31f0bd21ae3fdd1a1c29395bbb9
|
| VirtualSize |
0x300
|
| VirtualAddress |
0x9000
|
| SizeOfRawData |
0x400
|
| PointerToRawData |
0x6e00
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy |
3.23952
|
| MD5 |
d9d7daafea835a77fe3672cfeccc0bdd
|
| SHA1 |
87a0e513a3c17ed0e813f8c59bd7b9af16bf0f83
|
| SHA256 |
158d50faf8eb3de530e9c2c87fd9fcb9839a88ecac41935692c3dfc17d446810
|
| SHA3 |
1394bde2167f2a3b0e34842213e96c3d8af42429f89a7d8f4967adbf60d586e5
|
| VirtualSize |
0x758
|
| VirtualAddress |
0xa000
|
| SizeOfRawData |
0x800
|
| PointerToRawData |
0x7200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy |
5.19819
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
| VirtualSize |
0xad0
|
| VirtualAddress |
0xb000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
d74bba207273a42a59d5d4a2e581dd16
|
| SHA1 |
7fab37b377cb6057d051ca73bbf449aa474f2ec1
|
| SHA256 |
fe39b2856e14c971da51350485c0dcba576ae9bcc5243ed1b8b09c6ff14eec5c
|
| SHA3 |
695abff6b31a1bf4fa19bc199b8e6336ab39439b9607e979830e1e9617bc29f1
|
| VirtualSize |
0x4e6
|
| VirtualAddress |
0xc000
|
| SizeOfRawData |
0x600
|
| PointerToRawData |
0x7a00
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy |
4.50572
|
| MD5 |
8c3ea704e1603841211ef64ed0a5f9d7
|
| SHA1 |
a63f1f08a64f536af3cd9228c7c71c7f5a23c9d1
|
| SHA256 |
95e5d49c98592ac7f271c9177c21e517097d13bacc6045df209f383320a33b2a
|
| SHA3 |
ea05e0ee5017ab008a6db1211028a9afe3b01e1315c9aab56ea19a2a711f4167
|
| VirtualSize |
0xf78
|
| VirtualAddress |
0xd000
|
| SizeOfRawData |
0x1000
|
| PointerToRawData |
0x8000
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
4.44724
|
| MD5 |
82eca58cc92e2bc1ea32b1f4b1325d4c
|
| SHA1 |
2deb60186226b7a4f5123bcbeef73d45e6750b26
|
| SHA256 |
f8f22675f9a7481b33b98efab7882b94bac401991582a656be3a09ff108ac53d
|
| SHA3 |
d0832f763f7f0e98d778f3c0928807bdcf51bc9be793e8b34b71a23a036d4ac8
|
| VirtualSize |
0x68
|
| VirtualAddress |
0xe000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x9000
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
0.270919
|
| MD5 |
a9b84d46b6cf139ef26f775a78b475ad
|
| SHA1 |
5932b39728d9cf87ea6463c28b1ec8076529ca69
|
| SHA256 |
bb804ea5e9504558193621ad2bfab7b01bc6840556c9f62b52342e74329e4025
|
| SHA3 |
5a078a3b0a6d4f8e9374a59490c7a8c728ed7aa1b1654de16443d261696ab6c6
|
| VirtualSize |
0x68
|
| VirtualAddress |
0xf000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x9200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
0.197438
|
| MD5 |
26eb1111a21ce3ea36cb24142951b0d4
|
| SHA1 |
34ac5825b2b186714b91bb4dc698da6587304ad3
|
| SHA256 |
02d121881abb034c3ad46cadc310795a7fe4ebf39a1b303b5f1455401352274d
|
| SHA3 |
de1a8566d05a7f7b9988c34f7a8a374830040d6d5f6b4b4b9fc04309df65965d
|
| VirtualSize |
0x90
|
| VirtualAddress |
0x10000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x9400
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy |
1.61995
|
| libgcc_s_seh-1.dll |
_Unwind_Resume
|
| libstdc++-6.dll |
_ZNKSs5rfindEPKcy
_ZNKSs6substrEyy
_ZNKSs7compareEPKc
_ZNKSt5ctypeIcE13_M_widen_initEv
_ZNSo3putEc
_ZNSo5flushEv
_ZNSs12_M_leak_hardEv
_ZNSs12_S_constructEycRKSaIcE
_ZNSs3endEv
_ZNSs4_Rep10_M_destroyERKSaIcE
_ZNSs4_Rep10_M_disposeERKSaIcE
_ZNSs4swapERSs
_ZNSs6assignEPKc
_ZNSs6assignEPKcy
_ZNSs6assignERKSs
_ZNSs7replaceEyyPKcy
_ZNSsC1EPKcRKSaIcE
_ZNSsC1ERKSs
_ZNSt8ios_base4InitC1Ev
_ZNSt8ios_base4InitD1Ev
_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_x
_ZSt16__throw_bad_castv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt4cerr
_ZSt4cout
_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
_ZdlPv
_Znwy
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_seh0
|
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
__C_specific_handler
|
| msvcrt.dll |
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
free
fwrite
getenv
malloc
memcmp
memcpy
signal
strlen
strncmp
vfprintf
|
| Ordinal |
10
|
| Address |
0x4ec0
|
| StartAddressOfRawData |
0x40f000
|
| EndAddressOfRawData |
0x40f060
|
| AddressOfIndex |
0x40b6dc
|
| AddressOfCallbacks |
0x40e040
|
| SizeOfZeroFill |
0
|
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000000403250
0x0000000000403220
|
[*] Warning: Section .bss has a size of 0!